Privacy policy

Last updated 21 October 2026

This policy explains what personal data GraphSeam collects, why, and what you can do about it. We apply the standard of the EU General Data Protection Regulation (GDPR) to every user, wherever you live: the rights described below are yours whether or not you are in Europe.

Who we are

GraphSeam is run by GraphSeam LLC, a Delaware limited liability company ("we", "us"), which is the controller of the personal data described here. For anything in this policy, including requests to see or delete your data, write to [email protected].

What we collect

• Your account: your email address and a password, stored only as a one-way hash we cannot read back. If you sign in with Google, we receive your name, email address and Google account identifier from Google, and nothing else.
• Your use of the service: the markets you have access to, your purchases and account balance, the companies you ask to be alerted about, and settings such as light or dark mode.
• Technical data: your IP address, browser type and the pages you request, recorded in server logs. We use these to keep the service running, secure it and detect abuse such as automated scraping.

Payments are handled by Stripe. Your card details go directly to Stripe and never reach our servers; we receive only a confirmation of the payment and its amount. We do not ask for or want sensitive data such as health, political or religious information.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in, one that protects forms against cross-site request forgery, an optional "remember me" cookie, and one that remembers your light or dark theme. We use no advertising cookies, no analytics or tracking cookies and no third-party trackers, so there is nothing to consent to beyond using the site.

Why we use your data

• To provide the service you signed up for (performance of a contract): your account, your access to the markets you bought, and the alerts you asked for.
• To keep the service secure and fair (our legitimate interest): preventing fraud, account sharing and automated scraping.
• To meet legal obligations: keeping records of purchases as accounting and tax law requires.
• With your consent, where we ask for it. You can withdraw consent at any time.

We do not make automated decisions about you that have legal or similarly significant effects. If your account is suspended for suspected scraping, a person will review it on request.

The emails we send

We send emails you need, such as password resets, and emails you ask for, such as alerts when an insider trades in a company you follow. Which alerts you receive is controlled in the Account section, where you can turn each one off. We do not send marketing emails unless you have agreed to them.

We never sell your data

We will never sell, rent or trade your email address or any other personal data, and we will never give it to anyone for their own marketing. We share data only with the service providers that run parts of the service for us, under contracts that require them to protect it and use it only on our instructions:

• Akamai (Linode), which hosts our servers;
• Cloudflare, which delivers the website and protects it against attacks;
• Resend, which delivers our emails;
• Stripe, which processes payments;
• Google, only if you choose to sign in with Google.

We would also disclose data if the law required it, for example in response to a valid court order. Some of these providers process data outside your country, including in the United States; where they do, the transfer is covered by safeguards recognised under the GDPR, such as the European Commission's standard contractual clauses.

How long we keep it

We keep your account data for as long as your account exists. When you ask us to delete your account, we delete your personal data within 30 days, except records of purchases that we must keep for as long as accounting and tax law requires. Server logs are kept only for a limited period, for security and troubleshooting.

Your rights

Wherever you live, you can ask us to:

• give you a copy of the personal data we hold about you, in a portable format;
• correct data that is wrong;
• delete your data and your account;
• restrict or object to how we use your data;
• withdraw any consent you have given.

Write to [email protected] from the email address on your account. We answer within 30 days and do not charge for it. If you are unhappy with our answer, you can complain to the data protection authority where you live.

Security

All traffic to the site is encrypted (HTTPS), passwords are stored only as hashes, and access to our servers is restricted. No system is perfectly secure, but if a breach affecting your data occurs we will tell you and the relevant authorities as the GDPR requires.

Children

The service is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

If we change this policy, the new version will be posted here with a new date. If a change materially affects how we use your data, we will email you before it takes effect.