Privacy Policy

We take the protection of your personal data seriously. This policy informs you about which data we process when you use Glancefield and which rights you have.

1. Controller

Luca Koopmann
An der Feldscheune 22, 41470 Neuss, Deutschland
Email: lucakoopmann2010@gmail.com

2. Hosting

Our website is hosted by a service provider (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). When the pages are accessed, technically necessary data (including IP address, date/time, requested resource, browser type) is processed in server log files. The legal basis is our legitimate interest in secure and stable provision (Art. 6(1)(f) GDPR). A data processing agreement (DPA) is in place with the provider.

3. Account & sign-in (Supabase)

For login and account management we use Supabase (Supabase, Inc.). Sign-in uses your email address and a password you choose; the password is stored exclusively as a cryptographic hash at Supabase — it is not accessible to us in plain text. To confirm your address and reset your password we send links by email. We process your email address, a technical user identifier and the status of your subscription or trial. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). A DPA is in place with Supabase. Any transfer to third countries (e.g. the USA) is safeguarded on the basis of the EU standard contractual clauses.

4. Payment processing (Stripe)

For the paid “Glancefield Pro” subscription we use the payment provider Stripe (Stripe Payments Europe, Ltd.). You enter your payment data (e.g. card details) directly with Stripe — we do not receive or store complete payment data. To manage the subscription we only store a Stripe customer number, a subscription identifier, the status and the term end. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Stripe’s Privacy Policy applies.

5. Market data

We source prices, charts and news from external market-data services; the fundamentals come from the official financial reports — for US names from the EDGAR database of the US SEC, for European stocks from a table we maintain and check by hand. These queries are made server-side based on the security you search for: your browser does not contact these providers itself, and no personal data about you is transmitted to them — the providers only see our server. One exception is the price chart on stocks listed outside the USA — see immediately below.

Price chart by TradingView (stocks listed outside the USA)

On the pages of stocks listed outside the USA we embed the price chart from TradingView, Inc., 1330 Avenue of the Americas, 23rd Floor, New York, NY 10019, USA. That chart is loaded directly from TradingView’s servers. Your browser therefore opens a connection to them and transmits technically necessary connection data — in particular your IP address as well as details of your device, operating system and browser. TradingView may also set its own cookies or similar technologies on your device. We have no influence on the content or extent of that processing.

The sole purpose is to display the price history of these stocks; the valuations and metrics on our pages are calculated independently from our own data sources. The legal basis is our legitimate interest in a complete and lawfully licensed presentation of the price history (Art. 6(1)(f) GDPR). This involves a transfer to the USA; details and the legal bases for it are set out in TradingView’s Privacy Policy. If you want to avoid this connection, you can open the stock pages with a content blocker: the chart then stays empty and says so, while everything else on the page keeps working.

6. Reviews

As a signed-in user you can leave a review of Glancefield. The display name you provide, along with the star rating, title and text, are then publicly visible on the home page — so only publish there what should be visible to everyone. Internally we store the link to your account so you can edit your own review. The legal basis is your consent by submitting it (Art. 6(1)(a) GDPR); you can delete your review yourself at any time or ask us to. We reserve the right to remove unlawful or offensive contributions.

7. Protection against abuse (rate limiting)

To fend off automated mass requests, we limit the number of requests per user and time window. For this we use Upstash (Upstash, Inc.) with a data location in Frankfurt am Main. A counter linked to your IP address is processed, which expires automatically after a short time. The legal basis is our legitimate interest in protecting the Service from overload and abuse (Art. 6(1)(f) GDPR).

8. Cookies

We use exclusively strictly necessary cookies — specifically: to maintain your sign-in (Supabase), to remember your theme setting (light/dark) and your language choice, and so the cookie notice does not reappear after being dismissed. These are required for operation and do not require consent (§ 25(2) TDDDG). We do not use tracking, analytics or marketing cookies. For payment you are redirected to a Stripe page; which cookies Stripe sets there is governed by Stripe’s privacy policy (see section 4). On the pages of stocks listed outside the USA a chart by TradingView is also loaded, which may set its own cookies; we have no influence on that (see section 5).

9. Email delivery

Confirmation and password-reset emails are triggered by our Supabase account (see section 3) and delivered by the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Your email address and the content of the message are processed for the purpose of delivery. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). A DPA is in place with the provider; any transfer to third countries (e.g. the USA) is safeguarded on the basis of the EU standard contractual clauses. We do not send promotional emails or newsletters.

10. Retention period

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods (e.g. under commercial and tax law). If you delete your account, the associated data is deleted unless retention obligations prevent this.

11. Your rights

Under the GDPR you have, in particular, the following rights:

• Access to your processed data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

To exercise your rights, an email to lucakoopmann2010@gmail.com is sufficient.

12. Data security

Transmission is encrypted via TLS (HTTPS). We take appropriate technical and organizational measures to protect your data against unauthorized access.