Privacy Policy

1. DATA WE COLLECT

• Account data: your email address (used as your sign-in identity), subscription tier, and alert preferences.
• Authentication data: single-use login tokens and session identifiers. Both are stored hashed; the session is kept in an essential, httpOnly cookie.
• Billing data: your PayPal subscription ID, plan, status, and billing-period dates. We never see or store your card numbers, bank details, or PayPal credentials — payment is handled entirely by PayPal.
• API keys: if your tier includes developer access, we store your API keys hashed and record usage for rate limiting.
• Messages you send us: contact-form submissions and support emails, including the email address and content you provide.
• Technical logs: standard server logs (IP address, user agent, request path, timestamps) generated by our hosting provider for security, rate limiting, abuse prevention, and debugging.

We do not collect passwords (sign-in is passwordless), we do not run third-party advertising or cross-site tracking, and we do not buy data about you from data brokers.

2. HOW WE USE YOUR DATA

• to sign you in and keep your session secure;
• to provide the features of your tier, including tier-gated data, CSV exports, and API access;
• to manage subscriptions: activating tiers, syncing renewal or cancellation status from PayPal, and downgrading lapsed subscriptions;
• to send transactional email: login links, and — only if you opt in — cluster alert notifications. You can turn alerts off at any time on your account page;
• to respond to messages you send us;
• to protect the Platform: rate limiting, fraud and abuse detection, and security monitoring;
• to comply with legal obligations.

Where the GDPR or similar law applies, our legal bases are: performance of our contract with you (accounts, subscriptions, features), our legitimate interests (security, abuse prevention, service improvement), your consent (optional alert emails), and compliance with legal obligations.

3. COOKIES

We use an essential, httpOnly session cookie to keep you signed in. It is required for the Platform to function and is not used for advertising or cross-site tracking. Because we use only essential cookies, no cookie-consent banner is required; if we ever add non-essential cookies, we will ask for consent first.

4. PAYMENT INFORMATION

Payments are processed entirely by PayPal under PayPal's own terms and privacy policy. We receive only subscription metadata (subscription ID, plan, status, period dates) via signed webhooks so that your tier stays in sync. We never view, store, or process your credit card numbers or full billing details on our servers.

5. SERVICE PROVIDERS (SUBPROCESSORS)

We share personal data only with the infrastructure providers needed to run the Platform, each acting under their own security and data-processing commitments:

• Vercel — application hosting, edge network, firewall, and server logs;
• Neon — Postgres database hosting (account and application data);
• PayPal — subscription billing;
• Resend — transactional email delivery (login links, alerts, contact-form messages).

We do not sell, trade, rent, or share your personal data with advertisers or data brokers. We may disclose data if required by law, to enforce our Terms, or to protect the rights, safety, or property of WhaleTrack, our users, or the public, and it may be transferred as part of a merger, acquisition, or sale of assets (with notice to you).

6. INTERNATIONAL TRANSFERS

Our providers store and process data primarily in the United States and the European Union. Wherever your data is processed, we rely on our providers' standard contractual safeguards and apply the protections described in this policy.

7. DATA RETENTION

Account data is kept while your account is active. Expired login tokens and sessions are single-use or time-limited and are cleaned up routinely. Subscription records are retained as long as needed for accounting and legal purposes. Server logs are retained on our hosting provider's standard short-term schedule. When you delete your account, we delete your personal data within 30 days except where the law requires longer retention.

8. SECURITY

All traffic is encrypted in transit (TLS/HSTS). Login tokens, sessions, and API keys are stored hashed; login links are single-use and expire quickly. Access to production systems is restricted, and webhook and cron endpoints are authenticated. No system is perfectly secure — if we learn of a breach affecting your personal data, we will notify you as required by applicable law.

9. YOUR RIGHTS

Depending on where you live (for example under the GDPR, UK GDPR, or CCPA/CPRA), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent (for example, alert emails), and to complain to your local data-protection authority. To exercise any of these rights, email support@whaletrack.io from your account address — we respond within 30 days. We do not discriminate against you for exercising your rights, and we do not "sell" or "share" personal information as those terms are defined in the CCPA.

10. PUBLIC-FIGURE DATA ON THE PLATFORM

The Platform displays information about corporate insiders, institutional investment managers, and members of Congress derived from public regulatory filings (SEC EDGAR, House and Senate STOCK Act disclosures, FINRA datasets). This is public-record information published under disclosure laws; we display it with links to the official source where possible. If you believe a record about you is displayed inaccurately relative to its official source, contact us and we will review it.

11. CHILDREN

The Platform is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

12. CHANGES TO THIS POLICY

We may update this policy from time to time. Material changes will be announced on the Platform or by email, and the "Last Updated" date above will change. Your continued use of the Platform after changes take effect means you accept the updated policy.

13. CONTACT

Privacy questions and requests: support@whaletrack.io