Privacy Policy

Effective 20 October 2026. How Stock Atlas collects, uses and protects personal information in connection with Stock Atlas.

The short version: we collect the minimum needed to run accounts and keep the Service working. We do not sell personal information, and we do not use your queries to build a profile of your investment activity.

1. Who is responsible

Stock Atlas is the controller of personal information described here. Contact: support@stockatlas.com.

2. Information we collect

Information you give us

  • Account details — email address, and any name or profile image you provide.
  • Authentication data — if you sign in with Google, we receive your email address, name and profile picture from Google. We never receive your Google password.
  • Correspondence — messages you send us by email or through the site.

Information generated by your use

  • API key metadata — keys you create, when they were created and last used.
  • Query logs — the queries your agent sends, with timestamps, so we can enforce rate limits, debug failures, and understand which capabilities matter. See section 4, which explains how we treat these.
  • Technical data — IP address, browser or client identifier, request timing, and error diagnostics.
  • Cookies — see section 8.

What we do not collect

We do not ask for and do not want your brokerage credentials, account numbers, positions, trades or holdings. The Service has no facility to receive them. Do not send them to us.

We do not currently process payments, and the free trial needs no card. When paid plans open, payment data will be handled by a payment processor, we will never see full card details, and we will update this policy before that happens.

3. Why we use it, and our legal basis

PurposeLegal basis (UK/EU GDPR)
Create and operate your accountPerformance of a contract
Authenticate requests and enforce rate limitsPerformance of a contract; legitimate interests
Detect abuse, protect the Service and other usersLegitimate interests
Diagnose errors and improve reliabilityLegitimate interests
Understand which features are used, in aggregateLegitimate interests; consent where cookies require it
Send service notices (outages, material changes)Performance of a contract
Comply with law and respond to lawful requestsLegal obligation

Where we rely on legitimate interests, we have weighed those against your rights and use the least intrusive means we reasonably can.

4. How we treat your queries

We recognise that what you query can reveal commercially sensitive information — which companies you are researching, and what you are looking for. We therefore commit that:

  • We do not sell, rent or share query logs with third parties for their own purposes.
  • We do not use your queries to trade, or to inform anyone else's trading.
  • Access to query logs is restricted to those who need it to operate the Service.
  • Where we analyse usage to improve the Service, we work with aggregated or de-identified data wherever that is sufficient.

5. Who we share it with

We do not sell personal information. We share it only with service providers who process it on our instructions:

ProviderPurposeLocation
Amazon Web ServicesHosting, database and backupsUnited States
SentryError monitoring and diagnosticsUnited States / EU
GoogleSign-in with Google; analytics, if enabledUnited States
Anthropic, OpenAIAI assistant features, where you use themUnited States

If you use an AI assistant feature on this site, the content of your messages is sent to the relevant model provider to generate a response. Do not enter anything in those features you would not want transmitted to a third party.

Connecting the Service to an external AI client — Claude, ChatGPT, Codex or similar — means that client sends your queries to us and returns our responses to its own platform. That platform's handling of your data is governed by its privacy policy, not this one.

We may also disclose information where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

6. International transfers

The Service is hosted in the United States. If you access it from outside the US, your information will be transferred to and processed there, under laws that may differ from those where you live. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

7. Retention

  • Account data — kept while your account is open, then deleted within 90 days of closure, except where we must retain it by law.
  • Query and access logs — retained no longer than 12 months, then deleted or aggregated.
  • Error diagnostics — retained according to our monitoring provider's default, typically 90 days.
  • Backups — database backups are retained on a rolling 14-day cycle, so deleted data may persist in backups for up to 14 days after deletion.

8. Cookies

We use a small number of cookies and similar storage:

  • Strictly necessary — session and CSRF cookies that keep you signed in and protect forms. These cannot be switched off.
  • Preferences — your light/dark theme and language choice, stored in your browser.
  • Analytics — only if analytics is enabled, and subject to consent where the law requires it.

You can block cookies in your browser, but the Service will not work properly without the strictly necessary ones.

9. Security

We use HTTPS throughout, store passwords only as salted hashes, restrict administrative access, keep encrypted backups, and apply security updates automatically. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any relevant regulator as required by law.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to our processing of your personal information, and to withdraw consent where we rely on it. To exercise any of these, email support@stockatlas.com. We will respond within the time the applicable law allows, normally one month.

UK and EU residents may lodge a complaint with their local data protection authority.

California residents have rights under the CCPA/CPRA to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.

11. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Automated rate limiting may temporarily restrict request volume; you can contact us to have that reviewed.

13. Changes to this policy

We may update this policy. If a change materially affects how we handle your personal information, we will notify you by email or a notice on the site before it takes effect. The effective date at the top always reflects the current version.

Contact

Privacy questions or requests: support@stockatlas.com