Privacy Policy

1. Who We Are

The data controller is Monolitics OÜ, a private limited company registered in Estonia (registry code 17569508), Viru väljak 2, Kesklinna linnaosa, 10111 Tallinn, Harju maakond, Estonia. You can reach us about any privacy matter at support@metravise.com.

This policy applies to users in the European Union under the GDPR and to users in Turkey under the Turkish Personal Data Protection Law (KVKK).

2. Data We Collect

Account and sign-in: Your email address, your name (optional), and your password, which we never store in plain text (it is hashed with bcrypt). If you sign in with Google, we receive your email address, name and profile picture from Google and store no password. We also keep sign-in and activity timestamps, and one-time codes for email verification and password resets (stored only in hashed form).

Subscription and payments: Payment and billing are handled by Stripe, through Link, as the merchant of record (the seller of record for your purchase): Stripe calculates and collects any applicable tax and issues your receipts and invoices. You enter your card details directly with Stripe; we never see or store your full card number or security code. We keep your plan, subscription status, payment amounts and dates, invoice records, refunds, your billing country and the Stripe reference numbers that link these records.

Region and language: Your language, the time zone you choose for notifications, and a two-letter country code derived from your connection, which we use for regional pricing. We do not store your IP address for this purpose.

Content you create: Transactions and cash amounts you enter in My Portfolio, price and Quality Score alerts, saved screens and column choices in Explore, comparison lists, notification preferences (including quiet hours), and share links you create.

Notifications: Notifications we show you in the app, whether they were delivered or opened, and, if you turn on browser notifications (Web Push), the technical address and keys your browser gives us for delivering them, together with your browser type.

Emails and the mailing list: Which emails we send you and whether they were delivered, bounced or reported as spam, and your unsubscribe choices. If you request the free guide or join the mailing list without an account, we keep your email address, language, the text of the consent you gave and when you confirmed it, and, as proof of that consent, the IP address and browser details at the time of sign-up, plus campaign or referral tags if present.

Usage inside your account: Which screens and features you use, which stocks you view (the ticker symbol), and events such as signing in, starting a trial, purchasing, cancelling, sharing, setting an alert or completing the welcome tour. This is our own (first-party) data, tied to your account; it is never sold or used for advertising.

Feedback: Your answers to short surveys (for example, why a trial ended or why you cancelled), any comment you add, and your answer to "Was this helpful?" in the Help Center.

Content protection: Subscription content carries invisible marks that are unique to each account, and we record which protected content was accessed and when. This lets us identify the account from which content was shared without permission.

Sharing and public pages: A share page shows a frozen snapshot of stock data; it does not show your name or email. We count visits to share pages using a pseudonymous code that changes daily and cannot be traced back to an IP address, and we record when a share link leads to a sign-up.

Security and abuse prevention: Forms such as sign-up, password reset and the free guide are protected by Cloudflare Turnstile, which checks your browser for automated activity. A random identifier in a cookie stops the free trial from being started repeatedly in the same browser. To block brute-force attempts we keep short-lived counters, held only in memory and keyed by IP address and email address.

Support: Whatever you share with us when you contact support. If you use the Support assistant in the app, we keep your questions, the answers, the Help Center articles they were based on, the page you were on and usage counts. If you send a request to the support team, we keep the topic and your message, together with your recent assistant chat, the page you were on, your plan, language and browser details, which are attached automatically.

3. Why We Use Your Data and Our Legal Bases

• To provide the service (performance of a contract): creating and running your account, the features you use, your subscription and payments, service emails such as verification, password, payment and account messages, and answering your support questions (including the Support assistant).
• Legitimate interests: keeping the Platform secure and preventing fraud and abuse; understanding how the product is used so we can improve it; content protection; tips during your trial based on how you use the app (for example, a reminder about a stock you viewed); and the Daily Bulletin and occasional product news for customers and former trial users, which you can turn off at any time.
• Consent: the mailing list and free guide, analytics cookies, browser notifications, and the share-link sign-up cookie. You can withdraw consent at any time; this does not affect processing before the withdrawal.
• Legal obligations: keeping accounting and tax records and responding to lawful requests from authorities.

Our scores and observations are about stocks, not about you. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your data and do not use it for advertising.

4. Emails We Send

Service emails (account verification, password changes, payment receipts, account deletion) are part of the service and are always sent. Other emails can be switched off: the Daily Bulletin, trial tips, notification emails, and occasional product updates and offers. Every such email has a one-click unsubscribe link, and you can choose email types one by one under Settings → Notifications. When an address unsubscribes, bounces or reports spam, we keep it on a suppression list so we do not email it again.

5. Service Providers

We share personal data only with providers that help us run the Platform, and only for that purpose:

• Hetzner (hosting): servers and database, located in the European Union (Finland).
• Cloudflare (network, security and Turnstile): routes all traffic to the Platform, protects it from attacks and runs the bot check on our forms; it processes technical request data such as IP addresses.
• Resend (email delivery): sends our emails; it processes your email address, the content of the emails and delivery events.
• Stripe (payments): processes payments, card details and refunds; it receives your email address and billing details.
• Link (Stripe) (merchant of record): sells the subscription to you on our behalf, calculates and collects tax, sends receipts and invoices, and offers order management and payment support; it receives your email address, name, billing address and payment details.
• Google (sign-in, analytics and backups): Google sign-in if you choose it; Google Analytics, as described in the Cookie Policy; and Google Drive for off-site backups, which are encrypted before they leave our servers.
• Browser notification services (Apple, Google, Mozilla or Microsoft, depending on your browser): deliver browser notifications if you turn them on; the content they carry is encrypted.

We use AI tools to help prepare general market content such as the Daily Bulletin; no personal data is sent to them for that. The Support assistant in the app uses an AI service provider for one purpose only: preparing an answer to your support question. It receives your question, the earlier messages in the same chat and the relevant Help Center articles, but not your name or email address. Our market and news data providers do not receive any personal data.

6. International Transfers

Our database is hosted in the European Union. Some providers (Cloudflare, Resend, Stripe, Google and the AI service provider used by the Support assistant) may process data in the United States or other countries outside the European Economic Area and Turkey. When they do, we rely on the safeguards required by law: the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses, and, for users in Turkey, the safeguards required by KVKK.

7. How Long We Keep Data

• Account data and content you create: for as long as your account exists.
• Detailed usage records: 90 days, after which they are reduced to anonymous totals.
• Support assistant chats: 90 days after the last message, then deleted automatically. The chat copy attached to a support request is removed after the same period; the request itself (topic and message) is kept for as long as your account exists.
• When you delete your account, invoice and payment records are kept for the period required by accounting legislation; all other personal data is deleted (your profile is anonymized; mailing-list consent records and the suppression list are kept as described below).
• Mailing list consent records and the email suppression list: kept after you leave or unsubscribe, so we can prove consent and make sure we do not email you again.
• Backups: daily database backups are kept for 14 days on our servers; encrypted off-site copies are kept for 30 days, plus one copy per month for 12 months. Deleted data disappears from backups as they expire.

8. Security

We use encrypted connections (HTTPS), hashed passwords and one-time codes, access limited to authorized staff with an internal audit log, encrypted off-site backups, and rate limits against brute-force attempts.

9. Your Rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing (including at any time to direct marketing), to receive it in a portable format, and to withdraw any consent you gave.

You can delete your account yourself under Settings → Account, change your email preferences under Settings → Notifications, and cancel your subscription in your account. For any other request, write to support@metravise.com; we answer within one month.

You can also complain to a data protection authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon); in Turkey, the Personal Data Protection Authority (KVKK); or the authority in your country of residence.

10. Children

The Platform is intended for adults aged 18 and over. We do not knowingly collect data from children; if we learn that we have, we delete it.

11. Cookies

See our Cookie Policy for the cookies and similar technologies we use.

12. Changes to This Policy

We may update this policy. The date at the top shows the latest version. We will tell you about significant changes in the Platform or by email before they take effect.

13. Contact

Monolitics OÜ · Registry code 17569508 · Viru väljak 2, Kesklinna linnaosa, 10111 Tallinn, Harju maakond, Estonia · support@metravise.com