Privacy Policy
What personal data we collect, why we collect it, the legal basis for each use, who processes it on our behalf, how long we keep it, and how you exercise your rights under the GDPR.
1. Who is the controller
The controller of your personal data is Norwic Finance, the operator of this platform, based in Porto, Portugal.
For any privacy question, or to exercise the rights described in section 9, write to norwicfinance@gmail.com.
We have not appointed a Data Protection Officer, as we do not meet the criteria in Article 37 of the GDPR. Privacy requests are handled directly by the address above.
2. Data we collect
Data you give us
- Account data — email address and password (stored only as a salted hash, never in readable form).
- Billing data — name, billing address, country and tax identification where required for invoicing. Card details are entered directly with our payment provider and never reach our servers.
- Support data — the content of messages you send us, and any information you choose to include in them.
- Preferences — the tickers, markets and topics you follow, and your notification settings.
Data generated by your use of the service
- Usage data — which analyses you open or generate, timestamps, plan quota consumption, and your research history.
- Technical logs — browser type, operating system, approximate region, error and performance events.
- Security data — sign-in attempts and rate-limit counters. IP addresses used for rate limiting and abuse prevention are stored as a salted SHA-256 hash, never in plain text.
- Consent records — when you purchase a plan we record the date, time, plan and the boxes you ticked accepting the Terms, the Refund Policy and your request for immediate access. This is required to evidence your express consent under consumer law.
We do not collect special categories of personal data, and we ask you not to send them to us. We do not collect data about your portfolio holdings, brokerage accounts or net worth, and you should not send that information to support.
3. Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and operate your account; deliver the research you subscribe to | Account, preferences, usage | Performance of a contract — Art. 6(1)(b) |
| Process payments, renewals and invoicing | Billing, account | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Enforce plan quotas and rate limits | Usage, hashed IP | Contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) |
| Prevent fraud, abuse and account sharing; keep the platform secure | Security data, technical logs | Legitimate interest in protecting the service — Art. 6(1)(f) |
| Provide support and answer your messages | Support, account | Contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) |
| Send service and transactional emails (briefs, alerts, billing notices, security notices) | Account, preferences | Contract — Art. 6(1)(b) |
| Send marketing emails about our own products | Account | Consent — Art. 6(1)(a), withdrawable at any time; or soft opt-in for existing customers |
| Evidence acceptance of the Terms and consent to immediate access | Consent records | Legal obligation and defence of legal claims — Art. 6(1)(c) and (f) |
| Keep accounting and tax records | Billing, invoices | Legal obligation — Art. 6(1)(c) |
| Improve the product (aggregate, non-identifying analysis of feature use) | Usage in aggregate | Legitimate interest — Art. 6(1)(f) |
Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and you may object at any time (section 9).
4. Research generation and automated processing
Our research is generated with the assistance of automated systems, including large language models supplied by a third-party provider, and is reviewed under human editorial supervision before publication. The Method page explains that process in full.
What this means for your data:
- The material sent to the model provider consists of market data, macro series, news and the ticker or topic requested. It is not accompanied by your name or email.
- Your account identifier is used on our side to store the result and count it against your plan quota — it is not part of the prompt.
- We do not permit the model provider to use content submitted through the platform to train its models.
- There is no automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 of the GDPR. The models produce research content; they make no decision about you.
If you type personal data into a free-text field that forms part of a research request, that text may be transmitted to the model provider. Do not include personal or confidential information in research requests.
5. Cookies and similar technologies
We keep cookie use to the minimum needed to run the service:
- Session cookie — an
httpOnly,Secure,SameSite=Laxcookie that keeps you signed in. Strictly necessary; no consent required. - Preference storage — remembers choices such as “remember me”. Strictly necessary for the feature you requested.
- Consent record — a record that you have accepted the terms notice, so it is not shown repeatedly.
We do not use advertising cookies, cross-site tracking, ad-tech pixels or data brokers, and we do not sell or rent personal data. If we later introduce analytics that are not strictly necessary, they will be added to this section and will be requested through a consent banner before being set.
6. Who we share data with
We share personal data only with providers that process it on our behalf, under a written processing agreement, and only to the extent needed to run the service:
| Provider | Role | Data |
|---|---|---|
| Vercel | Application hosting and delivery | Technical logs, request metadata |
| Supabase | Database and authentication | Account, usage, consent records |
| Anthropic | Language-model processing for research generation | Research request content (no account identifiers) |
| Payment provider, acting as merchant of record | Payments, invoicing and VAT handling | Billing data, transaction history |
| Email delivery provider | Transactional email and delivery of the briefs you subscribe to | Email address, delivery events |
Where the table names a category rather than a company, the specific provider is identified on your invoice and on request.
We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims. We do not sell personal data to anyone.
7. International transfers
Some of the providers above process data outside the European Economic Area, in particular in the United States. Where that happens, transfers are covered by the safeguards permitted under Chapter V of the GDPR — typically the European Commission’s Standard Contractual Clauses, an adequacy decision, or certification under the EU–US Data Privacy Framework, together with supplementary technical measures.
You may request a copy of the safeguards applicable to a specific transfer by writing to norwicfinance@gmail.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Account data | For as long as the account is active, then deleted or anonymised within 30 days of closure |
| Research history and usage | Life of the account; anonymised for aggregate statistics afterwards |
| Invoices and accounting records | 10 years, as required by Portuguese tax law |
| Consent records (terms, immediate access) | For the limitation period applicable to the contract, then deleted |
| Security logs and hashed IPs | 12 months |
| Support correspondence | 24 months after the request is closed |
| Marketing consent and opt-out records | Until withdrawn, plus a suppression record kept to honour the opt-out |
9. Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data, and a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where the conditions of Article 17 apply.
- Restriction — ask us to limit processing in the cases set out in Article 18.
- Portability — receive the data you provided in a structured, machine-readable format, or have it sent to another controller.
- Objection — object to processing based on legitimate interest, and object at any time to direct marketing.
- Withdraw consent — at any time, without affecting processing carried out before withdrawal.
To exercise any of these, write to norwicfinance@gmail.com from the address registered on the account. We reply within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We may ask for information to confirm your identity, but only what is necessary.
Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.
10. Security
We apply technical and organisational measures proportionate to the risk, including: encryption in transit (HTTPS/TLS), passwords stored only as salted hashes, session tokens in httpOnly cookies rather than browser storage, row-level access control on the database, restricted administrative credentials, rate limiting on authentication endpoints, IP addresses stored only as salted hashes, and a strict content security policy on the website.
No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where the risk is high, inform you directly.
11. Children
The service is not directed at people under 18 and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.
12. Complaints
If you believe we have not handled your data properly, please contact us first — most issues are resolved quickly. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or with the authority of your country of residence.
13. Changes to this policy
We may update this policy. Material changes will be announced on the platform or by email before they take effect, and the date at the top of this page will be updated.
Informational research content. It is not personalised investment advice. Decisions are the sole responsibility of the user.
← Back to home