Privacy Policy

1. Data Controller

InsydrDeck is the data controller for personal data collected through our Service.

Contact: privacy@insydrdeck.com

2. Data We Collect

2.1 Account Data (when you register)

• Email address
• First and last name
• Country of residence
• Password (stored as a bcrypt hash — we never store your plain text password)
• Account creation date

2.2 Usage Data (automatically collected)

• Pages visited and features used
• Search queries within the platform
• Watchlist and portfolio items added
• Alert preferences set
• IP address and browser type
• Session timestamps

2.3 Payment Data

• Payment is processed by Stripe
• We do not store card numbers or payment details on our servers
• We receive only a transaction reference and subscription status from Stripe

2.4 Portfolio Data (if you use this feature)

• Stock tickers and positions you manually enter
• CSV files you upload
• This data is stored securely and never shared with third parties

3. How We Use Your Data

3.1 To provide the Service

• Authenticate your account
• Deliver your subscription benefits
• Send email alerts you have configured
• Display your personal portfolio analytics

3.2 To improve the Service

• Understand which features are most used
• Debug technical issues
• Improve platform performance

3.3 To communicate with you

• Send transactional emails (login, alerts)
• Notify you of important platform changes
• Send subscription receipts

We do not send marketing emails without your explicit consent.

4. Legal Basis for Processing (GDPR)

For EU/UK users, we process your data under:

• Contract: to provide the Service you subscribed to
• Legitimate interests: platform security and improvement
• Consent: for any optional communications
• Legal obligation: where required by law

5. Data Sharing

We do not sell your personal data.

We share data only with:

• Stripe (payment processing)
• Our hosting providers (Vercel, Railway) who process data on our behalf under data processing agreements
• Law enforcement when legally required

6. Data Retention

• Account data: retained while your account is active + 90 days after deletion request
• Usage logs: 12 months
• Payment records: 7 years (legal requirement)
• Portfolio data: deleted immediately on account deletion request

7. Your Rights (GDPR/UK GDPR)

If you are in the EU or UK, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time

To exercise these rights, email privacy@insydrdeck.com. We will respond within 30 days.

For EEA users: You have the right to lodge a complaint with your local supervisory authority.

8. Cookies

We use minimal cookies:

• Essential cookies: required for login sessions
• No advertising or tracking cookies
• No third-party analytics cookies

You can control cookies through your browser settings. Disabling essential cookies will prevent login.

9. Security

We protect your data with:

• bcrypt password hashing
• JWT tokens with expiry
• HTTPS encryption in transit
• Rate limiting on all endpoints
• Account lockout after failed login attempts
• Regular security reviews

10. International Transfers

Your data may be processed in:

• European Union (our primary servers)
• United States (Stripe, Vercel infrastructure)

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses.

11. Children

Our Service is not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We will notify you of material changes via email or prominent platform notice with 30 days advance notice where possible.

13. Contact & Complaints

Data protection enquiries: Email privacy@insydrdeck.com

If you are unhappy with how we handle your data, you have the right to complain to:

• UK: Information Commissioner’s Office (ico.org.uk)
• EU: Your national data protection authority