Privacy policy

The controller

Investedia is operated by Adonay Kabeya, eenmanszaak, at [OWNER: registered address], Belgium. This operator is the controller for the processing described here. Privacy requests: [email protected] [OWNER: confirm mailbox forwarding and monitoring]. No data protection officer is claimed to have been appointed.

Data we actually use

For accounts, Supabase processes your email, password authentication information, user ID and authentication/session metadata. Your password is sent to Supabase for authentication; the site does not store a readable password. Google sign-in can provide your name, email, profile picture and provider identifier. Your account can hold a name, newsletter choice and watchlist. Country, topic and article follows are stored on the device in this branch.

Device storage can contain guest lists, country/topic follows, learning progress, display choices and popup-dismissal flags. Our storage inventory identifies the keys. Messages you send us include the contact details and information you provide.

Hosting, authentication and email services process technical logs such as IP addresses, request times, browser information and delivery/security events. We do not claim these logs are anonymous.

Purposes and legal bases

[OWNER: confirm these bases, assess legitimate interests and document provider contracts before publication]. We do not use account data to generate public news summaries, sell personal information or operate advertising trackers.

Providers and recipients

Supabase provides accounts and database storage (contracting entity and processing locations require verification; selected project region: [OWNER: verify Supabase project region]). Resend is configured for transactional email templates; its contracting entity and processing locations require verification. GitHub Pages hosts the site; the contracting entity and locations require verification. Their infrastructure and support subprocessors may operate in other countries.

Google processes sign-in when you choose it and, with the third-party-services choice, serves fonts. Brandfetch receives browser requests for logos only with that choice. Coinbase receives optional live-rate requests. Those requests disclose network information such as your IP address, user agent and permitted referrer. Google, Brandfetch and Coinbase may use international infrastructure: [OWNER: verify contracting entities, countries and processing terms].

Pixabay provides photographs downloaded by our news robot and served locally; displaying those saved photographs does not contact Pixabay. Google Gemini receives public source headlines/descriptions in the news workflow, not your account details. Google Search Console supports search-site administration; it is not a visitor tracking script added here. Instagram and original publishers receive data if you follow their links under their own policies.

International transfers

Transfers outside the EEA require an applicable legal mechanism. Depending on the provider and destination, that may be an adequacy decision, verified participation in the EU–US Data Privacy Framework, or standard contractual clauses with necessary supplementary measures. We do not assume every provider is DPF-certified. [OWNER: verify region settings, DPAs, SCCs, certification where relied on, and the transfer assessment].

See Supabase’s transfer information, Resend’s legal hub and GitHub’s privacy statement.

How long data is kept

Account and list data is needed while an account is active. Device keys without an expiry remain until cleared, withdrawn where applicable, or removed by your browser; closing a tab does not clear local storage. Consent expires after 12 months or a policy-version change. Session-only flags end with the browser session.

The current code does not enforce a scheduled deletion period for database events, account backups or provider logs. We therefore do not promise deletion within a fixed number of days. [OWNER: set and implement account-closure, backup, usage-event, correspondence, email and security-log retention periods; confirm each provider’s retention]. Any legal hold must be limited to what is required.

Your rights and choices

You may request access, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. You can withdraw optional consent through Cookie settings without affecting earlier lawful processing. Write to [email protected] [OWNER: confirm mailbox forwarding and monitoring], describing your request and the relevant account; we may ask for proportionate identity verification.

We aim to handle GDPR requests within one month, subject to the Regulation’s permitted extensions and exceptions. We will explain any extension or refusal and the available remedies. You can complain to Belgium’s Gegevensbeschermingsautoriteit / Autorité de protection des données via its official complaints page, or another competent supervisory authority.

Pro waitlist

If you join the Pro waitlist, we store your email address, the date you joined, the page you joined from and a record of your consent. We use it only to tell you when Pro opens and to send occasional product updates about Pro. Legal basis: your consent. We keep it until Pro launches and for up to 12 months after, or until you withdraw consent. You can withdraw at any time using the unsubscribe link in any email or by contacting us. The list is stored on our Cloudflare infrastructure and is never sold or shared. No payment information is collected.

Children, security and changes

Accounts are intended for ages 16 and over; this is a service policy, not a claim about Belgium’s statutory age of digital consent. Contact us if a child’s data needs attention. We use HTTPS and provider authentication/access controls, but no system is completely secure. The date above identifies this draft’s version; material privacy changes should receive appropriate notice.

Provider locations and retention awaiting confirmation

These periods and locations must be verified against actual settings and contracts; no deletion deadline is promised by the unresolved entries.

Retention accounts

[OWNER: retention accounts]

Retention watchlists

[OWNER: retention watchlists]

Retention follows

[OWNER: retention follows]

Retention correspondence

[OWNER: retention correspondence]

Retention email delivery

[OWNER: retention email delivery]

Retention security logs

[OWNER: retention security logs]

Retention backups

[OWNER: retention backups]

Hosting location

[OWNER: hosting location]

Resend location

[OWNER: resend location]

Gemini location

[OWNER: gemini location]

Brandfetch location

[OWNER: brandfetch location]

Pixabay location

[OWNER: pixabay location]

Google location

[OWNER: google location]

Coinbase location

[OWNER: coinbase location]

Public publisher RSS feeds and GDELT are fetched by the news robot on GitHub Actions. Those server-side requests do not send visitor account details. Country, topic and article follows currently use device storage; account watchlists use the Supabase watchlists table. An in-page headline popup polls the saved public feed; it does not itself send email notifications. Account and welcome email templates use Supabase Auth and Resend; template presence alone does not confirm deployment.