Privacy Policy

1. Introduction

Strategy Investor ("we," "our," or "us") operates the platform at strategy-investor.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and handling your data in an open and transparent manner.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Data: Name, email address, and password when you register
• Profile Information: Investment preferences, risk tolerance, and financial goals you optionally provide
• Portfolio Data: Portfolios, positions, watchlists, and custom strategies you create within the Service
• Billing Information: Payment method details are processed securely by Stripe, Inc. We store only a tokenized reference — never your full card number
• Communications: Support inquiries and feedback you send us

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, interaction patterns, and search queries
• Device Data: Browser type, operating system, screen resolution, and device identifiers
• Log Data: IP address, access times, referring URLs, and error logs
• Cookies & Local Storage: Authentication tokens, theme preferences, and session identifiers (see Section 6)

2.3 Information from Third Parties

• Market Data Providers: We receive financial data (stock prices, fundamentals, news) from providers like Financial Modeling Prep (FMP) to power the Service
• Brokerage Services: If you connect a broker (e.g., via SnapTrade), we receive portfolio positions and account status to display within the Service

2.4 Product & Usage Analytics

To understand how the Service is used and where it can be improved, we collect a limited set of privacy-preserving product-analytics events — for example, which steps of a workflow you reach and where users tend to drop off.

• What we record: a fixed, predefined set of named actions (such as viewing a page, creating a portfolio, running a backtest or analysis, viewing a strategy, connecting a broker, starting checkout, or submitting a trade), together with the page or route involved, an anonymous session identifier, your subscription tier, whether you are on desktop or mobile, and timestamps.
• What we do not record: we never capture keystrokes, the contents of forms or text fields you fill in, search text, or specific financial amounts in these analytics events.
• Pseudonymized by design: each event is linked only to a one-way, salted cryptographic hash — never your name, email, or account ID — and that hash cannot be reversed to re-identify you.
• Consent-based and optional:these events are collected only if you enable "Analytics" in the cookie banner. They are off by default until you opt in, and you can withdraw consent at any time (via "Manage Cookies" in the footer), which stops further collection.
• Limited access and use: only authorized administrators can view this data, and only in aggregate, to improve product quality and reliability. We do not sell it and do not use it for third-party advertising.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and manage subscriptions
• Generate personalized investment analysis and portfolio recommendations
• Send transactional emails (account verification, password resets, billing receipts)
• Provide customer support and respond to inquiries
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

We do not sell your personal information to third parties for marketing purposes.

4. Data Sharing & Disclosure

We may share your information with the following categories of recipients:

4.1 Service Providers

• Stripe, Inc. — payment processing (PCI DSS Level 1 compliant)
• SnapTrade — brokerage integration (when you opt in)
• Sentry — error monitoring and application performance (anonymized technical data only)
• Hosting Provider — server infrastructure (data encrypted at rest and in transit)

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is subject to a different privacy policy.

5. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted via TLS/SSL
• Passwords are securely hashed using a modern, industry-standard algorithm — we never store them in plain text
• Database access is restricted and credentials are rotated regularly
• Authentication uses JWT tokens with expiration and refresh mechanisms
• API rate limiting protects against abuse
• Regular security audits and dependency vulnerability scanning

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

6. Cookies & Tracking Technologies

We use the following cookies and local storage:

We do not use third-party advertising cookies or cross-site tracking. You can disable cookies in your browser settings, but some features may not function correctly.

If you enable Analyticsconsent, we also collect the privacy-preserving product-analytics events described in Section 2.4. Declining Analytics disables both Sentry performance monitoring and product-analytics event collection. You can change this choice at any time via "Manage Cookies" in the footer.

7. Data Retention

We retain your data as follows:

• Account data: Retained for the duration of your account and 30 days after deletion request
• Portfolio & investment data: Retained while your account is active; deleted within 90 days of account closure
• Usage logs: Retained for up to 12 months, then anonymized or deleted
• Product-analytics events: Raw behavioral events are automatically deleted after 90 days; only de-identified, aggregated metrics are kept beyond that period
• Billing records: Retained for 7 years as required by financial regulations

8. Your Rights

8.1 General Rights (All Users)

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data
• Export: Request a machine-readable copy of your data (data portability)

8.2 GDPR Rights (EEA/UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to restrict processing of your personal data
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with your local data protection authority

Our legal bases for processing include: performance of a contract (providing the Service), legitimate interests (improving the Service, security), and consent (optional features).

8.3 CCPA Rights (California Residents)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

9. International Data Transfers

Your data is processed and stored on servers located in the United Kingdom. Transfers of personal data from the European Economic Area to the UK are covered by the European Commission's adequacy decision for the United Kingdom. For users located elsewhere, any international transfer is governed by appropriate safeguards, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately and we will promptly delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page with an updated "Last updated" date. For significant changes, we will provide notice via email or a prominent notice on the Service.

12. Contact Us

For privacy-related inquiries or to exercise your data rights:

• Email: support@strategy-investor.com
• Support: strategy-investor.com/support

We will respond to your request within 30 days (or sooner as required by applicable law).