Privacy Policy

The data controller responsible for processing personal data on this website is:

Zaid Ghazal
Prinz-Heinrich-Straße 17
24106 Kiel
Germany

Email: hello@invest-like.com
Phone: +49 178 4843395

For all privacy-related questions, exercising your rights, or general inquiries, contact hello@invest-like.com.

Account data: email (required), name (optional), encrypted password (bcrypt). If you sign in via Google: email, name, profile picture. Lawful basis: contract - Art. 6(1)(b) GDPR. Storage: while account is active, deleted within 30 days of deletion.

Usage data: pages visited, stocks analysed, watchlist contents, filter presets, timestamps. Used to provide features and improve the product. Lawful basis: legitimate interest - Art. 6(1)(f) GDPR. Storage: 12 months, then aggregated.

Technical data: truncated IP, browser, device. Used for security and rate-limiting. Lawful basis: legitimate interest in security - Art. 6(1)(f). Storage: 14 days full IP, 90 days truncated.

Payment data: handled by Stripe. We never see your card number - only token, last 4 digits, billing country. Lawful basis: contract - Art. 6(1)(b). Storage: 10 years (§ 147 AO Germany).

Marketing data (only if you opt in): if you tick "Send me the newsletter" we add your email to our newsletter audience. Lawful basis: consent - Art. 6(1)(a). Storage: until unsubscribe, then deleted within 7 days.

We use your data to:

We use a limited set of vetted providers. Each is a data processor under Art. 28 GDPR. Data Processing Agreements (DPAs) and EU Standard Contractual Clauses (SCCs) are in place.

Vercel Inc. (Covina, CA, USA) - application hosting. Serverless functions are locked to Frankfurt (fra1), so personal data is processed in the EU. Static assets via global CDN contain no personal data. DPA: vercel.com/legal/dpa.

Supabase Inc. (Singapore) - database and authentication. Our instance runs in Frankfurt, Germany (eu-central-1). DPA: supabase.com/legal/dpa.

Anthropic, PBC (San Francisco, CA, USA) - AI analysis (Buffett Brain). By contract, queries are not used to train their models.

OpenAI, L.L.C. (San Francisco, CA, USA) - fallback AI. By contract, queries are not used for training.

Resend, Inc. (San Francisco, CA, USA) - transactional and newsletter email delivery. Operates on AWS SES.

ImprovMX (Berkeley, CA, USA) - inbound email forwarding (e.g. hello@invest-like.com → founder's inbox).

Stripe Inc. (USA) and Stripe Payments Europe Ltd. (Dublin, Ireland) - payment processing for all paid subscriptions. PCI DSS Level 1 certified.

Financial Modeling Prep and Massive Market Data - public market data only. No personal data is shared with these providers.

Vercel Analytics (USA, EU edge) - privacy-first page-view analytics. No cookies, no personal data, IP truncated and hashed. GDPR-compliant by design.

PostHog (EU instance, posthog.com) - product analytics for funnels and session recordings. Activated only if configured. Inputs are masked by default.

Microsoft Clarity (USA, Microsoft Corp.) - heatmaps and session replay. Activated only if configured. PII redacted automatically.

We never sell your personal data and never use it for cross-context behavioural advertising.

Most personal data stays in the EU because our database and serverless functions run in Frankfurt, Germany.

A small subset is transferred to US-based processors (Anthropic, OpenAI, Resend, ImprovMX, Microsoft Clarity, Stripe). For these we rely on:

We use only strictly necessary cookies. Under TTDSG § 25 Abs. 2 Nr. 2 and ePrivacy Directive Art. 5(3), no consent is required for these - so we don't show a cookie banner.

Specifically:

See section 2 for storage durations per category. Summary:

If you're in the EU/EEA/UK, you have the right to:

You have the right to lodge a complaint with a data protection supervisory authority. As the data controller is based in Schleswig-Holstein, the competent authority is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany

Phone:  +49 431 988-1200
Email:  mail@datenschutzzentrum.de
Web:    https://www.datenschutzzentrum.de

TLS 1.3 in transit, AES-256 at rest, bcrypt password hashing, Supabase Row-Level Security, least-privilege access. No system is perfectly secure - use a strong unique password and 2FA.

The Service is not directed at children under 16 (EU) or under 13 (US, COPPA). We don't knowingly collect data from children. Email hello@invest-like.com if you believe a child has provided data.

California residents have the rights described in section 8. We don't sell or share personal information for cross-context behavioural advertising. Email hello@invest-like.com to exercise California rights.

We may update this policy. Material changes will be notified by email or banner. Continued use means acceptance. The "Last updated" date is always current.

Privacy questions: hello@invest-like.com. Postal address: see Impressum.