Privacy Policy

1. Introduction

Income Investor ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

This policy complies with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password (stored hashed), name
• Profile Data: Subscription tier, preferences, alert settings
• Usage Data: Ticker symbols you score, scoring requests, alert preferences
• Payment Information: Processed by Stripe (we do not store credit card details)

2.2 Automatically Collected Information

• Device Information: IP address, browser type, operating system
• Usage Analytics: Page views, feature usage, session duration
• Cookies: Authentication tokens, session management, preferences
• Performance Data: API response times, error rates

3. How We Use Your Data

We use your information for:

• Service Delivery: Providing dividend safety scores, email alerts, and portfolio analysis
• Account Management: Authentication, subscription management, billing
• Communication: Sending scorecards, alerts, and important service updates
• Improvement: Analyzing usage patterns to enhance features and performance
• Security: Detecting fraud, preventing abuse, protecting user data
• Legal Compliance: Meeting regulatory requirements and legal obligations

4. Data Sharing

We do not sell your personal data. We share data only with:

4.1 Service Providers

• Supabase: Database hosting and authentication (GDPR compliant)
• Vercel: Web hosting and CDN (GDPR compliant)
• Resend: Email delivery service (GDPR compliant)
• Stripe: Payment processing (PCI DSS compliant)
• Railway: Cron job hosting for automated scoring
• Microsoft Clarity: Session recordings and heatmaps that show how visitors use our pages. It loads only if you accept analytics cookies, and you can withdraw that choice at any time from the cookie settings.
• PostHog: Product analytics (page views and feature usage). In the browser it runs only if you accept analytics cookies; events for signed-in users are tied to your account ID, not your email address.
• Sentry: Error reports and performance traces that we use to detect and fix faults. Error reporting runs regardless of your cookie choices. Sentry session replays (with text masked and media blocked) load only if you accept analytics cookies.
• Cloudflare Turnstile: Bot protection on the free audit form and on the sign-in, sign-up, and password-reset forms, and when you change sensitive profile settings. The check runs in your browser against Cloudflare, which receives your IP address and browser information as part of running it, and our server sends the verification token to Cloudflare to confirm the result.
• Upstash: Redis hosting for our cache and for the rate-limit counters that protect our forms and API. A rate-limit counter is keyed by your account ID if you are signed in, or your IP address if you are not. One exception: if you unlock a free audit with your email address, that audit's daily counter is keyed by a one-way hash of the email address you verified, so the address itself is not stored in the counter. Some cached results are also stored under your account ID.
• Anthropic: The AI provider behind our support assistant. If you ask a support question, your question and a small amount of account context (your subscription tier, how long you have had your account, how many holdings you track, and whether your email is verified) are sent to Anthropic so it can generate an answer.

4.2 Legal Requirements

We may disclose data when required by law, court order, or to protect our rights and safety.

5. Your Privacy Rights

5.1 GDPR Rights (EU Users)

• Right of Access: Request a copy of your data (Export Data)
• Right to Rectification: Correct inaccurate data in your account settings
• Right to Erasure: Ask us to delete your account and all associated data (how to request deletion of your data)
• Right to Portability: Export data in JSON format
• Right to Object: Opt out of marketing emails (unsubscribe link in emails)
• Right to Restrict Processing: Limit how we use your data

5.2 CCPA Rights (California Users)

• Right to Know: What data we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

6. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: TLS/SSL encryption for data in transit, AES-256 for data at rest
• Authentication: Secure password hashing (bcrypt)
• Access Control: Role-based access control, row-level security in database
• Monitoring: Automated security monitoring, regular security audits
• CSRF Protection: State-changing requests from your browser session are validated against their origin (Origin/Referer checks), so requests forged from other sites are rejected. A few endpoints that never carry your session are exempt: payment webhooks are signature-verified, scheduled jobs and unsubscribe links use secret tokens, and the email tracking beacon is public by design
• Rate Limiting: API rate limits to prevent abuse

7. Data Retention

• Active Accounts: Data retained while account is active
• Deleted Accounts: Data permanently deleted within 30 days
• Backups: Backup retention for 90 days, then permanently erased
• Legal Holds: Data retained longer if required by law or litigation

8. Cookies and Tracking

We use cookies for:

• Essential Cookies: Authentication, session management (required)
• Analytics Cookies: Usage statistics via Vercel Analytics and PostHog, and session recordings and heatmaps via Microsoft Clarity, and session replays via Sentry Session Replay (optional, enabled only with your consent)
• Preference Cookies: Saving user settings (optional)

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

9. Children's Privacy

Our service is not intended for users under 18. We do not knowingly collect data from children. If we discover we have collected data from a child, we will delete it immediately.

10. International Data Transfers

Your data may be processed in the United States and other countries. We use Standard Contractual Clauses (SCCs) and ensure all processors are GDPR compliant.

11. Policy Changes

We may update this policy periodically. Material changes will be communicated via email and posted on this page with a new "Last Updated" date.

12. Contact Us

For privacy questions, data requests, or to exercise your rights: