Privacy Policy

1. Information we collect

Information you provide: email address, display name, and password (stored as a cryptographic hash). We do not collect sensitive financial information such as bank accounts, brokerage credentials, or trading positions.

Information collected automatically: IP address, browser type and version, device type, operating system, pages visited, time spent on pages, and referral source. This data is used solely for analytics and service improvement.

2. How we use information

• Provide, maintain, and improve the Service
• Process payments and manage subscriptions (via Gumroad)
• Send transactional emails (account verification, password reset, billing receipts)
• Respond to support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

3. Third-party services

We use the following third-party services to operate the platform. Each has its own privacy policy:

• Supabase — database, authentication, and file storage
• Anthropic (Claude) — AI report generation
• Gumroad — payment processing (Merchant of Record)
• Polygon.io & Finnhub — market data feeds
• Resend — transactional email delivery
• Vercel — web hosting and CDN
• Vercel Analytics & Speed Insights — first-party page-view and performance metrics. No third-party advertising cookies; data is aggregated and used only to monitor site health.

These services may process data outside your country of residence. We ensure all providers maintain adequate data protection standards. Stonvex is not liable for the privacy practices of third-party services.

4. Legal basis for processing (GDPR Art. 6)

Where the EU General Data Protection Regulation (GDPR) applies, Stonvex processes your personal data under the following legal bases:

• Contract (Art. 6(1)(b)) — to provide the Service you registered for, including delivering AI reports and managing your subscription.
• Legitimate interest (Art. 6(1)(f)) — to detect fraud and abuse, secure the platform, and improve the product.
• Consent (Art. 6(1)(a)) — for non-essential analytics cookies. You can withdraw consent at any time via the cookie banner or this page.
• Legal obligation (Art. 6(1)(c)) — to retain billing records and respond to lawful requests from authorities.

5. Data retention

Specific retention periods by data category:

• Account data (email, display name, profile) — for the lifetime of the account, then permanently deleted within 30 days of account closure.
• Billing records — 7 years after the transaction (tax compliance requirement).
• AI reports — 12 months from generation date.
• Authentication logs — 90 days, then anonymised or deleted.
• Community posts — retained while the account is active; deleted on account closure unless the post has been quoted / archived elsewhere.
• Aggregated anonymous metrics — indefinitely. Cannot be re-identified to you.

6. Your rights

Subject to the laws of your jurisdiction, you have the following rights regarding your personal data. EU/UK residents have these rights under the GDPR / UK GDPR; California residents have similar rights under the CCPA; Korean residents under PIPA.

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request permanent deletion, subject to billing-record retention.
• Portability — receive your data in a structured, machine-readable format (JSON).
• Restriction — ask us to suspend processing while we resolve a dispute.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — withdraw any consent you previously gave (e.g. analytics cookies). Withdrawal does not affect lawful processing that occurred before withdrawal.

To exercise these rights, email stonvexceo@gmail.com with proof of identity. We respond within 30 days.

Right to lodge a complaint: If you believe your rights have been violated, you may lodge a complaint with your local data-protection authority. EU residents may contact their national DPA; UK residents the ICO; Korean residents the Personal Information Protection Commission (PIPC).

7. Cookies

We use two categories of cookies:

• Strictly necessary — authentication, session management, country detection, security. These cannot be disabled because the Service does not function without them.
• Analytics — anonymous usage statistics that help us improve the product (which pages are popular, which features cause errors). These are only set if you click "Accept all" on the cookie banner. You can reject them or withdraw consent at any time without losing access to the Service.

The cookie banner appears on your first visit. To change your choice later, clear the stonvex_consent cookie in your browser and reload the page; the banner will reappear.

8. International transfers

Stonvex is operated from the Republic of Korea. Several of our processors are located in the United States or the European Union (Supabase, Vercel, Anthropic, Polygon.io, Finnhub, Resend, Gumroad). Where personal data is transferred outside your country of residence, we rely on the following safeguards:

• EU/UK → US: Standard Contractual Clauses (SCCs) executed with each US-based processor.
• EU/UK → Korea: Korea has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision, Dec 2021).
• Other regions: Where neither SCCs nor an adequacy decision applies, we obtain explicit consent before transfer.

9. Data security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, secure password hashing, and regular security reviews. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Data breach notification

In the event of a data breach affecting your personal data, Stonvex will notify affected users via email within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, the data affected, and the steps we are taking to address it.

11. Children's privacy

Stonvex is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If we discover that a user is under 18, we will promptly delete their account and associated data.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Data controller & contact

The data controller for personal information collected on this Service is:

For privacy-related questions, data access, or deletion requests, contact us at the address above.