This policy explains what EquityBias collects, why, who else sees it, and what you can ask us to do about it. We are in the EU, so the GDPR applies to all of it.
The data controller is Jones Inc., CVR DK34325170, Denmark, operating this site as EquityBias. For anything in this policy, write to contact@equitybias.com. We have not appointed a data protection officer, which we are not required to do at this size, and questions go to the same address.
Your account. Email address and an encrypted password, held by Supabase. We never see the password. Processed to give you the service you signed up for, which is a contract under article 6(1)(b).
Your subscription. If you subscribe, Lemon Squeezy handles the payment as Merchant of Record and holds your card and billing details. We never receive your card number. What reaches us is your plan, whether the subscription is active, and when the period ends. Contract, and for the invoice records, a legal obligation under EU and Danish accounting rules, article 6(1)(c).
What you save in the product. The stocks in your portfolio or watchlist, and your display preferences such as layout and theme. Contract.
Email and notifications you ask for. The daily digest and the watchlist report: your address and the tickers you named. Browser notifications: the push endpoint your browser issues. Consent, article 6(1)(a), withdrawable at any time through the unsubscribe link in every mail or from your account page.
Product news and marketing. A separate, unticked box at signup and on the watchlist form, and a switch on your account page. Consent, and we store the date and the exact wording you agreed to. Receipts, password resets and subscription notices are service messages, are not marketing, and are sent whatever that switch says.
Usage measurement. Which pages are opened, when, from what country and device type, and where the visit came from. It runs only if you allow it, so the basis is consent under the Danish cookie order, and for signed-in members the events are linked to the account so we can see whether members come back. We do not store your IP address, the country comes from the network connection, and there is no advertising tracker anywhere on this site. Full list on the cookie page.
Visit counts. Separately, Vercel, which hosts the site, counts page views for us in aggregate: the page, the referring site, campaign tags, country, device and browser type. Nothing is stored on your device and no cookie is set, so it runs without asking, and a visit cannot be linked to you, to your account or to a visit on another day. We strip everything else from the address before it is counted. Legitimate interest under article 6(1)(f) in knowing how many people reach the site and from where.
Feedback you send us. If you fill in the feedback form during a trial, the answers you pick, anything you write in your own words, and the language you chose. Stored against your account so we stop asking once you have answered. Legitimate interest under article 6(1)(f) in knowing where the product falls short, balanced against a form you chose to open.
Support chat. If you open the chat, Crisp holds the conversation and the address you give it. Legitimate interest in answering you.
We make no automated decisions about you in the sense of article 22, and nothing about your account or your price depends on how you use the product.
Each of these processes data on our behalf, under a written data processing agreement, and for no other purpose. None of them is allowed to use it for their own ends.
We do not sell data, we do not share it with advertisers, and we do not run data through a language model that is connected to a person. The text our pipeline sends to Anthropic and ElevenLabs is about stocks and contains nothing about you.
Your account, your saved data and the usage events sit in Supabase's Frankfurt region, inside the EU. Crisp is in France. Neither involves a transfer out of the EU.
Vercel, Lemon Squeezy, Resend and Cloudflare are established in the United States or process data there. Those transfers take place under the European Commission's standard contractual clauses, and where the provider is certified, under the EU-US Data Privacy Framework.
We do not pretend the remainder is nothing. Data held in the United States is subject to United States law, including access by public authorities on terms that differ from EU law. What crosses is your email address, your subscription status and the delivery of messages you asked for. The database itself does not leave the EU. If you would rather none of it happened, do not create an account: every public page on this site, including every score history, works without one.
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to anything we do on legitimate interest, and ask for your data in a portable form. Where we rely on consent you can withdraw it at any time, and withdrawing does not undo what was lawful before you did.
Write to contact@equitybias.com and we will answer within one month. Deleting your account removes your profile, your saved data and your usage history. If you think we have handled your data badly you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.
An email address is required to have an account, because there is no other way to sign you in or send you what you asked for. Everything else is optional, and the public pages, including every score history, work with no account at all.
Data is encrypted in transit and at rest by our providers, access to the production database is limited to the people who need it, and passwords are stored hashed by Supabase rather than by us. If a breach happens that is likely to put your rights at risk, we will tell Datatilsynet within 72 hours and tell you without undue delay.
When this policy changes materially we update the date below. Changes that affect what you consented to reset the consent question rather than being applied to an old answer.
Last updated: September 2026