Privacy Policy

Last updated: March 2026

1. Information We Collect

When you create an account and use the Service, we collect:

  • Account information: Name, email address, and a securely hashed password.
  • Usage data: Ticker symbols analyzed, selected analysis frameworks, report generation timestamps, and report count.
  • Technical data: IP address, browser type, device information, and access timestamps collected automatically through server logs.

We do not collect payment information directly. If payment processing is enabled in the future, it will be handled by a PCI-compliant third-party processor (e.g., Stripe), subject to their own privacy policy.

2. How We Use Your Information

We use your information for the following purposes:

  • Provide, operate, and maintain your account and the analysis Service.
  • Track report usage for free-tier and subscription limits.
  • Improve the Service, diagnose technical issues, and prevent fraud or abuse.
  • Communicate with you about your account, Service updates, or respond to inquiries.
  • Comply with legal obligations and enforce our Terms of Service.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal bases for processing your personal data include:

  • Contract performance: Processing necessary to provide the Service you requested.
  • Legitimate interests: Improving the Service, preventing fraud, and ensuring security.
  • Consent: Where you have given explicit consent for specific processing activities.
  • Legal obligation: Where processing is required to comply with applicable law.

4. Data Storage and Security

Passwords are hashed using PBKDF2 with SHA-256 and are never stored in plaintext. Your data is stored on secured cloud infrastructure with access controls, encryption in transit (TLS), and regular security monitoring.

While we implement commercially reasonable administrative, technical, and physical security measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute data security, and you acknowledge that you provide your information at your own risk.

5. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

  • Notify affected users via email within 72 hours of becoming aware of the breach, where feasible.
  • Provide details about the nature of the breach, the types of data affected, and steps we are taking to address it.
  • Notify applicable regulatory authorities as required by law (including GDPR supervisory authorities where applicable).

6. Financial Data

The Service processes publicly available financial data from SEC EDGAR, market data APIs, and other public sources for educational purposes. We do not collect, store, or process your personal financial information, brokerage credentials, portfolio holdings, or trading activity. Generated reports are stored on our servers and associated with your account for your convenience. Reports contain only publicly available company data applied through educational analysis frameworks, not your personal financial data.

7. Data Sharing

We do not sell, rent, trade, or share your personal information with third parties for their marketing purposes. We may share your information only in the following circumstances:

  • Service providers: With trusted third-party vendors (e.g., cloud hosting, payment processing) who need access to operate the Service, subject to contractual confidentiality and data protection obligations.
  • Legal requirements: When required by law, subpoena, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to a successor entity, subject to the same privacy protections.

8. Data Retention

We retain your data as follows:

  • Account data: Retained as long as your account is active. After account deletion, personal data is permanently deleted within 30 days, except where retention is required by law.
  • Generated reports: Retained for your access while your account is active. Reports are deleted upon account deletion.
  • Server logs: Retained for up to 90 days for security and diagnostic purposes, then automatically purged.

9. Cookies

We use strictly necessary session cookies to maintain your login state and provide core Service functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Because our cookies are strictly necessary for the Service to function, they do not require separate consent under most cookie regulations.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete personal data.
  • Deletion: Request deletion of your account and associated personal data ("right to be forgotten").
  • Portability: Request a machine-readable copy of your data.
  • Restriction: Request that we restrict processing of your data in certain circumstances.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw your consent at any time.

To exercise any of these rights, contact us at privacy@atkin.tech. We will respond to verified requests within 30 days (or within the timeframe required by applicable law).

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • The right to know what personal information we collect, use, and disclose.
  • The right to request deletion of your personal information.
  • The right to opt out of the sale or sharing of personal information. We do not sell or share your personal information.
  • The right to non-discrimination for exercising your privacy rights.

11. International Data Transfers

Your data may be processed and stored in the United States. If you are accessing the Service from outside the United States, you consent to the transfer of your data to the U.S., which may have different data protection laws than your jurisdiction. We take reasonable measures to ensure your data is treated securely and in accordance with this Privacy Policy.

12. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has provided us with personal information, please contact us at privacy@atkin.tech.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where required by law, by sending an email notification. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

14. Contact and Data Protection Inquiries

For privacy-related inquiries, data access requests, or complaints, contact us at:

Email: privacy@atkin.tech

If you are located in the EEA or UK and believe we have not adequately addressed your data protection concern, you have the right to lodge a complaint with your local data protection supervisory authority.