AtradianPrivacy Policy
Last updated Oct 6, 2026
Atradian is a market-research service. We keep the personal data we hold to the minimum needed to run your account, and we never sell it. This policy explains what we collect, why, who processes it and your rights under the EU General Data Protection Regulation (GDPR) and Irish law.
1. Who we are
Atradian, 23 Templeogue Road, Terenure, Dublin, Ireland ("we", "us") is the data controller for the personal data described in this policy.
Contact us about privacy at privacy@atradian.com. We are not required to appoint a Data Protection Officer. If that changes, we will publish their contact details here.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email address, hashed password or magic-link sign-in, account creation date | You |
| Subscription & billing | Plan (Free / Pro / Elite), billing currency, Stripe customer and subscription IDs, renewal and cancellation dates. We never see or store your full card number. Stripe handles it. | You, Stripe |
| Community | The username you choose, the comments and threads you post (text and emoji only, up to 1,000 characters each, with the time posted), likes, pinned/hidden/followed threads, who you tag, Community alerts, and any abuse reports you send or that are made about your comments | You, other members |
| Research preferences | Watchlist symbols, alert settings and alert history, research report requests, questions asked of the research Q&A, backtests and Opportunity Chains you build | You |
| Portfolio X-ray holdings and daily workflow | Positions you upload, paste or confirm from a screenshot (tickers, names, ISINs, quantities, cost, values, cash and totals), accepted snapshots, your rules, sleeves, thesis cards, decision journal, cash flows, daily briefs and review-queue notes. We do not connect to your broker and never receive your broker credentials or account numbers. Screenshot images are processed in memory and never stored. | You |
| Alert delivery | Email address, and (optionally) a Telegram chat ID or a webhook URL you give us | You |
| Usage & device | Only if you accept analytics cookies: pages viewed, a random visitor ID, first-visit campaign (UTM) tags and referrer. Always: browser type, approximate country (for currency) and IP address in server logs | Your browser, our hosting providers |
We do not collect special-category data. Please don't send us any. The market data, scores, regime calls and research on the service are about public securities, not about you.
3. How we use it and our lawful bases
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Create and secure your account, sign you in, provide the features of your plan | Contract (6(1)(b)) |
| Take payment, manage renewals, upgrades, cancellations and refunds | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) |
| Personalise the daily brief, watchlist hits, alerts and digests to the symbols you follow | Contract (6(1)(b)) |
| Send service emails (sign-in links, receipts, alerts you turned on, digests you subscribed to) | Contract (6(1)(b)). You can turn digests and alerts off at any time on the Alerts page |
| First-party analytics (which pages are used, how visitors find us) to improve the product | Consent (6(1)(a)) — only after you accept analytics cookies |
| Google Analytics measurement | Consent (6(1)(a)) — Google Analytics is not loaded until you accept |
| PostHog product analytics and Microsoft Clarity session recordings | Consent (6(1)(a)) — loaded only after you accept analytics cookies, and never on the operator's own devices |
| Service records needed to run your plan and measure whether the service is working: that a snapshot was accepted, a brief was built, delivered or opened, a trial started or ended, a payment succeeded. Stored under a random ID (never your email), with coarse categories only — never tickers, amounts, holdings, rules or question text | Contract (6(1)(b)) and legitimate interests (6(1)(f)) in operating and improving the service |
| Behavioural product analytics (for example which evidence links are opened) | Consent (6(1)(a)) — only after you accept analytics cookies |
| Prevent abuse, enforce plan limits, keep the service secure | Legitimate interests (6(1)(f)); legal obligation where applicable |
4. AI features
Briefs, research reports, earnings-call summaries, predictions and the research Q&A are generated with third-party large language models (for example Anthropic Claude, OpenAI GPT and xAI Grok). These features work on public market information. When you ask a question or request a report, we send the question text and the relevant market data to the model provider. If you ask the Ask Atradian agent about your own portfolio or watchlist, the holdings you saved in Portfolio X-ray (tickers, quantities, cost basis) and your watchlist symbols are sent to Anthropic to answer that question. In Portfolio X-ray, screenshots you upload are sent to Anthropic only to read the figures (you confirm every field; the image is not stored by us), and each brief's computed facts (positions, weights, rule states) are sent to Anthropic to write its plain-English explanation only if you choose to turn AI explanations on — they are off until you do, and you can switch them off again in X-ray Setup. Every figure in an AI answer is checked against the data it was given; figures that can't be traced are removed and marked unverified. We never send your email or billing details.
We make no decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22). Scores and AI outputs describe securities, not people.
5. Who we share it with
We do not sell personal data. We share it only with the processors that run the service, under written data-processing terms:
- Supabase: database and authentication
- Vercel: web hosting and server logs
- Stripe: payments, invoicing and the billing portal
- Resend: transactional and alert email
- Telegram: only if you connect Telegram alerts
- Cloudflare (Turnstile): a bot check on sign-up, sign-in links and password resets (receives your IP address and browser signals, not your account details)
- Google (Analytics): aggregated usage measurement
- Vercel (Web Analytics): cookieless, aggregated page-view measurement with no personal profile or cross-site tracking
- PostHog (product analytics, EU-hosted): only after you accept analytics cookies; pages viewed and product interactions
- Microsoft Clarity (session recordings and heatmaps): only after you accept analytics cookies; records how pages are used and scrolled
- AI model providers (Anthropic, OpenAI, xAI): prompt text as described above — including your saved holdings and watchlist when you ask Ask Atradian about them — never your email or billing details
We may also disclose data where the law requires it, or to protect our rights. If the business is sold or restructured, data may transfer to the successor, and this policy will continue to apply.
6. International transfers
Some processors are based in, or access data from, the United States and other countries outside the EEA. Where that happens we rely on the EU–US Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses, plus supplementary measures where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
- Account, watchlist, holdings, alerts: for as long as your account is open. Deleted within 30 days of account deletion.
- Portfolio X-ray workflow: snapshots, rules, theses, journal and unit-value history for as long as your account is open (export or delete them any time from X-ray → History & data); daily briefs are kept in full for 30 days, then reduced to their headline and rule states; resolved review-queue items for 180 days.
- Community posts: comments and threads are visible to other signed-in members under your username. If you delete a comment, or delete your account, its text is erased and replaced by a removal notice. Abuse reports are kept while needed to handle them. Comments a moderator removes are kept, out of public view, to record the decision.
- Billing records: 6 years after the end of the relevant tax year, as required by Irish Revenue rules.
- First-party page analytics: 13 months, then deleted automatically.
- Service records (product events): while your account is open; deleted with your account.
- Free-trial record: a one-way hash of your email address (not the address itself) is kept after account deletion so the free trial can be claimed once per person. It can't be reversed to reveal your email.
- Server and security logs: up to 90 days.
- Backups: overwritten on a rolling cycle of up to 35 days.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy
- have inaccurate data corrected
- have your data erased ("right to be forgotten")
- restrict or object to processing, including processing based on legitimate interests
- data portability (a machine-readable export)
- withdraw consent at any time, where processing relies on consent
You can download a copy of your data, change your email address and permanently delete your account yourself under Account. For anything else, email privacy@atradian.com from your account address. We reply within one month. You also have the right to complain to the Data Protection Commission (Ireland) or the supervisory authority where you live.
10. Security
Data is encrypted in transit (TLS) and at rest. Row-level security in the database limits each account to its own watchlist, holdings and alerts. Access to production systems is restricted and logged. No system is perfectly secure. If a breach affects your data, we will notify you and the Data Protection Commission as the GDPR requires.
11. Children
The service is for adults aged 18 or over. We do not knowingly collect data from anyone under 18.
12. Changes to this policy
We'll update the date at the top of this page when the policy changes, and email account holders about material changes before they take effect. The Terms of Service govern your use of the service.