Privacy notice

Information we use and why

• Account details: email address, account identifier, account role and sign-in records. Supabase manages email/password authentication. If you choose Google sign-in, we receive the identity information supplied for that sign-in, such as your email address, name, profile image and Google identifier. We use this to create, secure and administer your account.
• Saved research: dashboard names, chart settings, selected series, saved series and economy watchlists, with ownership and timestamps. We use these to provide the features you choose. Public economic statistics can become personal information when linked to your account and research choices.
• Subscriptions: payment-provider customer and subscription identifiers, plan, payment status, billing-period dates and cancellation information. We send Stripe your account email and an account reference to connect your purchase to your account. Card entry takes place on Stripe-hosted checkout; our application does not store your full card number or security code.
• Email choices and delivery: selected alert types, timezone, preference changes and delivery records. Account verification, security and billing messages are separate from optional economic alerts. You can switch optional alerts off in My account → Email alerts.
• Support and requests: the messages and attachments you send us, and records of our response. Please avoid sending sensitive information that is not needed for your enquiry.
• Technical and security information: IP addresses, browser/device and request details, authentication events, error records and measures used to prevent abuse. We and our infrastructure providers use this information to deliver and protect the service and investigate faults.

We receive information from you, your use of the service, your chosen sign-in provider and our payment and email providers. Required account and payment information is needed to supply the corresponding features. Watchlists, sharing and optional alerts are your choice.

Our lawful bases

We use information needed to provide your account, saved research, subscription and requested support to perform our contract with you or take steps you request before a contract. For business account contacts, service administration may instead rely on our legitimate interest in serving the organisation.

We rely on legitimate interests for proportionate security, abuse prevention, troubleshooting, service administration, handling enquiries and defending legal claims. These interests are operating a safe, reliable service and protecting users and our business. We consider the impact on you and you can object to processing on this basis.

We rely on legal obligations for required accounting, tax and regulatory records and applicable privacy obligations. Optional economic alert emails rely on your consent; withdrawing it does not affect earlier lawful processing. Account registration is not consent to advertising. We do not sell personal information or use it for targeted advertising.

Who receives information

• Supabase provides authentication and database services. Our primary database is in London. See Supabase privacy information.
• Cloudflare hosts and delivers the website and provides network security, request handling and operational records. See Cloudflare privacy information.
• Resend sends authentication and application emails and processes recipient addresses, email contents and delivery information. Our sending domain uses its Ireland region. See Resend privacy information.
• Google Workspace handles our support email and correspondence. Google also supplies Google sign-in when you choose it, under its own account arrangements. See Google privacy information.
• Stripe and Link handle checkout, subscription payments, transaction support and associated messages. For Managed Payments purchases, the merchant of record shown at checkout handles the sale and applicable payment obligations. Stripe also acts as a controller for its own payment, fraud-prevention and legal purposes; its information handling is explained in Stripe’s privacy policy and the Link notices shown at checkout.

Authorised personnel and service providers may access information where needed to operate the service. We may also disclose necessary information to professional advisers, authorities where legally required, or parties involved in a business transfer with appropriate protections. A provider may use subprocessors; its public privacy notice does not replace our processing agreement with it.

Sharing a dashboard

Your saved dashboards are private to your account unless you enable a share link. Anyone with an active link can view the shared content and may download or copy it. Do not include confidential or personal information in content you choose to share. Disabling or replacing a link stops future access through that link, but cannot recall copies already made.

We maintain approximate share-link open counts using a per-page event identifier and time. Security checks also use request information and short-lived rate-limiting identifiers. If you are signed in, account information can be used to avoid counting your own visits. These counts are not advertising profiles.

International processing

Our UK location and the database and email regions above do not mean all processing stays in the UK or Europe. Suppliers and their subprocessors operate internationally, including in the United States. Their processing agreements provide safeguards for restricted transfers, including European Commission standard contractual clauses and the relevant UK transfer provisions where applicable. An applicable adequacy decision may also cover a transfer.

The contractual provisions are described in the Supabase, Cloudflare, Resend and Google Workspace processing terms. Contact us for details of the safeguards applicable to your information and a copy, subject to necessary redactions. Stripe explains its separate transfer arrangements in its privacy information.

How long information is kept

Account details and Free research are kept while your account remains open. When Pro access ends, all your saved dashboards and charts are archived for 30 days. Resubscribe before that deadline to restore them; otherwise they are permanently deleted. Your account stays open and you can start a new Free dashboard. Archived share links stop working and are not restored automatically. The recovery window also applies when Pro ends following a refund or an unsuccessful renewal. A verified account-deletion request removes archived research too, without waiting for the recovery window. Backups expire separately through their retention cycle. We do not currently apply an automatic inactivity deletion deadline.

Support, security and delivery records are retained according to their purpose: resolving your enquiry, investigating an incident, preventing repeat abuse, meeting legal duties or handling a dispute. We review what is necessary when handling a deletion request. A record needed for one of these purposes is restricted rather than used to keep providing a closed account.

Accounting records that we are legally required to retain are generally kept for six years from the end of the company financial year they relate to, or longer where the law requires it. This is not a retention period for every item of account data. Stripe applies its own legal retention obligations to payment records.

Removal from active systems does not instantly remove every backup or supplier log. Residual copies expire through backup and provider retention processes and are restricted from ordinary use. If a backup is restored, completed deletion requests must be reapplied. We explain any necessary retention when responding to your request.

Your choices, rights and complaints

Depending on the applicable law and circumstances, you can ask to access or receive a portable copy of your information, correct it, erase it, restrict its use or object to processing, including processing based on legitimate interests. You can withdraw consent to optional emails at any time. We do not make solely automated decisions about you that have legal or similarly significant effects; payment providers may make their own fraud decisions.

Contact [email protected] or use the instructions on our account deletion and data requests page. We may need proportionate identity verification. We normally respond to rights requests within one month; if a lawful extension is needed, we explain it. We acknowledge privacy complaints within 30 days, investigate and communicate the outcome.

You can complain to the UK Information Commissioner’s Office or your applicable local data protection authority, including an EU supervisory authority where relevant. These rights do not depend on maintaining a paid subscription.

For browser storage and external checkout/sign-in services, see our Cookies and browser storage notice. We will update this notice when our practices change and draw material changes to your attention as appropriate.