Privacy Policy

• Email address
• Password, stored as a salted bcrypt hash. We cannot access your plain-text password at any time.
• Display name (if you provide one)
• Account creation timestamp
• Subscription tier and billing status
• Timezone preference
• Marketing and notification preferences

• IP address at each login
• User agent string (browser and operating system)
• Session tokens (managed by Supabase Auth)
• Login history and timestamps

• Subscription status and billing dates
• Stripe Customer ID (an opaque reference, not your card)
• Payment method type and the last four digits of your card only
• Billing country (for tax compliance)
• An anonymous fingerprint of your payment method, supplied to us by Stripe, used only to enforce one free trial per person. It is a one-way reference and cannot be turned back into your card number.
• Promotional or discount codes you redeem
• Refund requests you email to us, including the request itself and our decision

Refund requests are made by email to support@insiderpulse.org and are handled manually by a person at InsiderPulse. That email, and the record of the outcome, is stored with your billing records and used only to assess and process the refund, to prevent abuse, and to meet our tax and accounting obligations.

We do not store your full credit card number, CVC, or expiration date. All payment card data is collected and processed directly by Stripe, Inc. in its PCI DSS Level 1 compliant environment. InsiderPulse never sees your full payment details.

• Watchlist selections (tickers you follow)
• Active Signals you interact with
• AI Assistant query history (your messages and our responses), including saved conversations you can revisit and delete
• Browse Assets filter and search history
• Alert configurations and trigger history
• Pages, boards and tools you open, and product milestones such as signup, trial start and subscription
• Feature usage patterns and timestamps

If you choose to use these optional personal tools, we collect and store what you enter:

• Trading Profile: your preferred name, trading style, experience level, markets and sectors of interest, risk appetite, account size band, screen time, stated challenges and goals, your free text description of how you trade, and your chosen assistant tone
• Trade Journal: the trades you record, including ticker, direction, dates, entry and exit prices, quantity, stop price, profit or loss, setup, emotion, mistakes, and any notes you write
• Screenshots you upload to import a trade, stored privately in your own folder and readable only by you through short lived expiring links
• Written AI reads generated for you, including Your Edge Today and trade reflections, together with the summary inputs used to produce them

This information is used to personalise what you see, to calculate your own journal statistics, and to produce your written reads. It is visible only to you. Uploaded screenshots are sent to our AI image reader to extract the trade details (see clause 5.3) and are deleted from storage when you delete the matching journal entry or your account.

Please do not include information about other people, account numbers, or sensitive information in journal notes, profile free text, or uploaded images.

If you choose to connect a third-party brokerage account through Settings, we collect and store:

• The name of the brokerage (Alpaca, Binance, Coinbase, Interactive Brokers, Kraken)
• Your brokerage API key and API secret, encrypted using AES-256 encryption at rest before storage
• Metadata about the connection (connection timestamp, last verification timestamp)
• Trade orders you submit through the Platform (ticker, quantity, direction, timestamp)

Your brokerage credentials are stored encrypted. They are decrypted only at the moment of a trade execution request you initiate and are never displayed back to you in plain text. We do not transmit them to any third party other than the brokerage itself for the purpose of executing your trade instructions.

• IP address
• Browser type and version
• Operating system and device type
• Approximate geolocation derived from IP address (country or region level only)
• Referring URL (how you arrived at the Platform)

• Open rates, click-through rates, and unsubscribe actions from marketing emails
• Collected via Brevo email tracking pixels embedded in marketing emails only. Transactional emails (receipts, security alerts, account changes) do not include tracking pixels.

• Session cookies (essential for authentication and security)
• Preference cookies (to remember your display settings)
• Advertising measurement identifiers set by the Meta, TikTok and Google Ads tags described in clause 5.5 and Section 11

We do not use analytics cookies of our own, and we do not use cross-site tracking cookies beyond the advertising measurement tags described in Section 11, which you can block without losing access to any part of the Platform.

• Sensitive information as defined under APP 3 (health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, biometric data, criminal record) is not intentionally collected. Do not include such information in AI Assistant queries, journal notes, uploaded images, support emails, or any other submission to the Platform. If you inadvertently submit sensitive information, contact support@insiderpulse.org to request deletion.
• We do not purchase personal information from data brokers or third parties.
• We do not use session replay, heatmap tracking, or device fingerprinting for tracking or profiling. The only fingerprint we hold is the anonymous payment method reference described in clause 2.3, used solely to enforce one free trial per person.
• We do not sell your personal information to any third party. See Section 5.
• We do not use your data to train any artificial intelligence model.

Supabase, Inc.: database, authentication, file storage, edge functions. Stores: email, hashed password, account data, watchlists, AI query history, encrypted broker credentials, usage data, session tokens. Data stored in AWS Sydney (Australia). SOC 2 Type II certified.

Lovable Labs Inc.: application hosting and AI Gateway. Stores: IP addresses, browser type, page access timestamps, application logs. The Lovable AI Gateway routes AI Assistant queries from the Platform to underlying AI providers (see Section 5.2). Chat content passes through the Gateway during routing. Data stored in United States and Sweden.

Railway Corp.: application logs including IP addresses and request metadata. Data stored in United States.

Cloudflare, Inc.: domain name system (DNS), email routing for support@insiderpulse.org, and content delivery for public assets. Cloudflare sees request IP addresses and requested URLs for public pages served via its network but does not receive authenticated session data or form submissions. Data stored globally across Cloudflare's network.

Stripe, Inc.: processes all payment card transactions. Receives: your email address (to create or locate your customer profile), plan selection, billing country, and payment card details you enter directly on Stripe's hosted checkout page. Stripe is PCI DSS Level 1 compliant. Data stored in United States. We retrieve your subscription status from Stripe on demand; Stripe does not push webhook notifications to us.

Lovable AI Gateway: routes your AI Assistant chat messages to upstream AI providers. The Gateway receives the full content of your messages, your watchlist context (tickers), and any conversation history needed for response continuity. The Gateway does not retain messages beyond operational routing and does not use them to train any model.

Google LLC (Gemini API): generates responses to AI Assistant queries. Receives the query content and context passed from the Lovable Gateway. Under Google's paid API terms, prompts are retained for 55 days for safety monitoring purposes only and are not used to train any Google model. We take reasonable steps to strip directly identifying information (name, email) before transmission, but we cannot guarantee that query content is free of incidental personal information you may include. Data stored in United States.

ElevenLabs, Inc.: converts text to speech if you use the audio features of the AI Assistant. Receives only the text you explicitly request be voiced (maximum 5,000 characters) with no user identifier. Data stored in United States.

Tavily Research, Inc.: provides real-time web search results for the AI Assistant. Receives only the sanitised search query. Data stored in United States.

Firecrawl, Inc.: retrieves publicly available web pages for AI Assistant research and market data ingestion. Receives only URL or search query strings. No user personally identifiable information. Data stored in United States.

Screenshot import: if you upload an image of a trade, the image is sent through the Lovable AI Gateway to Google (Gemini) for the sole purpose of reading the trade details shown in it. The image is not sent with your name or email attached, is not retained by the provider beyond routing and short term safety monitoring, and is not used to train any model. The image itself is stored privately in our own storage against your account until you delete it.

Personalised written reads: when you request Your Edge Today or a trade reflection, the summary of your Trading Profile and, for reflections, a condensed summary of your own journal entries is sent to the AI provider to generate the text. Your email address and name are not included.

Brevo (Sendinblue SAS): delivers transactional and marketing emails. Receives your email address, email content we send, and email engagement metrics for marketing emails only. Data stored in European Union.

Meta Platforms, Inc. (Meta Pixel), TikTok Pte. Ltd. (TikTok Pixel), and Google LLC (Google Ads conversion tracking): measure which advertisements bring visitors to the Platform. Each receives your IP address, browser and device details, the pages you view on the Platform, and milestone events such as completing a signup, starting a trial, and subscribing, together with an advertising identifier set in your browser. None of them receives your name, postal address, payment card details, watchlists, alerts, AI queries, or brokerage data. Data stored in United States and globally.

Section 11 explains how to block or opt out of this measurement, and doing so does not affect your access to the Platform.

TwelveData, Inc.: stock, ETF, and forex price data. Receives ticker symbols and query parameters only. No user PII. Data stored in Singapore.

Finnhub: financial news and market data. Receives API key only. No user PII.

OpenFIGI (Bloomberg L.P.): security identifier mapping. Receives CUSIP or ISIN identifiers only. No user PII.

CoinGecko, Blockchain.com, Etherscan: public cryptocurrency on-chain data. Public endpoints. No user PII transmitted.

EOD Historical Data (EODHD), Polygon.io, and Alpha Vantage: daily price history, corporate actions and reference data used for the boards, charts and session statistics. Receive ticker symbols and query parameters only. No user PII.

US Securities and Exchange Commission (EDGAR), Federal Reserve Economic Data (FRED), Commodity Futures Trading Commission, and other public government sources: insider filings, institutional holdings, economic indicators and positioning data. Public endpoints. No user PII transmitted.

Quiver Quantitative and Benzinga: congressional trading disclosures and market news metadata. Receive API key only. No user PII.

Reddit and StockTwits: publicly posted market commentary used to measure social attention on tickers. We read public posts only. Receive no information about you, and no post is linked to any InsiderPulse account.

If you connect a brokerage account, your brokerage API credentials and trade orders are transmitted to the brokerage you selected. We send only what is required to execute your trade instructions.

• Alpaca Securities LLC: United States
• Binance Holdings Ltd.: Cayman Islands, global operations
• Coinbase Global, Inc.: United States
• Interactive Brokers LLC: United States
• Kraken (Payward, Inc.): United States

Each brokerage has its own Privacy Policy and terms. By connecting a brokerage, you authorise us to transmit data between that brokerage and the Platform for the purposes you select. The brokerage's handling of your information is governed by the brokerage's own privacy policy, which we recommend you review before connecting.

We may disclose your information to our legal advisors, accountants, auditors, or regulators where required by law or necessary to establish, exercise, or defend legal claims.

If we are involved in a merger, acquisition, sale of assets, or insolvency, your information may be transferred to the acquiring entity or administrator. We will notify you of any such transfer and your rights in respect of it.

Each overseas recipient listed above processes personal information under a Data Processing Agreement (or equivalent) containing confidentiality, security, and cross-border transfer obligations. Where Standard Contractual Clauses are required under GDPR Article 46, they have been executed.

The Platform uses artificial intelligence and algorithmic scoring to generate market analysis, asset scores, signal summaries, and conversational responses based on your queries and publicly available market data.

We do not use automated decision-making that produces legal effects on you or similarly significant effects, as defined under GDPR Article 22. We do not make credit decisions, employment decisions, insurance decisions, or eligibility determinations based on automated processing.

All AI-generated outputs are automated informational data points. They may contain errors, biases, hallucinations, or inaccuracies. They are not financial advice, recommendations, or statements of opinion intended to influence any investment decision. You should not rely on AI outputs as the sole basis for any decision. See our Terms of Service Section 4 for the full financial disclaimer.

We do not use your personal information, chat history, or any identifiable data to train any AI model. Our AI provider (Google Gemini) also does not use your API content to train their models under our paid API terms.

You may request:

• Access to the personal information we hold about you
• Correction of inaccurate information
• Deletion of your account and personal data
• A copy of your data in a portable format

We respond within 30 days at no charge, other than reasonable costs in complex cases (which we will disclose in advance).

You additionally have:

• The right to restrict processing (Art 18)
• The right to object to processing based on legitimate interests (Art 21)
• The right to data portability (Art 20)
• The right to lodge a complaint with a supervisory authority
• The right to withdraw consent at any time without affecting the lawfulness of prior processing

You have:

• The right to know what personal information we collect and why
• The right to delete personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information for cross-context behavioural advertising
• The right to limit use and disclosure of sensitive personal information
• The right to non-discrimination for exercising these rights

We do not sell or share your personal information as defined by the CCPA. We do not use sensitive personal information for purposes beyond what is required to provide the Platform.

You have rights substantially similar to those described for Californian users under applicable state law.

Email support@insiderpulse.org from the email address associated with your account. We respond within 30 days. You may also use the in-app Data Export feature (Settings → Delete Account → Download my data) to obtain a complete copy of your data at any time without contacting us.

We do not offer anonymous or pseudonymous access to paid tiers of the Platform, because an identifiable email and payment method are required to process subscriptions, handle billing disputes, and meet our tax and anti-fraud obligations. If you have concerns about this, you may use a dedicated email and a privacy-preserving payment method such as a virtual card.

Strictly necessary cookies: session management, authentication, and security. Cannot be disabled without breaking core Platform functionality.

Preference cookies: remembers your display preferences and theme settings. Can be disabled via your browser.

We advertise InsiderPulse on third-party platforms. To understand which advertisements bring people to the Platform, and to avoid wasting money on advertising that does not work, we use advertising measurement tags supplied by those platforms.

The tags currently in use are:

• Meta Pixel (Meta Platforms, Inc.), which records page views and milestones such as completing a signup, starting a trial, and subscribing
• TikTok Pixel (TikTok Pte. Ltd.), which records the same milestones
• Google Ads conversion tracking (Google LLC), which records advertisement-attributed signups and trial starts

These tags set cookies or similar identifiers, may record your IP address and browser details, and report the milestone events listed above back to the relevant advertising platform, which may use them to measure advertisement performance, build audiences, and show you advertisements. We do not send them your name, your postal address, your payment card details, your watchlist, your alerts, or any of your portfolio or research activity.

We do not sell your personal information, and we do not use session replay, heatmap tools, or behavioural fingerprinting.

Stripe may place cookies during payment processing for fraud detection purposes as described in Stripe's own privacy policy. Brevo embeds tracking pixels in marketing emails to measure engagement. These can be bypassed by disabling images in your email client or unsubscribing.

Australian law does not require a cookie consent banner for the cookies described in clause 11.1. Advertising measurement tags are covered by this policy and by the advertising platforms' own privacy policies, which also provide their own advertisement settings and opt-out controls.

Visitors in the European Economic Area, the United Kingdom and Switzerland are shown a consent banner on their first visit. No advertising or measurement tag loads for those visitors until they choose to accept, and choosing only essential cookies leaves the Platform fully usable. You can change your choice at any time from the cookie settings link in the footer.

Visitors in United States states that recognise the Global Privacy Control browser signal: where your browser sends that signal we treat it as an instruction not to sell or share personal information for advertising, and advertising tags do not load.

Marketing email in the European Economic Area, the United Kingdom and Switzerland is sent only to people who tick the separate optional box at signup, and every marketing email carries a one click unsubscribe.

You can block or delete these cookies through your browser settings, use your browser's tracking protection or a content blocker, or use the advertisement settings offered by Meta, TikTok, and Google. Blocking them does not affect your access to any part of the Platform, and the Platform continues to work normally.

If you would prefer that we exclude your account from advertising measurement entirely, email support@insiderpulse.org and we will action it.

When you create an account, we treat your signup as express consent to receive marketing and product-update emails, subject to your ability to opt out at any time. Spam Act 2003 (Cth) recognises inferred consent for existing customers for related product categories; we nevertheless treat signup as express consent to apply the same standard globally.

Transactional emails (receipts, security alerts, subscription changes, data export notifications, account deletion confirmations) are not commercial messages under the Spam Act 2003 and will continue to be sent after you unsubscribe from marketing. You cannot opt out of transactional emails while your account is active.

• Click the unsubscribe link in any marketing email
• Email support@insiderpulse.org with the subject line "Unsubscribe"
• Adjust your preferences in Settings → Notifications

We process unsubscribe requests within 5 business days as required by the Spam Act 2003.