Privacy notice
Effective 28 August 2026.
Controller and contact
The controller's legal contact details are provided here before a paid subscription is offered.
Data we process
We process account and contact data, profile preferences, analysis and workspace data you save, watchlists and portfolios, subscription and payment status, support and withdrawal records, limited product-analytics events, and security and operational logs.
Payment-card details are processed by Stripe and are not stored by StockBox.
Purposes and legal bases
Contract: account data, analyses, saved workspaces, subscriptions and customer support are processed when necessary to enter into or perform our contract with you.
Legal obligation: payment, invoice and bookkeeping data are processed where Swedish or other applicable law requires it.
Legitimate interests: limited security, abuse-prevention, error and product-analytics data are processed to protect the service, prevent misuse and improve reliability. We apply data minimization and balance these interests against user rights.
Product analytics
Server-side product-analytics events may be sent to PostHog. The StockBox analytics boundary does not send raw user IDs, analysis IDs, Stripe subscription IDs, email addresses or free-form search strings. The user identifier is one-way pseudonymized and event properties are limited by an explicit allowlist.
When Google Analytics 4 or Meta Pixel are configured, these browser-based analytics tools load only after you explicitly give consent in StockBox. If you reject consent, they are not loaded, and essential account, billing and security functions continue to work.
Processors and recipients
We use service providers to operate StockBox. The principal providers are Supabase for authentication and database services, Vercel for hosting and operations, Stripe for payments and subscriptions, PostHog for limited product analytics, Google Analytics 4 and Meta Pixel only when configured and consented to, and, when email delivery is enabled, the configured email provider. They may process personal data only for agreed purposes and subject to applicable data-protection requirements.
International transfers
Some providers may process personal data outside the EU/EEA. Where GDPR requires it, we rely on a valid transfer mechanism such as an adequacy decision of the European Commission or Standard Contractual Clauses, with supplementary safeguards where appropriate.
Retention
Account, profile and workspace data are kept while the account is active and afterwards only as long as needed to complete account closure, handle legal claims or meet legal obligations.
Accounting records and invoice material covered by Swedish bookkeeping law are retained for the statutory archive period, normally seven years after the end of the calendar year in which the financial year closed.
Security, operational and analytics data are kept only as long as needed for troubleshooting, protection, abuse prevention and product improvement. Retention is reviewed regularly and data is deleted or aggregated when no longer needed.
Withdrawal and support records are retained as long as needed to handle the matter and document compliance with legal obligations.
Your rights
Depending on the circumstances, you have rights to information, access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent without affecting prior lawful processing.
Use the contact form to exercise your rights. We may need to verify your identity before disclosing or changing data.
Complaints to IMY
If you believe our processing infringes data-protection law, you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY). If you live in another EU/EEA country, you may also contact the supervisory authority where you live or work.
Automated assessments
StockBox uses models to produce assessments about securities. These models do not make decisions about you as an individual that produce legal or similarly significant effects under GDPR.
Security and changes
We use technical and organizational safeguards including access controls, row-level security, secure session flows, data minimization and sanitized operational logs. This notice may be updated when processing activities, providers or legal requirements change. Material changes are communicated appropriately.