Privacy Notice

1. Who we are

StockTriage is operated by MangyByte Ltd, a company registered in England and Wales (Company No. 17175779) with its registered office at 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF (“we”, “us”, “our”). We are the data controller for personal data processed through the Service under the UK GDPR and the Data Protection Act 2018. You can reach our privacy contact at [email protected].

2. Personal data we collect

• Account data — your email address, a securely hashed password, and account settings.
• Usage & product data — your watchlists, saved views, report-view counts, paper-trade tracker entries and similar in-app activity.
• Broker connection data — if you choose to link a broker, the encrypted, read-only API key or token you provide, and the holdings data we retrieve to display alongside scores (see section 4).
• Billing data — subscription status and a billing customer reference. Card details are handled by Stripe; we do not store your full card number (see section 5).
• Technical data — IP address, device/browser information and security logs needed to operate the Service and protect against abuse.
• Communications — any messages you send us, such as support requests.

3. Purposes and lawful bases

• To provide the Service (accounts, rankings, watchlists, broker view, alerts) — lawful basis: performance of our contract with you.
• To take payment and manage subscriptions — performance of a contract.
• To keep the Service secure and prevent fraud and abuse — our legitimate interests.
• To send service emails (security, billing, neutral data-event alerts you have enabled) — performance of a contract or legitimate interests.
• Optional analytics to improve the Service — only with your consent (see cookies).
• To meet legal obligations (e.g. accounting) — legal obligation.

4. Broker API keys and holdings

If you link a broker, you either provide a read-only API key directly or authorise a read-only connection through our broker-connection aggregator, SnapTrade (operated by Passiv Inc., Fredericton, Canada). When you connect through SnapTrade you log in at your broker or via SnapTrade’s secure connection portal, so we never see your broker login credentials — we receive only a connection token and your read-only holdings. We verify the connection does not carry trading permission and reject any key that does. Keys and connection tokens are encrypted at rest using authenticated encryption (XChaCha20-Poly1305) with the key-encryption key held outside the application’s web root. We use the connection solely to display your holdings beside universal scores; your holdings are never used to calculate or alter any score, ranking or generated text. You can unlink a broker at any time, which deletes the stored key or token; holdings cached for display are deleted on unlink.

5. Payments

Subscription payments are processed by Stripe Payments Europe / Stripe, Inc. acting as a separate controller for card data. We receive only a customer reference and subscription status from Stripe; we do not receive or store your full card number. Stripe’s handling of your data is governed by Stripe’s own privacy policy.

6. Who we share data with

We do not sell your personal data and do not share it for third-party marketing. We share data only with processors who help us run the Service, on our instructions, including: our hosting provider, Stripe (payments), our transactional email provider, your chosen broker and, where you link a broker through it, our broker-connection aggregator SnapTrade (Passiv Inc.) — in each case only the connection you authorise — and any optional analytics provider you have consented to. Where a formal data-processing agreement is required under UK GDPR Article 28, we put one in place with that processor (SnapTrade/Passiv DPA sign-off is tracked separately). We may disclose data where required by law.

7. Retention

We keep account and product data for as long as your account is active. After you close your account or ask us to delete your data, we delete or anonymise personal data within a reasonable period, except where we must retain certain records (for example billing records for accounting and tax purposes) for the period required by law. Security logs are kept only as long as needed for security purposes.

8. Your rights

Under UK GDPR you have the right to access your data; to rectification; to erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent. To exercise any right, email [email protected]. We will respond within one month. Exercising your rights is free in most cases and will not disadvantage you.

9. Cookies

We use a small number of essential cookies needed to log you in, keep your session secure and remember your preferences; these do not require consent. We use analytics cookies only with your consent, requested via our cookie banner, and you can change or withdraw consent at any time. We do not use advertising or cross-site tracking cookies.

10. International transfers

Some of our processors (for example Stripe, and SnapTrade in Canada) may process data outside the UK. Where data is transferred outside the UK, we rely on an adequacy decision or appropriate safeguards such as the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

11. Security

We protect your data with measures appropriate to the risk, including encryption in transit, hashing of passwords, authenticated encryption of broker keys, access controls and logging. No system is perfectly secure, but we work to keep your data safe and will notify you and the regulator of any qualifying breach as required by law.

12. Contact and complaints

For any privacy question or to exercise your rights, contact [email protected]. If you are unhappy with how we handle your data you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to put things right first.