Privacy Policy

1. Introduction

SimpleTrade, operated by [COMPANY LEGAL ENTITY] ("we", "us", or "our"), respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. Please read it carefully.

2. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and authentication credentials. Authentication is handled securely through Supabase.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, stocks analyzed, and interaction patterns. This data is collected through PostHog analytics to help us improve the product.

User-Generated Content

We store content you create within the Service, including watchlists, trade journal entries, alert configurations, follow-up chat messages, and preferences.

Payment Information

Payment processing is handled entirely by Stripe. We do not store your credit card number, CVV, or full payment details on our servers. We receive from Stripe only the information necessary to manage your subscription (such as subscription status, billing period, and a payment method identifier).

Technical Data

We automatically collect certain technical information, including IP address, browser type, device type, operating system, and referring URLs. This is used for security, debugging, and service improvement.

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service (legal basis: performance of contract).
• Process transactions and manage subscriptions (legal basis: performance of contract).
• Send you service-related communications such as account verification, security alerts, and subscription updates (legal basis: performance of contract / legitimate interest).
• Generate AI-powered analysis tailored to your watchlist and preferences (legal basis: performance of contract).
• Monitor and analyze usage trends to improve user experience (legal basis: legitimate interest).
• Detect and prevent fraud, abuse, and security incidents (legal basis: legitimate interest / legal obligation).
• Comply with legal obligations (legal basis: legal obligation).

Where processing is based on legitimate interest, you have the right to object. See Section 8.

4. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — Authentication and database hosting.
• Stripe — Payment processing and subscription management.
• PostHog — Product analytics and usage tracking.
• Vercel — Application hosting and edge delivery.
• Upstash (Redis) — Caching and rate limiting.
• DeepSeek(operated by DeepSeek AI, People's Republic of China) — Primary AI analysis provider. We send market and analytical data to DeepSeek to generate stock analysis. Follow-up chat conversations, including your message history, are also sent to this provider to generate responses. We do not include your name, email address, or account identifiers in these requests.
• Helicone— LLM observability and request logging. Helicone processes AI request and response data for monitoring and debugging purposes.
• Market Data Providers(including Yahoo Finance, Finnhub, Financial Modeling Prep, BRAPI, and Tavily) — These services receive stock ticker symbols and related market queries to return financial data and news. They may log your IP address and request metadata in accordance with their own privacy policies.

Each of these services has its own privacy policy. We recommend reviewing them for complete information.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).

Cached analysis data and aggregated or pseudonymized usage analytics may be retained for longer periods. Pseudonymized data retains a link to a user identifier but has personal details removed; it is not the same as fully anonymized data.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS).
• Row-level security (RLS) policies on database tables.
• Secure authentication with password hashing.
• Environment-level separation of API keys and secrets.

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Cookies and Tracking

We use the following types of cookies and similar technologies:

• Essential cookies — Required for authentication and session management. These cannot be disabled without breaking core functionality.
• Analytics cookies — PostHog uses cookies and local storage to track usage patterns, page views, and feature interactions. These are non-essential. You can opt out by adjusting your browser settings or contacting us, though doing so may affect some Service functionality.

We do not use session recording or heatmap tools.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated personal data.
• Request a copy of your personal data in a portable format by contacting us at the address below.
• Object to processing based on legitimate interest.
• Withdraw consent where processing is based on consent.
• Restrict processing in certain circumstances.

You can delete your account through the Settings page. For all other requests — including data access, correction, portability, or objection — contact us at privacy@simpletrade.app.

If you are located in Brazil, you have additional rights under the Lei Geral de Proteção de Dados (LGPD), including the right to be informed of the legal basis for processing and to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). If you are located in the European Economic Area, you have rights under the GDPR and may lodge a complaint with your local supervisory authority.

9. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

10. International Data Transfers

Your data may be processed and stored in countries other than your own, including countries that may not have data protection laws equivalent to those in your jurisdiction. Specifically:

• AI analysis requests are processed by DeepSeek, which operates in the People's Republic of China.
• Other service providers (Vercel, Supabase, Stripe, PostHog, Upstash) operate primarily in the United States and European Union.

Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) or other appropriate transfer mechanisms to ensure an adequate level of protection for your data. By using the Service, you acknowledge these transfers. If you have concerns about international transfers, contact us at the address below.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last updated" date, and — where practicable — sending a notification to the email address associated with your account. Your continued use of the Service after changes constitutes acceptance.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at privacy@simpletrade.app.