Privacy Policy

When you use the service, we collect:

• Account details. Your email address, and your name and profile picture if you sign in with Google. We do not use passwords, so we never store one.
• What you save in the product. Your screening rules and preferences, portfolios, holdings, watchlists, and language choice. Holdings you paste into the public X-Ray tool are processed to return a result.
• Usage records. Which companies and funds you analyse, so we can apply the monthly allowance on the free plan, and product analytics we run ourselves to understand how features are used.
• Technical data. Standard server logs, including your IP address, browser type, and the pages requested. We use these for security, abuse prevention, and debugging.
• Messages you send us. If you contact us, we keep the correspondence so we can reply and improve support.
• Billing status. If you subscribe to Pro, payment is handled by a payment provider. We receive your plan and payment status, not your card number.

We are not a broker. We do not place trades or hold your money, and we never ask for your brokerage password or banking credentials. Your assets stay at your own broker.

We use your data to:

• run the service: screen the assets you ask about, save your rules and portfolios, sign you in, and apply plan limits;
• keep the service secure and prevent abuse, including scraping and automated access;
• improve the product, using aggregated usage patterns rather than individual profiles wherever possible;
• send you service messages, such as sign-in links, billing notices, and material changes to our terms;
• meet legal obligations.

We do not sell your personal data, and we do not send marketing email without your consent.

The service uses a small number of cookies and similar technologies. Essential ones, such as the cookie that keeps you signed in, are always on. Analytics and marketing trackers (Google Analytics and the Meta Pixel) load only if you accept them in the consent banner, and declining changes nothing about how the service works. The Cookie Policy lists each one and lets you change your choice.

We share personal data only with the service providers that help us operate, under agreements that limit their use of it to providing those services:

• Authentication. Google Firebase handles sign-in (email links and Google sign-in).
• Hosting and infrastructure. Amazon Web Services hosts the service and stores your account data.
• Payments. If you subscribe, a payment provider processes your payment details on our behalf.
• Analytics and marketing. Google Analytics and Meta, only if you consent in the cookie banner.

The market data providers we screen with receive the tickers being analysed, not your identity. Beyond the above, we disclose personal data only where the law requires it, to protect the service and its users from abuse or fraud, or as part of a reorganisation or transfer of the service, in which case this policy continues to apply and we will tell you.

Our infrastructure runs on Amazon Web Services, and our providers may process data in countries other than your own, including the United States. Wherever your data is processed, it is protected by this policy and by our agreements with those providers.

We keep your account data for as long as your account exists. Deleting your account removes your saved rules, portfolios, watchlists, and profile. Server logs and backup copies are kept for a short period for security and recovery, then deleted. Billing records are kept as long as tax and accounting law requires.

Data is encrypted in transit, session credentials are cryptographically signed, access to production systems is restricted, and we run regular security reviews of the code and infrastructure. No system is perfectly secure, but we treat the security of your data as a core part of the product.

You can access and update your data in settings, and you can delete your account there at any time. You can also contact us to request a copy of your data, ask us to correct or delete it, or object to a use of it. Depending on where you live, these rights may be backed by data protection law, and you may also have the right to complain to your local data protection authority. We respond to all requests regardless of where you live.

The service is for adults making investment decisions and is not directed to anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

We may update this policy as the product evolves. If a change is material, we will give you reasonable notice, for example by email or a notice in the product, before it takes effect. The date at the top shows when it last changed.

Privacy questions or requests? Email hello@xumirah.com or use the contact page.