Privacy Policy

1. Introduction

Strategy Investor ("we," "our," or "us") operates the platform at strategy-investor.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and handling your data in an open and transparent manner.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Data: Name, email address, and password when you register
• Profile Information: Investment preferences, risk tolerance, and financial goals you optionally provide
• Portfolio Data: Portfolios, positions, watchlists, and custom strategies you create within the Service
• Billing Information: Payment method details are processed securely by Stripe, Inc. We store only a tokenized reference — never your full card number
• Communications: Support inquiries and feedback you send us

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, interaction patterns, and search queries
• Device Data: Browser type, operating system, screen resolution, and device identifiers
• Log Data: IP address, access times, referring URLs, and error logs
• Cookies & Local Storage: Authentication tokens, theme preferences, and session identifiers (see Section 6)

2.3 Information from Third Parties

• Market Data Providers: We receive financial data (stock prices, fundamentals, news) from providers like Financial Modeling Prep (FMP) to power the Service
• Brokerage Services: If you connect a broker (e.g., via SnapTrade), we receive portfolio positions and account status to display within the Service

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and manage subscriptions
• Generate personalized investment analysis and portfolio recommendations
• Send transactional emails (account verification, password resets, billing receipts)
• Provide customer support and respond to inquiries
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

We do not sell your personal information to third parties for marketing purposes.

4. Data Sharing & Disclosure

We may share your information with the following categories of recipients:

4.1 Service Providers

• Stripe, Inc. — payment processing (PCI DSS Level 1 compliant)
• SnapTrade — brokerage integration (when you opt in)
• Sentry — error monitoring and application performance (anonymized technical data only)
• Hosting Provider — server infrastructure (data encrypted at rest and in transit)

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is subject to a different privacy policy.

5. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted via TLS/SSL
• Passwords are hashed using Argon2id (winner of the Password Hashing Competition)
• Database access is restricted and credentials are rotated regularly
• Authentication uses JWT tokens with expiration and refresh mechanisms
• API rate limiting protects against abuse
• Regular security audits and dependency vulnerability scanning

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

6. Cookies & Tracking Technologies

We use the following cookies and local storage:

We do not use third-party advertising cookies or cross-site tracking. You can disable cookies in your browser settings, but some features may not function correctly.

7. Data Retention

We retain your data as follows:

• Account data: Retained for the duration of your account and 30 days after deletion request
• Portfolio & investment data: Retained while your account is active; deleted within 90 days of account closure
• Usage logs: Retained for up to 12 months, then anonymized or deleted
• Billing records: Retained for 7 years as required by financial regulations

8. Your Rights

8.1 General Rights (All Users)

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data
• Export: Request a machine-readable copy of your data (data portability)

8.2 GDPR Rights (EEA/UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to restrict processing of your personal data
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with your local data protection authority

Our legal bases for processing include: performance of a contract (providing the Service), legitimate interests (improving the Service, security), and consent (optional features).

8.3 CCPA Rights (California Residents)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

9. International Data Transfers

Your data may be processed on servers located outside your country of residence. We ensure that any international data transfers comply with applicable data protection laws through appropriate safeguards, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately and we will promptly delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page with an updated "Last updated" date. For significant changes, we will provide notice via email or a prominent notice on the Service.

12. Contact Us

For privacy-related inquiries or to exercise your data rights:

• Email: privacy@strategy-investor.com
• Support: strategy-investor.com/support

We will respond to your request within 30 days (or sooner as required by applicable law).