This Privacy Policy explains how personal data is processed when you use StockPilo, the web application at www.stockpiloapp.com (the "Service").
01
Who we are (controller)
The controller of your personal data is:
Vebify OÜ Registry code: 17183973 (Estonian Commercial Register) Address: Aaslina tn 5, Haabersti linnaosa, Tallinn, 13516, Harju maakond, Estonia Email: privacy@stockpiloapp.com
02
What data we process
2.1 Account data
Email address and password. Passwords are stored by our database provider (Supabase Auth) only as a salted hash; we never see them in plain text.
Google Sign-In. If you sign in with Google, Google shares your email address, name and profile picture with us (OAuth scopes openid email profile). We do not receive your Google password.
Profile (profiles table): username, full name, avatar (uploaded image stored in our avatars storage bucket, or the URL of your Google picture), email-verification status, account creation and last sign-in time.
Onboarding answers you choose to give: investing experience level, how you heard about us / referral source.
Settings: language, currency, refresh interval, summary length, dashboard layout, notification preferences (email notifications, earnings, news, market events, price alerts, AI insights), and flags that record whether you have seen the tour or a trial message.
Acceptance of the Terms and this Privacy Policy: we record which version of the Terms you accepted and when, timestamped by our server, in a record you can read but not change (terms_acceptances). For email sign-up this is the ticked checkbox, recorded when the account is created; for Google sign-up it is continuing with Google under the notice that doing so means you agree. The record is kept while you have an account and deleted with it.
Security and session data held by Supabase Auth: sessions and refresh tokens, and the IP address and browser user-agent recorded with sign-in events.
2.2 Content you create in the Service
Watchlist (user_stocks): the tickers you follow.
Holdings (user_stock_lots): ticker, quantity, buy price, buy date and currency of positions you enter manually. We do not connect to any broker or bank account.
Investment notes ("theses") (user_stock_thesis and its history): the text you write about a stock, its tags and the price when saved.
Pilo agent instructions (pilo_agents, agent_instructions, agent_runs): the free-text instruction you give your agent, the plan compiled from it and a log of each run.
Alerts and saved items: price/volume alert settings, earnings alerts, saved Risk Lab scenarios and their alert preferences, and the Congress members and company insiders you follow (user_followed_people).
Push notification devices (push_subscriptions): if you turn on push notifications, a label for the device and the push address your browser issues for it (see sections 3 and 4).
Derived portfolio data we compute from your watchlist and holdings: portfolio metrics (holding count, sector breakdown, average beta), daily portfolio snapshots and briefs, and in-app notifications.
Feedback and support: thumbs up/down on AI answers and news summaries, feedback messages, and support requests (name, email, subject, message and any attachments you upload, stored in a private storage bucket).
2.3 AI usage data
What you type to our AI features (chat questions, investment notes sent for analysis, agent instructions) is sent to OpenAI to generate the answer — see section 4.
AI usage logs (ai_query_logs): your user ID, the ticker and type of query, response time and whether a cached answer was used. The message text is not stored in this log.
Earlier chat messages (chat_messages): the app no longer saves chat conversations, but messages saved by an earlier version stay on your account until you delete it. They are part of your download (section 8), also after a subscription has ended.
Usage counters: number of AI calls and chat messages today (to enforce daily limits), watchlist-change counters.
Generated outputs (ai_outputs): AI answers are stored so they can be reused and quality-checked. Some are linked to you (for example, suggestions generated from your agent instruction); others are keyed by a one-way hash of your user ID and input.
2.4 Payment data
If you subscribe, Stripe processes your payment. We receive and store your Stripe customer ID, subscription ID, plan, subscription status, trial dates and billing-period end date. We create the Stripe customer with your email address and your internal user ID.
We never receive or store your card number. Card details go directly to Stripe.
2.5 Technical data
Error reports sent to Sentry when the app crashes (see section 4).
Server logs: our backend records which function was called, whether it succeeded, how long it took, any error message, your internal user ID (when you are signed in) and whether the call came from a signed-in user, our own servers or an automated test browser (edge_fn_invocations). We use this to measure and limit how much market data each part of the app uses and to tell real use apart from our own testing. It never includes your email, the content of your requests or your IP address, and it is deleted automatically after 30 days. Our hosting providers additionally keep standard request logs, which include IP addresses.
Bot-check signals (Cloudflare Turnstile): your IP address, TLS fingerprint, browser user agent, and the site key and page address the check ran on (see sections 4 and 7).
03
Why we process it and on what legal basis
Creating and running your account, signing you in Data: Account data, session data Legal basis (GDPR Art. 6(1)): (b) performance of a contract
Providing the Service: watchlist, holdings, notes, alerts, agent, portfolio metrics and briefs Data: Content you create, derived portfolio data Legal basis (GDPR Art. 6(1)): (b) contract
Generating AI answers, including answers personalised with your watchlist, notes or agent instruction Data: AI inputs, relevant content Legal basis (GDPR Art. 6(1)): (b) contract
Sending push notifications you turned on Data: Device label, push address Legal basis (GDPR Art. 6(1)): (a) consent: you grant it in your browser and can withdraw it there or in Settings
Keeping accounting records Data: Payment/invoice data Legal basis (GDPR Art. 6(1)): (c) legal obligation
Preventing abuse and bots on sign-in, password reset and the support forms (support chat, Help Center contact form) Data: Bot-check signals, IP Legal basis (GDPR Art. 6(1)): (f) legitimate interest in security
Enforcing daily AI and usage limits, controlling cost Data: Usage counters, AI usage logs Legal basis (GDPR Art. 6(1)): (f) legitimate interest
Finding and fixing errors, monitoring AI answer quality Data: Error reports, server logs, AI outputs and feedback Legal basis (GDPR Art. 6(1)): (f) legitimate interest
Answering support requests Data: Support messages Legal basis (GDPR Art. 6(1)): (b) contract / (f) legitimate interest
Who receives your data (processors and other recipients)
We share personal data only with service providers that process it on our behalf, under a data processing agreement. Two exceptions: if you choose Sign in with Google, Google is not our processor but an independent controller of your Google account data (see the Google Sign-In row); and if you turn on push notifications, your browser's push service delivers them (see its row).
Supabase (Supabase Pte. Ltd., Singapore) What it does: Database, authentication, file storage, backend functions What it receives: All data listed in section 2 Location: Data stored in the EU (Ireland, AWS eu-west-1). Supabase's own staff and sub-processors may access it from outside the EEA (Singapore, US) under Standard Contractual Clauses
OpenAI (OpenAI Ireland Ltd.) What it does: Generates AI text What it receives: See "What OpenAI receives" below. OpenAI keeps API inputs and outputs for up to 30 days for abuse monitoring, unless the law requires longer Location: Processed in the US under Standard Contractual Clauses
Stripe (Stripe Payments Europe, Limited, Ireland) What it does: Payments and subscriptions What it receives: Email, internal user ID, card and billing details you enter at checkout, subscription data Location: EU; transfers to Stripe, LLC (US) under the EU–U.S. Data Privacy Framework, or Standard Contractual Clauses
Resend (Plus Five Five, Inc., trading as Resend) What it does: Sends transactional email What it receives: Your email address and the email content (e.g. verification link, password-reset link, the tickers in an earnings or market-event alert, subscription notices) Location: US: Resend stores message content, delivery logs and account records in the United States
Sentry (Functional Software, Inc.) What it does: Error monitoring What it receives: Error message and stack trace, page path (no query string), browser and OS, IP address, and a pseudonymous identifier derived from your user ID. Emails, user IDs and tokens are scrubbed from the report text before sending; sendDefaultPii is off; no session replay or performance tracing Location: Error reports stored in the EU (Frankfurt): our Sentry project uses the EU region (ingest.de.sentry.io). Sentry account and organisation data stay in the US
Cloudflare (Cloudflare, Inc., US) What it does: Hosts and serves the web application (Cloudflare Workers), fetches and caches ticker logos for it (see "Market-data and content sources" below), and runs the Turnstile bot check on sign-in, password reset and the support forms What it receives: Standard web request data, including your IP address, for every request to the app. For Turnstile also your TLS fingerprint, browser user agent, and the site key and page address the check ran on. Cloudflare states that Turnstile does not read what you type into the form Location: US / Cloudflare's global edge network. Cloudflare acts as our processor; for Turnstile it also acts as an independent controller, on its legitimate interest, when it uses these signals to improve bot detection (Turnstile privacy addendum, cloudflare.com/turnstile-privacy-policy)
Google Sign-In (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) What it does: Optional sign-in What it receives: Google authenticates you and sends us your email, name and picture; Google learns that you signed in to StockPilo Location: Independent controller, not our processor: Google processes your Google account data under its own privacy policy (policies.google.com/privacy), in which Google Ireland Limited is the controller for users in the EEA and Switzerland. We and Google act as independent controllers under the Google Controller-Controller Data Protection Terms, which the Google APIs Terms of Service apply to Sign in with Google. Once we receive your email, name and picture, we are the controller of that copy
Your browser's push service (Google, Apple or Mozilla, whichever your browser uses) What it does: Delivers push notifications you turned on What it receives: The push address of your device and the notification, encrypted as the Web Push standard requires Location: Operated by your browser vendor under its own terms; we do not choose it
What OpenAI receives. Only the text needed to answer a specific request:
AI chat: your question and recent messages of the conversation. (The server can also accept your watchlist and a portfolio summary as context; the current app does not send them.)
Investment-note analysis and note alerts: the text of your note and its ticker, including when our scheduled job checks your notes against the news.
Pilo agent: the text of your agent instruction, and tickers taken from your watchlist when the agent runs on schedule.
All other AI features (the stock page's AI analysis, stock summaries, market events, news summaries, earnings insights, the daily market recap and similar) send market data, news and tickers only — no information about you.
We do not send your name or email address to OpenAI. But what you type is sent as written, so please do not include personal information in chat messages, notes or instructions.
Market-data and content sources (no personal data). To show prices, news, and social posts we request data from Financial Modeling Prep, FRED (Federal Reserve Bank of St. Louis), the U.S. EIA, GDELT, Alpha Vantage, Polygon, Reddit, and X and StockTwits (via RapidAPI). These requests are made **from our servers** and contain only tickers or data-series names — for social feeds, the tickers on your watchlist — never your name, email, user ID or IP address. Stock and theme photos come from Pexels and are served from our own storage. Ticker logos are requested by our Cloudflare Worker, not by your browser: your browser asks www.stockpiloapp.com/logo/…, and the Worker fetches the image from Financial Modeling Prep, Parqet or Twelve Data using only the ticker, and keeps a copy at Cloudflare for up to a week. Those three providers receive the ticker and a request from Cloudflare's servers, nothing about you.
Content loaded directly by your browser. A few things are still requested straight from third-party servers, which therefore see your IP address and browser details (and, for the page you are on, a referring address as your browser sends it):
country flags (flagcdn.com) and website icons shown with notes (google.com);
company logos on the IPO page (logo.dev, and image addresses stored with a listing);
YouTube video thumbnails and the pictures that news publishers host with their articles;
the list of members of Congress (unitedstates.github.io) and rocket-launch times (Launch Library 2, ll.thespacedevs.com), fetched by the page that shows them;
the Cloudflare Turnstile script (challenges.cloudflare.com), only on the forms it protects.
None of these requests carries your account data.
Other recipients. Authorised administrators at Vebify OÜ can see account, subscription and support data and AI usage logs to run the Service. We may disclose data to authorities where the law requires it. We do not sell personal data and do not share it for advertising.
05
International transfers
Some providers process data outside the EEA or may access it from there. The safeguard for each:
Supabase (Supabase Pte. Ltd.) Where: Data stored in the EU; access from Singapore / US Safeguard: Standard Contractual Clauses (in Supabase's DPA)
OpenAI (OpenAI Ireland Ltd.) Where: US Safeguard: Standard Contractual Clauses
Stripe (Stripe Payments Europe, Limited) Where: EU; transfers to Stripe, LLC (US) Safeguard: EU–U.S. Data Privacy Framework (Stripe, LLC is certified), otherwise Standard Contractual Clauses
Resend (Plus Five Five, Inc.) Where: US Safeguard: Standard Contractual Clauses (Modules 2 and 3 in Resend's DPA), plus the EU–U.S. Data Privacy Framework (Plus Five Five: EU-US and UK Extension, "Active – re-certification under review")
Sentry (Functional Software, Inc.) Where: Error reports in the EU (Frankfurt); account data in the US Safeguard: EU–U.S. Data Privacy Framework (certified, active); Standard Contractual Clauses (Modules 2 and 3) if the Framework no longer applies
Cloudflare (Cloudflare, Inc.): hosting, logo cache and Turnstile Where: US / global edge Safeguard: EU–U.S. Data Privacy Framework (Cloudflare, Inc. is certified), and Standard Contractual Clauses (Modules 2 and 3) if the Framework no longer applies (Cloudflare's customer DPA)
Google Sign-In (independent controller) Where: Google Ireland Limited; Google's own onward transfers Safeguard: Not a transfer by us: Google processes your Google account data as an independent controller under its own privacy policy and safeguards. Between us and Google, the Google Controller-Controller Data Protection Terms apply, including their Standard Contractual Clauses (Google LLC is also DPF-certified)
You can ask us for a copy of the relevant safeguards (section 13).
06
How long we keep data
Account, profile, watchlist, holdings, notes, agent data, alerts, feedback Retention: Until you delete your account (section 8), then erased
Backend function logs (edge_fn_invocations) Retention: Deleted automatically after 30 days; your user ID in them is removed when you delete your account
AI usage logs, AI outputs, agent run logs Retention: 90 days, then deleted by a daily automatic clean-up
In-app notifications Retention: 90 days, then deleted by the daily clean-up
Support messages and attachments Retention: 12 months, then deleted by the daily clean-up
Earlier chat messages (chat_messages) Retention: Until you delete your account (no new ones are saved)
Payment and invoice records (at Stripe) Retention: Kept after account deletion for as long as accounting law requires: 7 years from the end of the financial year to which they relate (Estonian Accounting Act)
Error reports (Sentry) Retention: 90 days (the retention of the plan we use)
Ticker-logo cache at Cloudflare Retention: Up to 7 days; the images contain no personal data. Cloudflare keeps its own request logs under its terms
Email-verification and password-reset tokens Retention: Until used or expired; deleted with the account
Deletion receipt (erasure_log) Retention: A one-way hash of your user ID and the date, kept as proof that we honoured the request — 3 years, then deleted by the daily clean-up
Database backups (Supabase) Retention: Backups are kept by Supabase for the retention of our plan and expire on their own; an erased account can remain in a backup until it expires
07
Cookies and browser storage
StockPilo does not use advertising or analytics cookies. We use browser storage that is needed to make the Service work:
Sign-in session (Supabase Auth): stores your login session so you stay signed in.
Session-only login (sessionStorage: stockpilo_session_only) and the "remember me" choice (stockpilo_remember_me, stockpilo_was_session_only): if you chose not to be remembered, you are signed out when you close the tab.
Google Sign-In safety values (sessionStorage: google_oauth_nonce, google_oauth_state), cleared after sign-in.
Your email address in localStorage (stockpilo_last_email, and stockpilo_pending_verification_email while you verify your email), to pre-fill forms. Both are removed when you sign out.
Terms acceptance in progress (sessionStorage: stockpilo_terms_google_pending) while you are redirected to Google, cleared after sign-in.
Preferences: language (stockpilo-language), theme, sidebar state (sidebar:state cookie), whether you've seen the tour (stockpilo_tour_seen_<your user ID>) or hints.
Other local settings: recent stock searches (stockpilo_recent_searches), whether you hid holding amounts (hide-holdings-amounts-v1), when you last dismissed the install prompt (sp-install-snooze-until) or an announcement (stockpilo_announcement_dismissed), and the last figures you saw for a stock (stockpilo_prev_stats_<ticker>).
Service worker (/sw.js): receives push notifications you turned on; it caches nothing.
Caches of market data and news summaries to make pages load faster (no personal data).
Security check (Cloudflare Turnstile): the sign-in and password-reset page (/auth), the Help Center contact form and the support chat load Cloudflare's security check. It does not set cookies on our domain. It keeps a temporary value in browser storage on challenges.cloudflare.com, Cloudflare's own domain, to run the check. Most visitors never see it; if Cloudflare is unsure, it shows a "Verify you are human" checkbox. See Cloudflare's Turnstile privacy addendum (https://www.cloudflare.com/turnstile-privacy-policy/).
This marketing site (stockpilo.com) loads fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and code libraries from cdnjs (cdnjs.cloudflare.com) directly in your browser, so those servers see your IP address and browser details when a page loads.
08
Your rights
Under the GDPR you have the right to:
Access your data and get a copy of it.
Rectification — most profile data can be edited in Profile / Settings.
Erasure — you can delete your account yourself on your Profile page (Delete Account, then confirm). This cancels any active subscription immediately and deletes your profile, watchlist, holdings, notes, agent, alerts, feedback, support messages, AI usage logs, avatar and login. Exceptions: billing records at Stripe (legal obligation), error reports until Sentry's retention expires, and the hashed deletion receipt.
Data portability — download your profile, watchlist, holdings, notes, alerts, followed people, saved scenarios, chat messages and support messages yourself as a JSON file (Settings → Your data → Download). This also works after your subscription has ended; earlier chat messages are then read for you on our server. Files you attached to support requests are not in the download: email us for those or for anything else you gave us.
Restriction of processing and objection to processing based on legitimate interest.
Withdraw consent at any time, without affecting earlier processing.
To exercise a right, email privacy@stockpiloapp.com. We answer within one month. We may need to verify your identity first.
You also have the right to lodge a complaint with a supervisory authority — in Estonia the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), www.aki.ee — or with the authority in the EU country where you live or work.
09
Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. AI features produce informational text; they do not decide anything about you, your account or your access to the Service.
10
Children
The Service is intended for people 18 years or older (see our Terms). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
11
Security
Data is encrypted in transit (HTTPS). Access to the database is restricted by row-level security so that each user can only read their own records; only authorised administrators and backend functions have wider access.
12
Changes to this policy
We may update this Privacy Policy. We will show the date of the latest change at the top, and notify you by email or in the app before material changes take effect.
13
Contact
Vebify OÜ, Aaslina tn 5, Haabersti linnaosa, Tallinn, 13516, Harju maakond, Estonia Email: privacy@stockpiloapp.com