Privacy Policy

Version: [[ PRIVACY VERSION - PENDING OWNER INPUT ]] · Effective date: [[ POLICY EFFECTIVE DATE - PENDING OWNER INPUT ]]

This policy explains what [[ LEGAL ENTITY NAME - PENDING OWNER INPUT ]] collects when you use Regivion, why, and what you can do about it.

Who is responsible

[[ LEGAL ENTITY NAME - PENDING OWNER INPUT ]]
[[ REGISTERED ADDRESS - PENDING OWNER INPUT ]]
Company number: [[ COMPANY REGISTRATION NUMBER - PENDING OWNER INPUT ]]
Privacy contact: [[ PRIVACY CONTACT - PENDING OWNER INPUT ]]

What we collect

Data	Why
Email address	To identify your account and contact you about it
Password (stored only as a salted hash)	To authenticate you. We never store your password itself and cannot read it
Account status and creation date	To operate the account
Subscription status, plan and renewal date, plus Stripe customer and subscription identifiers	To give you access to paid features and to support billing
Record of which policy versions you accepted, and when	To evidence consent
Watchlists and portfolio entries you create	To provide the features you are using
Copilot conversations, where server-side storage is enabled	To maintain conversation context

What we do not collect

Regivion does not store your IP address, browser user-agent string or any device fingerprint against your account. It does not run analytics or advertising trackers, does not build behavioural profiles, and does not sell or share personal data with advertisers. It never sees your card details — those go directly to Stripe.

Purposes and lawful basis

Providing the service — performance of our contract with you.
Billing — performance of that contract and our legal obligations.
Security, abuse prevention and service integrity — our legitimate interests.
Consent evidence — compliance with our legal obligations.

We do not send marketing email and we do not collect marketing consent.

Service providers

We use a small number of providers to run the service:

Stripe — payment processing and subscription management.
Market and fundamental data providers — to supply financial data. They receive the symbols the system requests, not your identity.
Language-model provider — where Copilot's AI features are enabled, to generate responses.
Hosting and infrastructure — to run the application and store its data.

The definitive list of providers, their roles and their locations is [[ RETENTION PERIODS - PENDING OWNER INPUT ]] — owner review item: this must be completed with the actual provider list and any international transfer safeguards before launch.

Retention

We keep account data for as long as your account exists. After deletion, some records are retained where we are required or permitted to keep them — typically billing records for statutory accounting periods, consent evidence, and security logs. Specific retention periods: [[ RETENTION PERIODS - PENDING OWNER INPUT ]].

Backups are kept on a rolling schedule and expire automatically. Data can therefore persist in a backup for a period after deletion from the live system; it is not restored into the live service except in a disaster-recovery event.

Your rights

Subject to applicable law you may request access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing. You can also complain to your local data protection authority.

Signed-in users can request a copy of their data or the deletion of their account from the Account page, where those features are enabled. Requests are handled by a person, not instantly by the system — see the Account page and our Terms for what actually happens and when. You can also contact [[ PRIVACY CONTACT - PENDING OWNER INPUT ]] directly.

Security

Passwords are stored using salted PBKDF2-SHA256 hashing. Sessions use signed, HttpOnly cookies. Forms are protected against cross-site request forgery. Application logs are automatically scrubbed of email addresses, identifiers, credentials and file paths. Where per-account databases are in use, each account's data is held separately.

Children

Regivion is not intended for anyone under [[ MINIMUM AGE - PENDING OWNER INPUT ]]. We do not knowingly collect data from children.

Cookies

See the Cookies and Local Storage page for exactly what is stored in your browser.

Changes

If this policy changes materially we will update the version and effective date above, and may ask you to acknowledge the new version when you next sign in.