Privacy Policy

1. Who We Are

StockScore is a product of Zastras Ltd (company number SC832156), a company registered in Scotland with its registered office at 48 West George Street, 2nd Floor, Glasgow, Scotland, G2 1BP. Zastras Ltd is the data controller for the personal data described in this notice, and is registered with the Information Commissioner's Office (ICO) under registration number ZB948253.

2. What Personal Data We Collect

We collect the following categories of personal data:

• Account data: your name and email address, provided when you sign up.
• Payment data: your subscription is billed by our payment processor, Stripe. We do not receive or store your full card number - Stripe collects and processes it directly, and shares with us only what we need to run your subscription (for example, your subscription status, renewal date, and a truncated card reference such as the last 4 digits and card brand).
• Portfolio tracker data: any holdings, quantities, prices, dates and personal notes you choose to enter into the portfolio tracking tool. This is your own factual record-keeping data; we do not add to, assess, or act on it.
• Support requests: the name, email address and message content you submit through the Support page.
• Discount code redemptions: if you redeem a discount code, which code you used, when you redeemed it, and when the free access it gives ends.
• Account activity: when you signed up and last signed in, and a log of the actions you take in your account (for example signing in, subscribing or cancelling, adding or removing a card, updating your profile, exporting a CSV, or saving a portfolio-tracker entry), with the date and time of each. The log records the type of action only - not your holdings, prices, notes or card details.
• Usage and device data: collected via cookies, described in full in our Cookie Policy. Strictly necessary cookies (for example, to keep you signed in) are always active. Analytics and advertising cookies are only set if you consent to them, and you can withdraw that consent at any time.

3. Why We Process Your Data, and Our Legal Basis

Under UK GDPR, we must have a lawful basis for each way we use your data:

• Performance of a contract - creating and running your account, processing your subscription and payments, providing the formula-results dataset and the portfolio tracker, and responding to support requests you send us.
• Legitimate interests - keeping the Service secure (for example, fraud prevention and access logs), keeping a record of account activity so we can investigate problems and answer support or security questions about your account, and strictly necessary cookies required for the site to function. We only rely on this basis where it does not override your own rights and interests.
• Consent - analytics cookies (to understand how StockScore is used) and advertising cookies (to measure the effectiveness of our own ads, once that feature is live - see Section 4). You can give, refuse or withdraw this consent at any time using "Cookie Preferences" in the footer, with immediate effect.
• Legal obligation - keeping financial and billing records for the period required by UK tax and company law. In practice, these records are held by Stripe, our payment processor, under Stripe's own retention terms, since we don't separately store a copy ourselves (see Section 5).

4. Who We Share Your Data With

We do not sell your personal data. We share it only with the following service providers, each acting as our processor (or, for their own compliance obligations around payments, as an independent controller of the payment data they process):

• Stripe, Inc. - processes your payment card details and manages your subscription billing. Stripe is based in the United States; see Section 6 for how this international transfer is safeguarded.
• PostHog, Inc. - our analytics provider, used only if you consent to analytics cookies. PostHog is based in the United States; see Section 6.
• Meta Platforms, Inc. - our advertising cookie category exists so that, once this feature is live, we can measure the effectiveness of our own ads using Meta's Pixel and Conversions API, only for visitors who consent to advertising cookies. No data is currently sent to Meta through StockScore. We will update this notice when it goes live.
• Amazon Web Services (AWS) - hosts our infrastructure (application servers, databases and file storage) in AWS's EU (Ireland) region. Your account, subscription and portfolio-tracker data are stored there.

We may also disclose personal data where required by law, for example in response to a valid request from a regulator, court, or law-enforcement authority.

5. How Long We Keep Your Data

• Account and profile data: for as long as your account is active. Requesting deletion from your account settings flags your account for deletion by our team. We will update this notice with a definite timeframe once that process is automated.
• Billing and payment records: held by Stripe, our payment processor, under Stripe's own retention terms. StockScore's own systems do not separately store a copy of your billing or payment history today.
• Portfolio tracker data: for as long as your account is active; deleted when you delete your account. A deleted item may remain recoverable from our automated backups for up to 35 days afterward, as part of our disaster-recovery process, before it is gone from those backups too.
• Support requests: our aim is to keep these for up to 24 months after your request is resolved, so we can refer back to it if you contact us again about the same issue. This period is not yet enforced by an automated process, and is still subject to confirmation as part of our data-retention review - we will update this notice once that's settled.
• Discount code redemptions: for as long as your account is active, so that each code can only be used once per account; deleted when you delete your account.
• Account activity log: each entry is deleted automatically 12 months after it is recorded, or sooner if you delete your account. Your last sign-in date is kept with your account and profile data. As with other data, a deleted entry may remain in our automated backups for up to 35 days.
• Cookie consent choices: kept until you change them, or until a material change to what we use cookies for requires us to ask you again.

6. International Transfers

Stripe and PostHog are both based in the United States, so using them involves transferring personal data outside the UK. Where we transfer personal data internationally, we rely on legal safeguards recognised under UK GDPR, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism each provider has in place. AWS hosts our data in the EU (Ireland) region; as a global provider, AWS maintains its own transfer safeguards for any processing that involves other regions.

7. Your Rights

Under UK GDPR, you have the right to: access the personal data we have about you; have inaccurate data corrected (rectification); ask us to delete your data in certain circumstances (erasure); restrict how we use your data; receive your data in a portable format; object to certain processing; and withdraw consent at any time where we rely on consent (for example, analytics or advertising cookies). Please contact us (Section 8) if you wish to exercise any of these rights. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

8. Contact Us

For any question about this notice, or to exercise any of the rights in Section 7, please contact us via the Support page, which reaches Zastras Ltd directly.

9. Children

StockScore is not directed at, or intended for use by, children, and requires a valid payment card to sign up. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us (Section 8) and we will delete it.

10. Automated Decision-Making and Profiling

The StockScore formula applies a disclosed, mechanical calculation to company and market data to produce formula results - it does not process your personal data, and it does not make any decision about you. We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. Where you consent to analytics cookies, we use aggregate usage data to understand how StockScore is used and to improve it - this does not involve automated decisions about you either.

11. Cookies

For a full list of the cookies we use, what each one does, and how to manage your choices, see our separate Cookie Policy.

12. Changes to This Notice

We may update this notice from time to time, for example if we start using a new service provider or change what we collect. We will update the date below when we do.