Privacy Policy

Last updated: April 18, 2026

1. Who We Are

DiviCharts ("we", "us", "our") operates the website divicharts.com. We provide dividend stock analytics and charting tools for individual investors. We are committed to protecting the privacy of our users.

2. Data We Collect

We collect the minimum data necessary to operate the service:

• Account & Identity Data: Email address, hashed password, full name, profile picture avatar URL, and Social SSO provider identifiers (Google, Apple) processed securely via Clerk, Inc.
• Usage Data: Tickers searched, pages visited, and feature interactions — used solely to improve the product.
• Payment Data: Processed by Stripe, Inc. — we never store your card number, CVC, or full billing details on our servers.
• Technical Data: IP address, browser type, device type, and essential cookies for authentication and session security.

3. How We Use Your Data

Your data is used exclusively to:

• Provide and maintain the DiviCharts service
• Authenticate your account via Clerk / Social SSO and manage your subscription
• Send transactional emails (welcome notifications, password resets, billing receipts)
• Improve product quality through aggregated, anonymized analytics

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contractual necessity: To deliver the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interest: To improve our product and prevent fraud (Art. 6(1)(f) GDPR).
• Consent: Where explicitly given, e.g., for optional marketing communications (Art. 6(1)(a) GDPR).

5. Your Rights Under GDPR

As a data subject in the EEA/UK, you have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten") — Request deletion and automated scrubbing of your data. We will comply within 30 days unless legal obligations require retention.
• Restriction — Limit how we process your data.
• Portability — Receive your data in a structured, machine-readable format.
• Objection — Object to processing based on legitimate interest.
• Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

6. Cookies

We use essential cookies strictly necessary for security and session authentication:

• dc_token — DiviCharts session authentication token (httpOnly, essential).
• dc_csrf — Double-submit CSRF security token (essential).
• __session / __clerk_db_jwt — Clerk authentication and Social SSO session management (httpOnly, essential).
• dc_demo_start — Tracks the start of the 7-day free trial window (httpOnly, essential).

We do not use third-party advertising or cross-site tracking cookies. No data is shared with advertising networks.

7. Data Retention & Automated Scrubbing

We retain your account data for as long as your account is active. If you request account deletion or trigger GDPR erasure, our system executes automated PII scrubbing (anonymizing email, clearing Clerk IDs, revoking tokens, and deleting watchlists) within 30 days, except where retention is strictly required by law (e.g., billing records for tax compliance).

8. Data Security

We implement industry-standard security measures including:

• Authentication & Social SSO are managed by Clerk, Inc. (SOC 2 Type II & ISO 27001 certified).
• Local credentials are hashed with bcrypt — passwords are never stored in plaintext.
• All traffic is encrypted via TLS/SSL (HTTPS enforced).
• Authentication tokens are signed with JWT and stored in httpOnly cookies.
• Payment processing is handled by Stripe, Inc., a PCI DSS Level 1 certified provider.

9. Third-Party Services & Sub-processors

We share data only with the following certified data processors, each subject to strict data processing agreements and privacy standards:

• Clerk, Inc. — User authentication & Social SSO provider (clerk.com/privacy)
• Stripe, Inc. — Payment processing (stripe.com/privacy)
• Hetzner Online GmbH — EU-based secure cloud hosting (hetzner.com/legal/privacy-policy)
• Vercel Inc. — Frontend web application hosting & CDN (vercel.com/legal/privacy-policy)
• Cloudflare, Inc. — DNS, security, and DDoS protection (cloudflare.com/privacypolicy)

10. International Data Transfers

Your data may be processed on servers located in the EU and US. Where transfers outside the EEA occur, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Children's Privacy

DiviCharts is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on the website. Continued use of the service after changes constitutes acceptance.

13. Contact & Data Protection Officer

For privacy-related inquiries or to exercise your GDPR data rights:
Email: [email protected]