Privacy Policy

We collect the following information when you create an account or use our service:

Information you provide directly:

• Email address
• Username
• Password (stored as a bcrypt hash — we never store your plaintext password)
• Chosen plan (trial, monthly, or annual)
• Consent records (age attestation, sanctions attestation, terms acceptance, marketing preference, timestamp, version)

Information collected via Stripe (payments):

• Stripe Customer ID
• Stripe Subscription ID
• Payment status and subscription period end date

Information collected automatically:

• IP address (logged by Vercel infrastructure)
• Browser user agent
• Request timestamps
• Analysis usage counts per calendar month

• Account creation and authentication — to create and manage your account and verify your identity on each session.
• Subscription billing — to process payments, manage plan upgrades and cancellations, and send renewal reminders via Stripe and (where opted in) email.
• Service delivery — to count your monthly analysis usage against your plan limit and to display your saved analyses in your dashboard.
• Customer support — to respond to enquiries you send through our contact page.
• Security and fraud prevention — to detect and block abuse, enforce sanctions compliance, and protect our infrastructure.
• Legal and regulatory compliance — to retain records as required by applicable law.
• Product updates (if opted in) — to send you information about new features or offers where you have given marketing consent.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract (Art. 6(1)(b)) — processing necessary to create your account, authenticate you, and administer your subscription.
• Legitimate Interest (Art. 6(1)(f)) — security monitoring, fraud prevention, sanctions screening, and service improvement, where our interests do not override your fundamental rights.
• Consent (Art. 6(1)(a)) — optional marketing email communications (you may withdraw consent at any time) and non-essential cookies and analytics.
• Legal Obligation (Art. 6(1)(c)) — tax, audit, and other records we are required by law to retain.

We share your data with the following third parties only to the extent necessary to operate the service:

• Stripe — Payment processing and subscription management. Location: United States (Dublin, IE for EU customers).
• Vercel — Hosting, edge network, serverless functions. Location: United States (global edge).
• Vercel KV (Upstash Redis) — User records, analysis metadata, usage counters. Location: United States.
• NextAuth.js — Session management (JWT, no external server). Location: No data leaves your infrastructure.
• Financial Modeling Prep (FMP) — Market data for analysis (ticker queries only — no personal data sent). Location: United States.
• Google Fonts — Web font delivery (loaded only after functional cookie consent). Location: United States.
• Resend — Transactional and subscription renewal emails. Location: United States.

We do not sell, rent, or trade your personal information to any third party.

Depending on your jurisdiction, you may have the following rights. To exercise any of them, email BOD@amordad.capital.com.

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request erasure of your data, subject to legal retention requirements.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Restriction — ask us to restrict processing while a dispute is resolved.
• Withdraw Consent — withdraw marketing consent at any time without affecting lawfulness of prior processing.
• Quebec Law 25 (residents of Quebec) — you have additional rights including the right to be informed of automated decision-making that affects you, and to request human review of such decisions.

We will respond to verified requests within 30 days (GDPR) or 45 days (CCPA/CPRA). If you are unsatisfied with our response, you have the right to lodge a complaint with your supervisory authority.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — the categories and specific pieces of personal information we collect, use, and disclose.
• Right to Delete — request deletion of your personal information, subject to exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information beyond what is necessary to provide the service.
• Right to Opt-Out of Sale or Sharing — AMORDAD does not sell or share personal information for cross-context behavioural advertising. No opt-out mechanism is required, but we provide one as a courtesy: email BOD@amordad.capital.com.

We will not discriminate against you for exercising any of these rights.