Privacy Policy

Last updated: August 28, 2026

SpreadVista ("we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our platform and services.

1. Information We Collect

Account Information

When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Usage Data

We collect information about how you use the Service, including pages visited, features used, search queries, watchlists created, and session duration. This data helps us improve the product and understand which features provide the most value.

Feedback

When you submit feedback through the in-app widget, we store the message content, the page you were on, and your user ID.

Technical Data

We automatically collect standard technical information including IP address, browser type, device type, and referring URL. This is used for security, debugging, and aggregate analytics.

First-Party Usage Statistics

SpreadVista collects limited first-party technical and usage information to operate and secure the service, measure aggregate traffic, understand site and service performance, and improve the product. This measurement is deliberately minimizing: page paths never include query strings or credentials, referrers are reduced to their domain, IP addresses are hashed or discarded, browsers are recorded only as a coarse class, and anonymous activity is grouped only by a short-lived per-tab token that is deleted when the tab closes and is used only where optional analytics is enabled — declining optional analytics means your page views are counted as aggregate statistics without any session grouping. It sets no cookies, builds no cross-site profile, and is never shared with advertising or analytics providers.

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate your identity and manage your account
• To communicate with you about the Service, including updates, security alerts, and support
• To respond to your feedback and support requests
• To monitor usage patterns and improve the user experience
• To detect and prevent fraud, abuse, or security threats
• To comply with legal obligations

3. What We Don't Do

• We do not sell your personal information to third parties
• We do not share your data with advertisers
• We do not use your data to make investment recommendations
• We do not track you across other websites

4. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), JWT-based authentication with token rotation, and rate limiting on sensitive endpoints. However, no system is perfectly secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your account information for as long as your account is active. Usage data is retained for up to 24 months for analytical purposes. If you delete your account, we will remove your personal information within 30 days, except where retention is required by law.

6. Third-Party Sub-Processors

We use the following sub-processors to operate the platform. Each has its own privacy/security posture. Data shared with each is limited to what the service requires to function.

• Render (hosting infrastructure + managed PostgreSQL + cron jobs) — stores all application data at rest; encrypted at rest by default; accessible by Render staff for platform operations. Located in the United States.
• Resend (transactional email delivery) — receives your email address, first name, and email body at send time. Retains message metadata for up to 30 days per Resend's retention policy. Used for: account registration, password reset, welcome, beta access, outreach, alert notifications, and digest emails.
• Sentry (application error monitoring) — receives error traces, stack frames, and request metadata when exceptions occur. We have configured Sentry with send_default_pii=False and request-body capture disabled, so your email/name/password are not intentionally transmitted. User IDs (integer) are included in error contexts for debugging. Session Replay is disabled.
• Google Analytics (site and product analytics, where enabled) — receives page paths, page titles, and product-event names, plus the technical signals Google collects when its measurement runs (see Section 7 for when that is). Configured analytics-only: no advertising features, no remarketing, no ads personalization, and no Google Signals are enabled in our configuration. In regions where our implementation requires prior consent, Google Analytics does not load and nothing is sent to Google unless you accept analytics; elsewhere you can turn it off at any time under Privacy choices below.
• SEC EDGAR — SpreadVista's backend retrieves regulatory disclosures from the SEC's public API. Your personal information is not transmitted; only SpreadVista's server identifiers appear in SEC access logs.

Other than Google Analytics as described above, we do not use third-party analytics, advertising, or marketing-tracking services. We do not sell personal data, and we do not share personal data with third parties for their own advertising purposes.

Data Processing Agreements (DPAs) are on file with Render, Resend, and Sentry. Request copies at privacy@spreadvista.com.

7. Cookies

We use essential cookies and local storage for authentication (JWT tokens), user preferences (sidebar state, tour dismissal), and a functional region flag that decides whether analytics needs your consent before running. These are required for the Service and are not controlled by the analytics preference.

Where Google Analytics runs (see Section 6), it sets its own analytics cookies. In regions where our implementation requires prior consent, no analytics cookie is set unless you accept; elsewhere analytics may run by default and you can opt out below — opting out stops future analytics and removes Google Analytics cookies. Declining optional analytics never restricts SpreadVista functionality.

8. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent for optional data processing

To exercise these rights, contact us at privacy@spreadvista.com.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For privacy-related questions or requests, contact us at privacy@spreadvista.com.