Privacy Policy

We collect the minimum information required to provide and bill for the Service:

• Account information you provide directly: name, email address, optional phone number, and password (stored only as a one-way hash; we never see your plain password).
• Billing information you provide during checkout: billing address and payment-method details. Card numbers are entered directly into Stripe's hosted form and never touch our servers; we receive only a tokenized payment method identifier and a redacted card brand + last four digits for display.
• Service usage data collected automatically when you use the Service: IP address, browser type and version, device identifiers, pages visited, and the time of each request. Used for security, abuse prevention, and product-quality monitoring.
• Communications you send us, including support email and any contact-form submissions.

• To create and maintain your account, authenticate sign-ins, and recover access.
• To process payments, send receipts, and manage subscriptions or passes.
• To deliver the analytics, charts, and educational content that constitute the Service.
• To respond to your support inquiries and notify you of material service changes.
• To detect, prevent, and address fraud, abuse, and security incidents (including rate-limiting and anomaly detection on authentication endpoints).
• To comply with legal obligations (e.g., tax reporting, lawful requests from regulators).

We do not use your information to serve third-party advertising, and we do not sell your personal information to anyone.

We share information only with the following service providers, and only to the extent needed for them to operate on our behalf:

• Stripe, Inc. — payment processing, subscription management, invoice storage. Stripe's use of your data is governed by their own privacy policy at stripe.com/privacy.
• Amazon Web Services — application hosting and transactional email delivery (via Amazon SES). Governed by aws.amazon.com/privacy.

We may also disclose information if required by law, valid legal process, or to protect the rights, property, or safety of our users or the public.

We use a single first-party authentication cookie (managed by NextAuth.js) to keep you signed in. We do not use third-party advertising cookies, fingerprinting, or cross-site trackers.

We retain your account information for as long as your account is active. When you delete your account (Settings → Account → Delete account), we immediately remove your User record and all linked passes, subscription state, and password-reset tokens from our database.

Billing records held by Stripe (Customer records, charges, invoices) remain in Stripe's systems indefinitely as required by financial-services regulation. We have no ability to delete those.

We follow industry-standard practices, including:

• HTTPS/TLS encryption for all traffic between your browser and our servers.
• Passwords stored as one-way hashes (bcrypt with salt) — never in plain text.
• Payment card data never stored on our infrastructure — handled entirely by Stripe.
• Access to production systems is restricted to authorized personnel.

No internet-connected system is perfectly secure. We work to protect your data but cannot guarantee absolute security.

• Access & correction — view and update your name, email, and phone from Settings → Account.
• Deletion — permanently delete your account from Settings → Account → Danger Zone.
• Marketing email — we do not send marketing email. All email is transactional (account verification, password resets, billing).

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, please contact us so we can remove it.

We may update this Privacy Policy from time to time. Material changes will be noted with an updated "Last updated" date at the top, and significant changes will be announced via email to registered users.

Questions about this policy or your data? Reach out at support@spxinsights.com.