Skip to content

Privacy notice

GDPR Articles 13 & 14 · last updated 16 July 2026 · draft pending legal review

Who we are (controller)

InsiderLens, established in Malta. Contact: privacy@insiderlens.com. Supervisory authority: the Maltese Information and Data Protection Commissioner (IDPC), with whom you also have the right to lodge a complaint.

What we process and where it comes from

We aggregate insider-trading disclosures that company executives are legally required to publish: names of reporting insiders, their roles, and their transactions (instrument, volume, price, dates). Sources: SEC EDGAR (US), Finansinspektionen (SE), BaFin (DE), AFM — Autoriteit Financiële Markten (NL), AMF (FR). We do not collect data from the persons themselves (Art 14 applies).

Why we may process this data (lawful basis)

Legitimate interest (Art 6(1)(f)): contributing to market transparency by making legally public regulatory disclosures accessible and analysable. A documented balancing test supports this basis. Statistical signals (e.g. cluster detection, track records) are derived solely from those public filings. No solely automated decision producing legal or similarly significant effects is made about anyone (Art 22).

How long we keep it (retention)

Who receives it (recipients / sub-processors)

Hosting and processing stay in the EEA: Neon (PostgreSQL, EU region), Railway (compute, EU region), Inngest (job orchestration). Our AI search operates on schema metadata only — personal data is never sent to AI model providers. For registered accounts (below): Stripe (payments, EU entity) and Resend (transactional email; EU sending region, account metadata stored in the United States under a data processing agreement with Standard Contractual Clauses). If you accept analytics cookies (below): Google Ireland Ltd (Google Analytics and Google Ads measurement; data may be transferred to the United States under Standard Contractual Clauses).

Your account & billing (registered users)

If you create an account, we process — on the basis of our contract with you (Art 6(1)(b)): your name, email address, password hash, email-verification status, session tokens, your subscription state (plan, status, billing interval — synced from Stripe), and monthly usage counters for metered features (AI searches, track-record views). Sessions do not store your IP address or browser fingerprint. Payment card data never reaches our servers — it is handled entirely by Stripe.

When you create an account, we also record how you arrived on the site — campaign parameters (utm tags, Google click ID), an optional referral tag and the referring site, read from a first-party cookie (see Cookies & analytics below). We use this on the basis of our legitimate interest (Art 6(1)(f)) to measure which of our channels work; it is never shared and is erased with your account.

Retention: usage counters are erased 12 months after their month; expired sessions and verification tokens are purged daily; account data lives until you delete your account. Deleting your account (from your account page, confirmed by email — Art 17) immediately cancels any subscription and erases your account, sessions and usage history. Invoices are retained by Stripe for the legally required accounting period (Art 17(3)(b)).

A subject access request (Art 15) returns your account data, your subscription state, your usage counters and the audit log of your AI search queries.

Desk team seats: when a subscriber invites a teammate, we store the invited email address to send the invitation. Once it is accepted, the two accounts are linked and the subscriber sees the teammate's name and address. Either side can end the link at any time; deleting either account deletes it.

Cookies & analytics

Signing in relies on strictly necessary first-party session cookies — no consent required. A first-party cookie (il_attr) also remembers how you arrived on the site (campaign parameters, referring site); we are the only reader. It lasts for your browsing session, or 90 days if you accept analytics.

Google Analytics and, when enabled, Google Ads conversion measurement only load after you accept through the cookie banner. Declining leaves the site fully functional. Your choice is stored for 6 months (il_consent) and you can change it here at any time. Withdrawing consent disables analytics and removes the analytics cookies on this site.

When enabled, Microsoft Clarity also uses cookies and masked session replays after your consent to help us understand clicks, scrolling and difficulties using the site. Text and images are masked. Account, sign-in and payment pages are excluded, as are pages with URL parameters. We send predefined usage events without your questions, email address or account identifier. Microsoft receives this usage data; processing may take place outside the EEA. Advertising consent is denied for Clarity. See Clarity data collection and retention and the Microsoft Privacy Statement for how Microsoft uses this data. A previous agreement covering Google Analytics alone does not enable Clarity.

Your rights

Access (Art 15), rectification (16), erasure (17), restriction (18) and, central here, the right to object (Art 21) to the processing of your data. Use the objection form or write to privacy@insiderlens.com. We answer within one month (Art 12(3)). If an objection is upheld, your profile is removed, the page returns HTTP 410 and search engines are asked to de-index it.