Privacy Policy

This policy explains what personal information GLS Equity Limited (New Zealand) collects when you use glsequity.com, why, who we share it with, and the choices you have. We follow the New Zealand Privacy Act 2020 and, for visitors in the European Union, United Kingdom and other places with similar laws, the rights those laws give you.

1. What we collect

• Account details. Your email address, first and last name, and preferences (such as date format) when you create an account. We sign you in with a one-time code emailed to you, so we never store a password.
• Subscription and payment details. If you subscribe, our payment provider Stripe collects your card details directly. We never see or store your full card number. We receive and keep your Stripe customer ID, the plan you are on, its status and renewal date, the last four digits and brand of the card, your billing country, and any referral credits.
• Things you put into the Service. Watchlists, symbols you compare, saved scanner presets, trades and notes you log in the journal, equity and margin figures you enter on the Performance tab, and files you import. This can reveal your trading activity and account size; we treat it as confidential.
• Messages. Your name, email and message when you use the contact form.
• Usage and device data. Pages viewed, buttons clicked, approximate location from your IP address, browser and device type, and error reports. This is collected by our analytics tool and our own server logs.

2. Why we use it

• To run the Service for you: sign you in, show your watchlists and journal, apply your plan's limits and bill your subscription.
• To send you emails that are part of the Service: login codes, receipts, renewal and payment-failure notices, changes to terms or prices, and referral credit notices.
• To answer your messages and provide support.
• To understand how the site is used and fix problems, using aggregated analytics.
• To send occasional product news, if you have an account. Every such email has an unsubscribe link, and unsubscribing never affects the emails needed to run your account.
• To protect the Service, for example detecting shared accounts, abuse of referral credits or attempts to scrape data.
• To meet legal obligations, such as tax and accounting records.

Where GDPR or the UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in running, improving and protecting the Service, your consent for non-essential cookies and product news, and compliance with law.

3. Who we share it with

We do not sell personal information. We share it only with the service providers that run parts of the site for us, each under its own privacy and security commitments:

• Supabase - our database and sign-in system, holding account details and everything you save.
• Stripe - payments and subscription billing.
• Resend - sends login codes and account emails.
• Netlify - hosts the website and receives contact-form submissions.
• DigitalOcean - hosts the server that calculates valuations and serves data.
• PostHog - product analytics (page views and clicks), hosted in the United States.
• Cloudflare Turnstile - checks that a login or sign-up request comes from a person, not a bot. It sees your IP address and browser details for that check only.
• Financial Modeling Prep and Polygon.io - market data providers. They receive the stock symbols we look up, never your identity.

We may also disclose information if the law requires it, to enforce our terms, or as part of a sale or restructuring of the business (in which case this policy continues to apply). If GLS Equity moves to a company in another country in future, your information will be transferred to that company under the same protections and we will tell you.

4. Where it is stored

Our providers store data in the United States and other countries outside New Zealand. We only use providers that commit to protecting personal information to a standard comparable to New Zealand law, including standard contractual clauses where European or UK data is involved.

5. Cookies and similar technologies

• Essential: a sign-in token that keeps you logged in, and browser storage for preferences such as your date format, collapsed panels and which cookie choice you made. The site cannot work without these.
• Analytics: PostHog sets cookies to tell repeat visits from new ones and record which pages and buttons are used. We use this to improve the site, not to advertise to you, and we do not use advertising or cross-site tracking cookies.

The cookie banner records your choice. You can also block or delete cookies in your browser; the site keeps working, although you may be signed out.

6. How long we keep it

• Account data and everything you save: while your account exists, and for up to 30 days after you ask us to delete it, so a mistaken deletion can be reversed.
• Billing records: 7 years, as New Zealand tax law requires. These are kept even after account deletion, but hold only what is needed for accounting.
• Contact-form messages: up to 2 years.
• Analytics and server logs: up to 12 months, then deleted or made anonymous.

7. Your rights and choices

You can:

• see and update your name and preferences on your account page at any time;
• export your journal from the Performance tab;
• ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and its data - we will act within 30 days and, where we cannot fully comply (for example billing records we must keep), tell you why;
• unsubscribe from product news with the link in any such email;
• object to, or ask us to restrict, processing based on our legitimate interests, and withdraw consent where consent is the basis;
• complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or to your local data-protection authority.

To exercise any of these, use the Contact page from the email address on your account. We will confirm your identity before releasing or deleting anything.

8. Security

Data travels over encrypted connections and is stored with providers that encrypt it at rest. Access to your data inside the database is limited to your own account by row-level security. Card details go straight to Stripe. No system is perfectly secure; if we learn of a breach that is likely to cause you serious harm, we will notify you and the Privacy Commissioner as the law requires.

9. Children

The Service is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

10. Changes to this policy

We will update this page when our practices change and email account holders about any significant change. The date at the top shows the latest version.

11. Contact

GLS Equity Limited, New Zealand. Privacy questions and requests: the Contact page.