Privacy Policy

Last updated: September 7, 2026

SpreadVista ("we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our platform and services.

1. Information We Collect

Account Information

When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text. If you complete the optional profile prompt, we also store what you tell us about your role, your organization's size, your primary goal and your assets-under-management range. When you sign up, we record the page you arrived from, the landing page and any campaign tags present on your first visit, and keep them with your account.

Usage Data

We collect information about how you use the Service, including pages visited, features used (as named product events such as export, share, watch, alert, saved view and stress-test runs, stored with your account id when you are signed in), the number of results a search returned (not the text you typed), watchlists created, and session duration. This data helps us improve the product and understand which features provide the most value.

Feedback

When you submit feedback through the in-app widget, we store the message content, the page you were on, and your user ID.

Technical Data

We automatically collect standard technical information including IP address, browser type, device type, and referring URL. This is used for security, debugging, and aggregate analytics. Security records written when an account is created and when a session token is rotated keep the full IP address and browser user-agent string; API request logs keep a truncated network address (the last part of the address is removed). See Section 5 for how long each is kept.

First-Party Usage Statistics

SpreadVista collects limited first-party technical and usage information to operate and secure the service, measure aggregate traffic, understand site and service performance, and improve the product. This measurement is deliberately minimizing: page paths never include query strings or credentials, referrers are reduced to their domain (the signup attribution described in Account Information is the one exception), IP addresses are hashed or discarded, browsers are recorded only as a coarse class, and anonymous activity is grouped only by a short-lived per-tab token that is deleted when the tab closes and is used only where optional analytics is enabled — declining optional analytics means your page views are counted as aggregate statistics without any session grouping. It sets no cookies, builds no cross-site profile, and is never shared with advertising or analytics providers.

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate your identity and manage your account
• To communicate with you about the Service, including updates, security alerts, and support
• To respond to your feedback and support requests
• To monitor usage patterns and improve the user experience
• To detect and prevent fraud, abuse, or security threats
• To comply with legal obligations

3. What We Don't Do

• We do not sell your personal information to third parties
• We do not share your data with advertisers
• We do not use your data to make investment recommendations
• We do not track you across other websites

4. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), JWT-based authentication with token rotation, and rate limiting on sensitive endpoints. However, no system is perfectly secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your account information for as long as your account is active. Other data is kept for fixed periods: first-party page-view records for 90 days; API request logs (with the truncated network address) for 24 months; alert and digest email logs for 12 months; security and audit records — account-creation and session-rotation records, revoked sessions, invitation and outreach records, and the administrative audit log — for 7 years, for abuse prevention and accountability; daily traffic counts are kept as aggregates without personal identifiers. If you delete your account, your account, profile, workspace (watchlists, alerts, saved views, comp groups) and feedback are removed immediately; the security and audit records above are retained for their period with personal details scrubbed or replaced by a placeholder, and any page-view records that reference your account age out within 90 days.

6. Third-Party Sub-Processors

We use the following sub-processors to operate the platform. Each has its own privacy/security posture. Data shared with each is limited to what the service requires to function.

• Render (hosting infrastructure + managed PostgreSQL + cron jobs) — stores all application data at rest; encrypted at rest by default; accessible by Render staff for platform operations. Located in the United States.
• Resend (transactional email delivery) — receives your email address, first name, and email body at send time. Retains message metadata for up to 30 days per Resend's retention policy. Used for: account registration, password reset, password-change and account-deletion confirmations, welcome, invitations, outreach, alert notifications, and digest emails.
• Sentry (application error monitoring) — receives error traces, stack frames, and request metadata when exceptions occur. We have configured Sentry with send_default_pii=False and request-body capture disabled, so your email/name/password are not intentionally transmitted; we do not attach your identity to error reports, although internal identifiers present in the request being handled can appear in technical context. Session Replay is disabled.
• Google Analytics (site and product analytics, where enabled) — receives page paths and page titles, plus the technical signals Google collects when its measurement runs (see Section 7 for when that is). Product events are not sent to Google. Where a search term is part of a page address (for example the filter on the Credits index), it is included in the page path Google receives. Configured analytics-only: no advertising features, no remarketing, no ads personalization, and no Google Signals are enabled in our configuration. In regions where our implementation requires prior consent, Google Analytics does not load and nothing is sent to Google unless you accept analytics; elsewhere you can turn it off at any time under Privacy choices below.
• Cloudflare (network edge in front of the Service) — every request passes through Cloudflare, which processes connection metadata including your IP address and supplies the country signal our consent handling uses. It does not receive your account data from us.
• Backup storage — encrypted database backups are copied to a cloud object-storage provider for disaster recovery; backups contain the same data as the database and are retained under the same access controls.
• SEC EDGAR — SpreadVista's backend retrieves regulatory disclosures from the SEC's public API. Your personal information is not transmitted; only SpreadVista's server identifiers appear in SEC access logs.

Other than Google Analytics as described above, we do not use third-party analytics, advertising, or marketing-tracking services. We do not sell personal data, and we do not share personal data with third parties for their own advertising purposes.

Data Processing Agreements (DPAs) are on file with Render, Resend, and Sentry. Request copies at privacy@spreadvista.com.

7. Cookies

We use essential cookies and browser storage for the Service itself: a session-presence cookie, a functional region flag that decides whether analytics needs your consent before running, and local storage for authentication tokens, your analytics choice, and preferences (sidebar state, tour dismissal, dashboard filters, recently opened credits). Per-tab storage holds the short-lived analytics token described above and the signup attribution described in Section 1 until you sign up or close the tab. These are required for the Service and are not controlled by the analytics preference.

Where Google Analytics runs (see Section 6), it sets its own analytics cookies. In regions where our implementation requires prior consent, no analytics cookie is set unless you accept; elsewhere analytics may run by default and you can opt out below — opting out stops future analytics and removes Google Analytics cookies. Declining optional analytics never restricts SpreadVista functionality.

8. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent for optional data processing

To exercise these rights, contact us at privacy@spreadvista.com.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For privacy-related questions or requests, contact us at privacy@spreadvista.com.