Privacy notice
A minimal account should create a minimal data footprint.
This review candidate explains the data used by the current preview. Controller identity, legal bases, processor terms, international-transfer safeguards and retention periods require final legal confirmation before launch. Current support and privacy contacts are listed below.
- Status
- Review candidate · not approved for launch
- Version
- privacy-eu-eea-2026-09-15-review-candidate-v3
- Perimeter
- EU/EEA preview
Data handled by the preview
- Account identity data managed through Supabase Auth, including email address and authentication identifiers. Optional Google sign-in shares basic profile and email information; it does not request Gmail or Drive access.
- Optional display name, language and theme preferences.
- Watchlist tickers, which are saved reading references rather than portfolio holdings, and monthly company-report access records used to enforce the plan allowance.
- Provider references and subscription status when test billing is used. Live payments are currently disabled; payment card details belong to Stripe, not the application database.
- Versions and timestamp of approved legal documents when acceptance is later enabled.
- Technical request, security and deployment logs that hosting providers may create, such as IP address, device information, timestamps and error records.
Why data is used
- Provide and secure the account, saved preferences and watchlist.
- Operate, diagnose and protect the application and prevent abuse.
- Respond to privacy, correction and deletion requests.
- Record approved document acceptance when the legal gate permits it.
Infrastructure and recipients
The current architecture uses Vercel for the web application, Render for the private API and jobs, Supabase for authentication, PostgreSQL and object storage, and Google for optional sign-in. Zoho Mail EU handles human correspondence and ZeptoMail EU delivers account emails. Stripe is the selected billing provider; live payments remain disabled. Their processing terms, sub-processors, regions and transfer mechanisms must be confirmed in the final processor register and privacy notice.
OpenAI provides source-grounded interpretation. Ticklume does not send account profiles or watchlists to the interpretation model. AI tasks use bounded company-source content, not a reader's personal circumstances.
Retention and security
Account data is retained while the account is active and removed through the account-deletion flow, subject to backups, security records and legal retention requirements that must be finalized. Secrets are kept outside the repository, private API access requires a verified token and user-owned database rows are protected by row-level security.
Your choices and rights
- Contact privacy@ticklume.com about access to or portability of your personal data. Self-service downloads are not available.
- Correct optional profile data and remove watchlist entries.
- Delete the account and its user-owned application data.
- EU/EEA rights may include access, rectification, erasure, restriction, objection, portability and a complaint to a supervisory authority, depending on the confirmed legal basis and circumstances.
Local preferences and contact
Theme preference is stored locally so the interface can respect light, dark or system mode. Session and temporary authentication cookies support sign-in and recovery. Account-email open and click tracking is disabled. This rebranding does not add advertising or analytics tracking. The final cookie inventory and controller disclosure still require review before launch.