1. Who we are
Stoxa (stoxa.io and app.stoxa.io) is operated by Azbouki R&D LTD, registered in Bulgaria (“Stoxa”, “we”, “us”). We are the data controller for the personal data described in this policy. Questions, requests and complaints go to hello@stoxa.io.
2. What we collect
Account data. When you create an account we receive your email address and, if you sign in with Google, the name and profile picture Google shares with us, plus a unique account identifier. Authentication is provided by Google Firebase; if you use a password, Firebase stores it in hashed form and we never see it.
Billing data. Subscriptions are processed by Stripe. Stripe collects your card details, billing address and any tax identifiers; we never receive or store full card numbers. We keep your Stripe customer identifier, your subscription plan and status, the renewal date and the email on the subscription so the product knows what you have paid for.
Things you save in the product. Saved screens, watchlists, valuation scenarios and backtest jobs you create, together with their names and settings.
API keys. If you create an API key we store a one-way hash of it, its first characters for display, the label you gave it, when it was created and when it was last used. The full key is shown to you once and is not recoverable by us.
Technical and usage data. Our servers log requests, including the IP address, browser or client identifier, the pages or API endpoints requested, timestamps and error details. We use these logs to keep the service running, to apply rate limits and to investigate abuse.
Correspondence. Emails you send us, including support requests.
We do not collect special-category data, we do not ask for your brokerage or portfolio holdings, and we do not build advertising profiles.
3. Why we use it and on what basis
We use personal data to provide the service you signed up for, to take payment and keep accounts, to secure the service and prevent abuse, to answer your messages, to tell you about material changes to the service or these terms, and to meet legal obligations such as tax record-keeping. Where the GDPR or UK GDPR applies, the legal bases are performance of our contract with you, our legitimate interest in running a secure and reliable service, and compliance with legal obligations. We send product or marketing email only with your consent, and every such email has an unsubscribe link.
4. Cookies and local storage
We do not use advertising cookies or third-party analytics trackers. The marketing site at stoxa.io sets no cookies of its own. The application at app.stoxa.io stores a sign-in token and your interface preferences in your browser so you stay signed in and the product remembers your settings; these are strictly necessary for the service. Stripe sets its own cookies on its checkout and billing pages, governed by Stripe’s privacy policy.
5. Who we share data with
We share personal data only with providers that help us run the service, under contracts that limit what they may do with it:
- Google (Firebase and Google Cloud) for authentication, website hosting and infrastructure.
- Stripe for payments, invoicing and subscription management.
- Email providers for transactional and support email.
The market and filings data in the product comes from sources such as the SEC’s EDGAR system, market-data vendors and central banks. We do not send your personal data to those sources. We do not sell personal data and we do not share it with advertisers. We may disclose data if the law requires it, to protect our rights or safety, or as part of a sale or reorganisation of the business, in which case this policy continues to apply.
6. International transfers
Our providers operate globally, so your data may be processed outside the country you live in, including in the United States. Where data leaves the European Economic Area, the United Kingdom or Switzerland we rely on the providers’ standard contractual clauses or an adequacy decision.
7. How long we keep it
Account data and the things you save are kept while your account exists and deleted or anonymised within 30 days of account deletion. Billing records are kept for as long as tax and accounting law requires, typically up to ten years. Server logs are kept for up to 90 days unless needed for an ongoing security investigation. Support correspondence is kept for up to two years.
8. Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on consent. Email hello@stoxa.io from the address on your account and we will respond within one month. You can also delete your whole account yourself from Settings in the product, which cancels any subscription and revokes your API keys at once; delete individual screens, watchlists, scenarios and API keys there too; and manage or cancel your subscription from the billing portal. If you live in the EEA, UK or Switzerland you have the right to complain to your data-protection authority.
9. Security
Traffic is encrypted in transit. Passwords are handled by Firebase and never stored by us in readable form. API keys are stored only as hashes. Access to production systems is limited to the people who operate the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
10. Children
Stoxa is for adults. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, tell us and we will remove it.
11. Changes to this policy
We will post changes here with a new effective date and, for material changes, email account holders before they take effect.