Legal
Privacy policy
This policy explains what personal data StocksControl processes, why it is used, who may receive it and how users can exercise their rights.
1. Data controller
Controller: Carlos Perea. Address: Hills 7, San Bartolomé de Tirajana, Las Palmas, Spain. Tax identification number pending confirmation. General and privacy contact: [email protected].
This policy applies to the StocksControl website, application and interfaces. No data protection officer has been appointed because the processing currently envisaged has not been identified as requiring one.
2. Data we process
- Account and identity: email address, alias, role, verification status, preferences and a cryptographically hashed password.
- Security and access: sessions, revocable tokens, MFA if enabled, IP addresses, user agent, authentication events and technical logs.
- Personal use of the product: portfolios and entered transactions, watchlists, notes, resources, filters, strategies, alerts, preferences and calendars.
- Research and community: drafts, revisions, analyses, attachments, share links, selected visibility, contributions, ratings, relevance signals, reports and moderation decisions.
- Support and communications: feedback, requests, support conversations, email preferences and push notifications.
- Billing: customer, checkout, subscription, product, price or coupon identifiers; status and period dates. StocksControl does not store full card numbers.
- Visitor and device: a signed random identifier used to enforce quotas, selected theme, push endpoint if authorized and request-level technical data.
3. Purposes and lawful bases
- Contract and pre-contract steps: create accounts, authenticate users, provide features, synchronize preferences and manage plans, payments and requested support.
- Legal obligations: accounting, taxation, data-subject requests, fraud prevention and responses to competent authorities.
- Legitimate interests: protect accounts and infrastructure, prevent abuse, enforce quotas, diagnose faults, keep minimum records and defend claims after balancing user rights.
- Consent: optional communications, newsletter and push notifications when requested. Consent can be withdrawn through available preferences or by email.
- Publication requested by the user: display content according to the selected community, public or private-link visibility and enable related interactions.
Company scores and models analyze companies and instruments, not people, and are not used to make decisions about users that have legal effects. Automated access, quota and security controls can be challenged by email.
5. Providers and recipients
Providers receive only the data they need to perform their services and act under the applicable contractual terms. The current main categories are:
- DigitalOcean: infrastructure, database and object storage. The controller states that the primary infrastructure is in Amsterdam, the Netherlands.
- Stripe: checkout, payments, automatic renewals, fraud prevention and subscription status.
- Mailgun: delivery of verification, account recovery, security and optional communications.
- Financial Modeling Prep (FMP), the SEC and Nasdaq: financial and regulatory information. Ordinary requests do not require private account content to be sent.
- Browser or operating-system push services: receive the technical endpoint needed when the user enables notifications.
- Other members or any visitor: only when a user publishes content as community or public, or voluntarily provides a private share link.
6. International transfers
The primary infrastructure is hosted in the European Economic Area. Global providers such as Stripe, Mailgun, push providers or financial-data sources may process technical or service data outside the EEA.
Where a transfer is subject to the GDPR, an adequacy decision, Standard Contractual Clauses or another valid safeguard will be used as appropriate. Users may request further information about applicable safeguards through the privacy contact.
7. Retention
Account and workspace data is retained while the account is active. Following a closure request, it will be erased or anonymized when no longer needed, except for blocked data that must be retained for legal duties, fraud prevention or the defence of claims.
Access, verification and recovery tokens expire according to their technical lifetimes; sessions can be revoked. Billing and contracting records are retained for applicable tax, accounting and limitation periods. Security and support records are retained only for a period proportionate to their purpose.
Published content remains until the user withdraws it or it is moderated. Withdrawal cannot delete copies lawfully made by others. Backups and technical queues are erased according to their rotation cycles and may take an additional reasonable period.
8. Individual rights
Where applicable, users may request access, correction, erasure, objection, restriction, portability and protection from decisions based solely on automated processing. They may withdraw consent without affecting earlier processing and lodge a complaint with the Spanish Data Protection Agency or another competent authority.
To exercise a right, email [email protected] from the affected account or provide enough information to verify your identity. Requests are free unless manifestly unfounded or excessive as permitted by law. We will normally respond within one month, subject to any extension allowed by the GDPR.
9. Security and user choices
Controls include permission separation, transport encryption, hashed credentials, protected sessions, optional MFA, revocable tokens and database-level validation. No system can guarantee absolute security.
Users choose whether to publish an analysis or create a private link. Anyone who knows a share link can read that report until the link is revoked. Users should not place secrets or unnecessary personal data in notes, resources, analyses or support requests.
10. Children and changes
StocksControl is intended for people aged 18 and over and does not knowingly collect children’s data. If an underage account is identified, reasonable steps will be taken to close it and erase the data where appropriate.
This policy may be updated to reflect legal, technical or provider changes. The current version and its date will remain available at this address; material changes will be communicated reasonably.
