This document is being finalised
The full Privacy Policy is with our legal counsel and will be published here before paid accounts open, including the controller's legal name and address, which do not exist yet because the company is still being formed. Everything described below is already how the system actually behaves.
What we collect
- Your email address and password. Handled by Supabase Auth; the password is stored hashed and we never see it.
- Your subscription state. Which products you are entitled to, the status, and the Stripe identifiers that tie them to your payments.
- Your Telegram user id, if you choose to link the alerts channel. Optional; blank until you fill it in.
- Security records. Rate-limiting counters keyed to the IP address that attempted a login, signup or password reset, kept briefly and then deleted.
- Your tracker, if you use it: the tickers you add and whether you mark each one Holding or Watching. Nothing else: no quantities, prices, cost or value. You can download it or clear it from Account at any time, and it is deleted with your account.
We do not ask for your name, your address, your date of birth, the size of anything you hold or your financial position, and we have no interest in holding them.
What we do not do
We do not sell your data. We do not share it with advertisers. We do not profile you, and we do not run advertising or cross-site tracking cookies.
Measuring usage
We count page views and a handful of milestones (an account created, a subscription started, a subscription paid) through Vercel Web Analytics, a processor acting on our instructions. It uses no cookies and builds no profile: visitors are counted from a hash of the request, discarded after 24 hours. We strip the address before it is sent, so share-card links and the one-time tokens in confirmation emails never reach it. What we get back is a count, not a person.
The Brief and roadmap alerts
If you subscribe to the Whale Orbit Brief, or ask to hear when an item on the roadmap ships, we keep your email address, the page you signed up from and the roadmap items you asked about. Nothing else: no name, no account. You confirm with one click in the first email, and until you do that confirmation is the only email you get. The list is held by beehiiv, a newsletter service in the United States acting on our instructions; the transfer is covered by the EU Standard Contractual Clauses in its data processing agreement. beehiiv records whether our emails are opened and which links are clicked, and we see those figures. Every email carries an unsubscribe link. The list is separate from web-app accounts: subscribing does not create one, and an account does not subscribe you.
Payments
Payments run through Stripe. Card numbers never touch our servers. Stripe holds them and we keep only the customer and subscription identifiers needed to know what you are entitled to.
Where it lives
Account data sits in a Supabase project hosted in the EU (Frankfurt). The application runs on Vercel. Both are processors acting on our instructions.
How long we keep it
Account data lasts as long as your account does. Ask us to delete it and it goes, except for the billing records tax law requires us to keep. Rate-limiting records expire on their own within days. A Brief subscription lasts until you unsubscribe or ask us to delete it.
Your rights
If you are in the EU or UK you have the right to access, correct, export or delete your data, to object to processing, and to complain to your national data-protection authority. Write to us and we will act on it. There is no form to fill in.
Public records are not personal data about you
The politicians and corporate insiders shown in the product appear because the law requires them to file those disclosures publicly. That material is not collected from you and is not covered by this policy, which is about your data as a user of the service.
Contact
Write to business@whaleorbit.com and a human will answer.
The Cookie Policy covers what we store in your browser. The Terms of Service govern use of the product.