Privacy Policy

1. Scope

This policy applies to the Aristockrat website and web application (together, the "Service"). "We", "us" and "our" refer to Aristockrat, which decides how and why your personal data is processed. It does not apply to websites of third parties that the Service links to, such as payment or sign-in pages run by other companies, which have their own privacy policies.

2. The data we process

• Account data: if you create an account, your email address and a password, which is stored only in hashed form. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your saved settings: the stocks you add to favorites, the dashboard views you save and the stocks you ask us to add to the Service.
• Subscription data: if you subscribe to PRO, your plan, subscription status, billing period and the customer reference created by our payment provider. Your card details are entered on the payment provider's page and never reach us.
• Messages: the name, email address and message you send through the contact form.
• Technical data: when you use the Service, our hosting provider processes your IP address, browser and device information and the pages you request, as part of normal server logs.
• Usage statistics: aggregated statistics such as pages viewed, referring website, country and device type, collected without cookies and without identifying you across websites.
• Cookies and browser storage: described in our Cookie Policy.

3. Why we process it and on what legal basis

• To provide your account and the features you use (sign-in, favorites, saved views, PRO features): necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To process payments and keep accounting records: performance of the contract and compliance with legal obligations, including tax and accounting law (Art. 6(1)(b) and (c) GDPR).
• To answer your messages: our legitimate interest in responding to enquiries, or steps you ask us to take before entering into a contract (Art. 6(1)(f) and (b) GDPR).
• To keep the Service secure and working: detecting abuse, preventing attacks and fixing errors, based on our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).
• To understand and improve how the Service is used, through aggregated, cookieless statistics, based on our legitimate interest (Art. 6(1)(f) GDPR).
• To send service emails such as account confirmation and password reset: performance of the contract. We do not send marketing emails or newsletters.

4. Service providers

We use a small number of providers who process personal data on our behalf, under data processing agreements, and only for the purposes above:

• Database and authentication provider: database, user authentication and service emails.
• Hosting provider: website hosting, content delivery and cookieless usage statistics.
• Stripe: payment processing for PRO subscriptions. Stripe also processes payment data as an independent controller under its own privacy policy, for example to prevent fraud and meet financial regulations.
• Google: only if you choose to sign in with Google, under Google's privacy policy.

We do not sell your personal data, share it for advertising, or give it to anyone else unless the law requires us to.

5. International transfers

Some of these providers, or their sub-processors, may process data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for certified providers) or by the Standard Contractual Clauses approved by the European Commission.

6. How long we keep data

• Account data and saved settings: for as long as you keep your account. When you delete your account, your account, favorites, saved views and subscription record are deleted. Stock requests are kept without any link to you.
• Payment and invoice records: for the period required by accounting and tax law.
• Contact messages: for as long as needed to handle your request and any follow-up, after which they are deleted.
• Server logs: for a short period set by our hosting provider, unless needed longer to investigate a security incident.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted. You can delete your account at any time from your account settings;
• restrict the processing of your data in certain cases;
• receive data you provided to us in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests;
• withdraw any consent you have given, without affecting processing that took place before.

To exercise these rights, contact us through the contact page. We will reply within one month, which may be extended in the cases allowed by law. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

8. Automated decisions

The scores and ratings on Aristockrat are calculated automatically, but they assess stocks, not people. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

9. Security

All connections to the Service are encrypted (HTTPS). Passwords are stored only in hashed form, access to user data is restricted at database level so each user can only reach their own records, and administrative access is limited to the people who need it. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures to protect your data.

10. Children

The Service is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

11. Additional information for California residents

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use it for cross-context behavioural advertising. California residents can exercise their rights to know, correct and delete personal information through the contact page.

12. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell account holders by email or with a notice in the Service before it takes effect.

13. Contact

For questions about this policy or your personal data, write to us through the contact page.