Privacy Policy
Last updated: 6 August 2026
1. Who is responsible
The operator of Investment Intelligence is the data controller for the personal data described here. Contact: privacy@example.com.
2. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Account identity, sign-in, service email | Performance of a contract |
| Password (hashed, never stored in plain text) | Authentication | Performance of a contract |
| Investor profile and settings | Decides which weighting your scores use | Performance of a contract |
| Watchlist and alert thresholds | The feature itself, and the daily digest | Performance of a contract |
| Usage events (scores viewed, searches, watchlist additions) | Enforcing plan limits and understanding whether the product is useful | Legitimate interests |
| Audit records of score calculations and generated explanations | Regulatory explainability — showing how any figure you saw was produced | Legal obligation and legitimate interests |
We do not collect financial account details, holdings, or transactions. We do not know what you own. There is no broker connection and no payment data on our servers — if paid plans are introduced, card details will be handled by the payment provider and never reach us.
3. Cookies
We set a session cookie when you sign in. It is strictly necessary to keep you signed in and cannot be switched off while you are using an account. Your theme preference is stored locally in your browser and is never sent to us.
Any analytics cookie is optional and off until you choose otherwise. The banner has no pre-ticked boxes, refusing is one click, and refusing changes nothing about how the product works. You can change your choice at any time from the footer.
4. AI-generated explanations
Written explanations of a score are produced by a language model operated by OpenAI. The model receives only the score breakdown for the stock you are looking at — the numbers, the weights, and the metric names. It does not receive your email address, your account, your watchlist, or anything else identifying you.
The model never computes a number. Every figure in an explanation comes from the breakdown that was calculated before the model was called, and text that cites a figure absent from that breakdown is rejected automatically and never shown.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and settings | Until you delete your account |
| Watchlists | Until you delete them, or the account |
| Usage events | 24 months |
| Detailed score breakdowns | 90 days, after which the headline scores remain and the components are dropped |
| Audit records | Retained, anonymized on erasure — see below |
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Two of these are built into the product and take effect immediately:
- Export — Settings → Your data → Download. Returns everything we hold about you as a JSON file.
- Erasure — Settings → Your data → Delete account. Your email, password, settings, watchlists, and usage history are removed immediately.
One carve-out, stated plainly: the audit record of score calculations is not deleted. It is what lets us demonstrate, afterwards, how a figure shown to any user was produced, and we are required to be able to do that. On erasure those records are disconnected from you — your user reference is removed and what remains cannot be traced back to you. No email address, and nothing you did as an identifiable person, is kept.
You may also complain to your national data protection authority. For requests not covered by the buttons above, write to privacy@example.com; we respond within one month.
7. Sharing and transfers
We share data only with the processors needed to run the service: our hosting and database provider, our email provider, our error-tracking provider, and OpenAI for the explanations described above. Each is bound by a data processing agreement. Where a processor is outside the EEA, transfers rely on Standard Contractual Clauses.
We do not sell personal data and we do not share it for advertising.
8. Security
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Access to production data is limited to those who need it, and every score calculation and generated explanation is written to an append-only audit log that cannot be altered after the fact.
9. Changes
Material changes will be notified by email before taking effect. The date at the top of this page always reflects the current version.