Privacy Policy

Last updated: March 28, 2026

SpreadVista ("we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our platform and services.

1. Information We Collect

Account Information

When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Usage Data

We collect information about how you use the Service, including pages visited, features used, search queries, watchlists created, and session duration. This data helps us improve the product and understand which features provide the most value.

Feedback

When you submit feedback through the in-app widget, we store the message content, the page you were on, and your user ID.

Technical Data

We automatically collect standard technical information including IP address, browser type, device type, and referring URL. This is used for security, debugging, and aggregate analytics.

2. How We Use Your Information

To provide, maintain, and improve the Service
To authenticate your identity and manage your account
To communicate with you about the Service, including updates, security alerts, and support
To respond to your feedback and support requests
To monitor usage patterns and improve the user experience
To detect and prevent fraud, abuse, or security threats
To comply with legal obligations

3. What We Don't Do

We do not sell your personal information to third parties
We do not share your data with advertisers
We do not use your data to make investment recommendations
We do not track you across other websites

4. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), JWT-based authentication with token rotation, and rate limiting on sensitive endpoints. However, no system is perfectly secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your account information for as long as your account is active. Usage data is retained for up to 24 months for analytical purposes. If you delete your account, we will remove your personal information within 30 days, except where retention is required by law.

6. Third-Party Sub-Processors

We use the following sub-processors to operate the platform. Each has its own privacy/security posture. Data shared with each is limited to what the service requires to function.

Render (hosting infrastructure + managed PostgreSQL + cron jobs) — stores all application data at rest; encrypted at rest by default; accessible by Render staff for platform operations. Located in the United States.
Resend (transactional email delivery) — receives your email address, first name, and email body at send time. Retains message metadata for up to 30 days per Resend's retention policy. Used for: account registration, password reset, welcome, beta invite, outreach, alert notifications, and digest emails.
Sentry (application error monitoring) — receives error traces, stack frames, and request metadata when exceptions occur. We have configured Sentry with send_default_pii=False and request-body capture disabled, so your email/name/password are not intentionally transmitted. User IDs (integer) are included in error contexts for debugging. Session Replay is disabled.
SEC EDGAR (public data source) — SpreadVista queries the SEC EDGAR API for filings. Your information is not sent to the SEC; only SpreadVista's server identifiers appear in SEC's access logs.

We do not use third-party analytics, advertising, or marketing-tracking services. We do not sell or share personal data with third parties for their own purposes.

Data Processing Agreements (DPAs) are on file with Render, Resend, and Sentry. Request copies at privacy@spreadvista.com.

7. Cookies

We use essential cookies and local storage for authentication (JWT tokens) and user preferences (sidebar state, tour dismissal). We do not use tracking cookies or third-party cookies.

8. Your Rights

You have the right to:

Access the personal information we hold about you
Correct inaccurate information
Request deletion of your account and associated data
Export your data in a portable format
Withdraw consent for optional data processing

To exercise these rights, contact us at privacy@spreadvista.com.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For privacy-related questions or requests, contact us at privacy@spreadvista.com.

1. Information We Collect

Account Information

When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Usage Data

Feedback

When you submit feedback through the in-app widget, we store the message content, the page you were on, and your user ID.

Technical Data

We automatically collect standard technical information including IP address, browser type, device type, and referring URL. This is used for security, debugging, and aggregate analytics.

2. How We Use Your Information

To provide, maintain, and improve the Service

To authenticate your identity and manage your account

To communicate with you about the Service, including updates, security alerts, and support

To respond to your feedback and support requests

To monitor usage patterns and improve the user experience

To detect and prevent fraud, abuse, or security threats

To comply with legal obligations

6. Third-Party Sub-Processors

We use the following sub-processors to operate the platform. Each has its own privacy/security posture. Data shared with each is limited to what the service requires to function.

Render (hosting infrastructure + managed PostgreSQL + cron jobs) — stores all application data at rest; encrypted at rest by default; accessible by Render staff for platform operations. Located in the United States.

Resend (transactional email delivery) — receives your email address, first name, and email body at send time. Retains message metadata for up to 30 days per Resend's retention policy. Used for: account registration, password reset, welcome, beta invite, outreach, alert notifications, and digest emails.

Sentry (application error monitoring) — receives error traces, stack frames, and request metadata when exceptions occur. We have configured Sentry with send_default_pii=False and request-body capture disabled, so your email/name/password are not intentionally transmitted. User IDs (integer) are included in error contexts for debugging. Session Replay is disabled.

SEC EDGAR (public data source) — SpreadVista queries the SEC EDGAR API for filings. Your information is not sent to the SEC; only SpreadVista's server identifiers appear in SEC's access logs.

We do not use third-party analytics, advertising, or marketing-tracking services. We do not sell or share personal data with third parties for their own purposes.

Data Processing Agreements (DPAs) are on file with Render, Resend, and Sentry. Request copies at privacy@spreadvista.com.