Privacy Policy & Disclaimer

Data Controller

Photonics Tracker is operated by Statsvana, an assumed name of Barbican Hill LLC, a Texas limited liability company with its principal place of business in Dallas, Texas, USA. Barbican Hill LLC is the data controller responsible for the processing of personal data described in this policy.

For privacy questions, data-subject requests, or any other data protection matter, contact us at [email protected] or via our contact form.

Photonics Tracker is a United States–based service primarily intended for US retail investors. We have not appointed a representative in the European Union or United Kingdom under Article 27 of the GDPR or UK GDPR. EU and UK visitors are welcome to use the site and may contact the controller directly at the address above to exercise their rights.

AI-Generated Content Disclosure

• Company summaries and analysis reports are generated using large language models (LLMs).
• Article titles and summaries may be AI-enriched from original source content.
• AI-generated content may contain inaccuracies — always verify with primary sources.
• We review AI output but do not guarantee its accuracy or completeness.
• These AI systems analyze publicly traded companies, not individual users. We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning any user (GDPR Article 22).

Information We Collect

• Contact form submissions: name, email, subject, optional ticker, and message content.
• Account data (when you register): name, email address, email verification status, a hashed password (for email/password accounts), and — if you sign in with Google — the provider identifier along with the OAuth access, refresh, and ID tokens issued to us by Google to maintain your session.
• Session records: when you sign in, we create a session record containing an IP address and user-agent string, used to detect session hijacking and to show your active sessions.
• Subscription data (when you upgrade): billing status, subscription period, and a Stripe customer identifier. Card details are collected and held by Stripe directly and never touch our servers.
• Usage data tied to your account: favorites, portfolio positions, view history, and email notification preferences.
• Transient IP at request time: we read the request IP to determine the country of origin so that visitors we classify as being in the EU, UK, or Switzerland see the analytics opt-out control described below. The IP is not stored for this purpose and is not used for access enforcement.
• First-party product analytics: aggregated page views and a small set of product events (for example, when the sign-in and sign-up buttons are clicked, when a dashboard tab is switched, when the screener is filtered, and when a stock detail page is opened). No IP addresses persisted, no fingerprints, no cross-site tracking (see Cookies & Tracking below).

How We Use Your Data & Legal Basis

Under Article 6 of the GDPR, we process personal data only when we have a valid legal basis. The basis for each activity is listed below.

• Responding to contact form inquiries — performance of a contract or pre-contractual steps at your request (Art. 6(1)(b)).
• Creating and operating user accounts — performance of a contract (Art. 6(1)(b)).
• Processing subscription payments and preventing fraud — performance of a contract (Art. 6(1)(b)) and legitimate interest in fraud prevention (Art. 6(1)(f)).
• Sending transactional email (verification, password resets, billing receipts) — performance of a contract (Art. 6(1)(b)).
• Sending optional digest emails — your consent (Art. 6(1)(a)), which you may withdraw at any time in account settings.
• Aggregate site analytics — legitimate interest in understanding which parts of the site are useful and keeping it fast (Art. 6(1)(f)). The processing is cookieless and anonymized; see the Cookies & Tracking section for how to opt out.
• Preventing abuse and securing the service (rate limiting, preview-limit enforcement) — legitimate interest in operating a functional, non-abused service (Art. 6(1)(f)).
• Session integrity (storing IP and user-agent with your session record) — legitimate interest in detecting session hijacking (Art. 6(1)(f)).

We do not sell personal data, we do not share it with advertisers, and we do not use it to train machine learning models.

Cookies & Tracking

We use a minimal set of cookies to operate the site. No advertising, no cross-site tracking, no data brokers.

Strictly Necessary

Analytics

Third-Party Services

We use a small number of third-party services to operate the site. Each provider has its own privacy policy that governs the data they receive from us and hold about you.

• Stripe, Inc. (United States) — payment processing for subscriptions. Stripe states it participates in the EU-US Data Privacy Framework; see Stripe's privacy policy for details.
• Brevo SA (France) — transactional email delivery (email verification, password reset, billing receipts, and optional digest emails). See Brevo's privacy policy for details of their hosting and retention.
• Google LLC (United States) — OAuth sign-in for users who choose Google as an identity provider. Google's own privacy policy governs data they hold about you as a Google user.
• Cloudflare, Inc. (United States) — content delivery network and security proxy through which all site traffic is served. Cloudflare processes visitor IP addresses and request metadata to route, cache, and protect site traffic. See Cloudflare's privacy policy for details of their processing and retention.

Data Retention & Deletion

• Contact form messages are retained for as long as they remain relevant to an ongoing or potential user relationship (for example, follow-up questions or recurring support). You may request deletion at any time.
• Account data (name, email, authentication records, OAuth tokens where applicable, session records) is retained for as long as the account is active. You may close your account and request deletion at any time by emailing [email protected]. On receipt of a verified request, we delete your user record and all associated data — favorites, portfolio positions, view history, email preferences, verification tokens, and contact messages you submitted — within one month, in line with GDPR Article 12(3). Active Stripe subscriptions are cancelled and your Stripe customer record is deleted as part of the same process. Operational email logs are preserved but with your personal fields (recipient address, subject, metadata) removed.
• Favorites, portfolio positions, view history, and email preferences are retained while the account is active to power the features that depend on them. They are deleted as part of the account deletion process described above.
• Preview limit cookie: 7 days in your browser.
• Authentication session cookie: session only.
• Aggregate analytics data is retained indefinitely because it contains no personal identifiers and cannot be tied back to an individual.
• Database backups are retained on a 30-day rolling window. Deleted records age out of backups within 30 days.
• Stripe invoice and billing records may be retained by Stripe and by us as required by US tax and accounting law, independent of any deletion request.

International Data Transfers

Photonics Tracker is hosted in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to a country outside the EEA/UK/CH when you use the site.

Where we rely on third-party service providers established outside the EEA/UK, we rely on the transfer mechanisms those providers themselves declare — for example, Stripe's self-certification under the EU-US Data Privacy Framework. You can review each provider's own privacy documentation linked above for the specific safeguards they apply. If you have questions about a specific transfer, please contact us.

Your Rights

If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that grants similar rights, you have the following rights with respect to your personal data:

• Right of access — request confirmation of whether we process your data and a copy of that data.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — ask us to delete your personal data, subject to legal retention obligations.
• Right to restriction of processing — ask us to limit how we use your data in certain circumstances.
• Right to object — object to processing based on our legitimate interests, including analytics.
• Right to data portability — receive your data in a structured, commonly-used, machine-readable format.
• Right to withdraw consent — where we rely on consent (for example, optional digest emails), you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected] or use our contact form. We respond within one month, in line with GDPR Article 12(3).

You also have the right to lodge a complaint with your local supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. In the EU, you can find your national data protection authority at edpb.europa.eu/about-edpb/board/members.

Contact

For privacy questions or data requests, email [email protected] or use our contact form.