Spreadsearch

Privacy Policy

Last updated: April 5, 2026

1. Who We Are

Spreadsearch is operated by DLA, a simplified joint-stock company with a sole shareholder (Société par Actions Simplifiée Unipersonnelle), registered in France under number 849430582 RCS Paris, with registered office at 39 rue de la Gare de Reuilly, 75012 Paris.

DLA is the data controller for personal data collected through the Spreadsearch website and Service. For any privacy-related questions, contact us at [email protected].

2. Data We Collect

We collect only the data necessary to provide the Service:

  • Account data: your email address, collected when you create an account or sign in via a third-party provider (e.g. GitHub, Google)
  • Subscription data: your subscription status and billing plan, stored in our database. Payment card details are processed and stored exclusively by Stripe; we never see or store them
  • Stripe customer data: a Stripe customer ID and subscription ID, used to manage your billing relationship
  • Alert configurations: any scan alerts you configure within the application
  • Usage data: basic analytics data collected by Cloudflare at the network level (anonymized request logs, page views). No personal identifiers are included

We do not collect, access, or store your Interactive Brokers credentials, account balances, trading history, or any brokerage data. All connectivity between Spreadsearch and Interactive Brokers occurs entirely on your local device.

3. How We Use Your Data

We use your data solely to:

  • Create and manage your account
  • Process and manage your subscription via Stripe
  • Verify your subscription status when you access the download page or use the application
  • Respond to support requests and inquiries
  • Send transactional emails related to your subscription (confirmation, renewal, cancellation)
  • Communicate material changes to the Service or these policies

We do not use your data for advertising, profiling, or any purpose beyond operating the Service. We do not sell, share, or rent your personal data to any third party.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your personal data on the following legal bases:

  • Contract performance: processing your email and subscription data is necessary to provide the Service you have subscribed to
  • Legitimate interests: basic analytics data is processed to understand how the Service is used and to improve it
  • Legal obligation: we may retain certain data as required by French law

5. Cookies and Tracking

The Spreadsearch website uses the following cookies and tracking technologies:

  • Authentication cookies: set by Supabase to maintain your logged-in session. These are strictly necessary and cannot be disabled without preventing login from working
  • Cloudflare analytics: anonymized, cookieless analytics used to measure page traffic. No personal data is collected or shared

We do not use advertising cookies, third-party tracking pixels, or any cookies for marketing purposes. A cookie notice is displayed on your first visit to inform you of these cookies.

6. Third-Party Services

We use the following third-party services, each subject to their own privacy policies:

  • Supabase: authentication and database hosting. Your email address and subscription status are stored on Supabase infrastructure (EU region where available)
  • Stripe: payment processing. Stripe processes and stores your payment card details under their own privacy and security standards
  • Cloudflare: website delivery and network security. Cloudflare may log IP addresses and request metadata for security purposes
  • GitHub: the application download is hosted as a GitHub release. Downloading the application may result in GitHub logging your IP address
  • Resend: transactional email delivery. Your email address is transmitted to Resend to send subscription confirmations and other service-related communications

Some of these third-party services may process your data outside the European Economic Area, including in the United States. Where this occurs, such transfers are subject to appropriate safeguards, including standard contractual clauses adopted by the European Commission or adequacy decisions, as applicable under GDPR.

7. Data Retention

We retain your account and subscription data for as long as your account is active, and for up to 12 months thereafter in case of disputes or legal obligations. You may request deletion of your data at any time (see Section 8 below. Upon deletion, your data will be removed from our systems within 30 days), except where retention is required by law.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

  • Access: request a copy of the data we hold about you
  • Rectification: request correction of inaccurate data
  • Erasure: request deletion of your data ("right to be forgotten")
  • Restriction: request that we restrict processing of your data
  • Portability: request your data in a machine-readable format
  • Objection: object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the French data protection authority (CNIL) at cnil.fr.

9. Data Security

We take reasonable technical and organizational measures to protect your personal data. All data transmission is encrypted via HTTPS. Access to our database is restricted to authorized services only. We do not store sensitive financial or brokerage data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the CNIL as required by GDPR.

10. Changes to This Policy

We may update this Privacy Policy as the Service evolves. We will notify you of material changes by email and by updating the date at the top of this page. Continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

11. Contact

For any privacy-related questions, requests, or complaints, contact us at [email protected] or by post at DLA, 39 rue de la Gare de Reuilly, 75012 Paris, France.