Your Data. Your Rights. Our Obligations.

Data Controller

The data controller for personal data collected through the Pingr platform is:

As the data controller, Pingr determines the purposes and means of processing your personal data. We are responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with applicable data protection law including the EU General Data Protection Regulation (GDPR) 2016/679, the UK GDPR, the California Consumer Privacy Act (CCPA), and any other applicable national data protection legislation.

Where Pingr processes personal data on behalf of another party (for example, where a business subscribes to Pingr on behalf of its employees), Pingr acts as a data processor. In such cases, the subscribing business is the data controller and a separate Data Processing Agreement applies.

What We Collect

Pingr collects only the data necessary to provide the Service. We do not sell data. We do not build advertising profiles. We do not share data with data brokers. The categories of personal data we collect are:

Account Data

• Email address — required to create an account, send alerts, and communicate with you about your subscription
• Name — optionally provided, used for personalisation of communications
• Password — stored as a bcrypt hash. Pingr never stores plaintext passwords
• Account tier — free, pro, or investor, used to gate feature access
• Account creation timestamp — for audit and support purposes

Usage Data

• Authentication tokens — JWT tokens issued at login, used to authenticate API requests. Stored locally in your browser. Not stored server-side beyond session validation
• Watchlist preferences — tickers and insider names you choose to track
• Notification preferences — your alert settings including minimum score thresholds and category filters
• Fund simulator data — fund names, rules, and followed trade positions stored in your browser's localStorage and optionally synced to our database to support price refresh
• Digest and alert preferences — timing and format of email alerts you configure

Technical Data

• IP address — logged by our hosting infrastructure (Vercel, Render) for security and rate-limiting purposes
• Browser and device type — collected via standard HTTP headers, used for compatibility and debugging
• Request logs — API request timestamps and endpoints accessed, retained for a maximum of 30 days for security monitoring

Financial Connection Data (Alpaca Integration — Investor Tier Only)

• Encrypted Alpaca API keys — your Alpaca API key and secret key, encrypted using AES-256 (Fernet) before storage. See Section 5 for full detail
• Alpaca trading mode — whether you are connected in paper or live mode
• Consent signature — your typed full legal name provided at the time of connecting your Alpaca account, plus the timestamp of consent. Stored as an auditable record
• Alpaca account status — basic account connectivity status fetched from Alpaca's API on your request (equity, cash balance). This data is displayed to you in the dashboard and is not stored by Pingr beyond the API response

Data We Do Not Collect

• We do not collect payment card numbers, bank account details, or any payment instrument data. All payment processing is handled by Stripe, which operates under its own privacy policy
• We do not collect your Alpaca account number, social security number, tax identification number, date of birth, or any identity verification document
• We do not collect biometric data, health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation
• We do not collect any non-public information about any company referenced in our signals
• We do not purchase, rent, or receive personal data from third-party data brokers

How We Use Your Data

Pingr uses personal data for the following purposes only:

We do not use your personal data for automated profiling that produces legal or similarly significant effects on you. We do not use your personal data for targeted advertising. We do not share your personal data with advertisers.

Legal Basis for Processing (GDPR)

For users in the European Economic Area, United Kingdom, and other jurisdictions with similar legal requirements, Pingr relies on the following legal bases under Article 6 of the GDPR:

Article 6(1)(b) — Performance of a Contract

The majority of Pingr's processing is necessary to provide the Service you have signed up for. This includes account creation, signal delivery, email alerts, fund simulator functionality, and subscription management. Without this processing, Pingr cannot provide the Service.

Article 6(1)(a) — Consent

Where Pingr processes data based on your consent, we rely on this basis for: sending marketing communications (separate from service-related communications); storing and using your Alpaca API keys for automated order placement; and any other processing for which we have specifically sought and obtained your explicit consent. You may withdraw consent at any time by contacting privacy@pingr.email or using the relevant settings in your dashboard. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Article 6(1)(f) — Legitimate Interests

Pingr relies on legitimate interests for: security monitoring and fraud prevention; storing consent audit records for legal protection; improving the Service through aggregated analytics; and responding to unsolicited support requests. Where we rely on legitimate interests, we have conducted a legitimate interests assessment and concluded that our interests are not overridden by your rights and freedoms, taking into account the nature of the data and the reasonable expectations of users of a data intelligence platform.

Article 6(1)(c) — Legal Obligation

Pingr may process personal data to comply with applicable law, including responding to lawful requests from regulatory authorities, courts, and law enforcement agencies in jurisdictions where Pingr operates.

Special Category Data

Pingr does not intentionally collect or process special category data as defined in Article 9 of the GDPR. If you believe we have inadvertently collected such data, please contact privacy@pingr.email immediately.

Alpaca API Keys — Storage, Encryption & Use

How Keys Are Stored

When you connect your Alpaca account to Pingr, your API key and secret key are encrypted using AES-256 symmetric encryption via the Fernet scheme (from the Python cryptography library) before being written to our database. The encryption key is a randomly generated 256-bit key stored as a Render environment variable — it is never committed to source code, never logged, and never transmitted. The encrypted values stored in the database are cryptographically meaningless without the encryption key.

How Keys Are Used

Your API keys are decrypted only at the moment Pingr's engine needs to submit an order instruction to Alpaca's API. The decryption occurs in memory on Pingr's secure Render infrastructure. The decrypted keys are used to authenticate a single API call to Alpaca and are then discarded from memory. Decrypted keys are never logged, never transmitted to any party other than Alpaca's own API servers, never stored in any secondary location, and never accessible to Pingr employees or systems except through the automated order execution process.

What Pingr Cannot Do With Your Keys

Pingr's API integration with Alpaca is read-only except for order submission. Pingr's engine cannot and does not: withdraw funds from your account; transfer funds between accounts; change your account settings; access your personal identity information held by Alpaca; view your full transaction history beyond what is needed to display your portfolio status; or perform any action not directly related to submitting and monitoring the specific order instructions generated by the signal engine.

Key Deletion

When you disconnect your Alpaca account via the Pingr dashboard, the encrypted key values are set to NULL in our database immediately. The encryption key stored in Render's environment is not affected by individual disconnections. If you request full account deletion, all encrypted key values are permanently deleted along with your account record.

Breach Notification

In the event of a security incident that may have compromised encrypted API key data, Pingr will notify affected users by email within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR. The notification will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed. We will also notify the relevant supervisory authority.

Trading & Signal Data

SEC Filing Data

Pingr processes publicly available data from the US SEC EDGAR system. This data includes the names, roles, transaction details, and ownership stakes of corporate insiders as reported in publicly filed Form 4 documents. This data is public record under US law. Pingr does not treat SEC filing data as personal data belonging to Pingr users — it is public information about third parties (corporate insiders) that Pingr processes and presents. If you are a corporate insider whose name appears in Pingr's platform and you have concerns, please contact legal@pingr.email.

Your Fund Simulator Data

Fund names, rules, and positions in the fund simulator are stored primarily in your browser's localStorage on your device. Where you follow specific trades, a record of the followed position (ticker, follow price, date) is stored in our database associated with your user account to enable server-side price refresh. This data is not shared with third parties. It is deleted when you unfollow a position or delete your account.

Signal History

Pingr maintains a database of processed SEC filings and their associated conviction scores. This database contains no personal data about Pingr users — it contains data about third-party corporate insiders derived from public filings. Your interactions with signals (saves, watchlist additions) are associated with your account for the purpose of personalising your alert feed and are not used for any other purpose.

Data Sharing

Pingr does not sell your personal data. Pingr does not share your personal data with advertisers, data brokers, or any commercial third party for their own marketing purposes. Personal data is shared only in the following limited circumstances:

Service Providers (Data Processors)

Pingr engages the following third-party service providers who process personal data on our behalf under contractual data processing agreements:

• Render (render.com) — cloud hosting for our backend API and worker processes. Stores encrypted database content including user accounts and encrypted API keys. Location: United States. Render's privacy policy applies
• Vercel (vercel.com) — hosting for our frontend application. Processes IP addresses and request logs for serving the web interface. Location: United States and edge network globally. Vercel's privacy policy applies
• Neon / PostgreSQL — managed database hosting. Stores all structured user data including account details and encrypted API keys. Location: United States. Encrypted at rest
• Brevo (brevo.com) — email marketing and transactional email service. Receives email addresses for the purpose of sending alert notifications and service communications. Location: European Union. Brevo is GDPR-compliant
• Stripe (stripe.com) — payment processing. Receives email addresses and processes payment transactions. Stripe operates under its own privacy policy and PCI-DSS compliance regime. Pingr does not receive or store card numbers
• OpenAI (openai.com) — AI text generation. Receives ticker symbols, insider names, trade values, and news context strings to generate AI summaries of signals. No user-identifying information is transmitted to OpenAI. OpenAI's API data usage policy applies
• Alpaca Securities LLC (alpaca.markets) — brokerage execution layer. Receives your API key credentials at order-time to authenticate order submissions. Alpaca operates under its own privacy policy and is regulated by FINRA and SIPC

Legal Disclosure

Pingr may disclose personal data to courts, regulators, law enforcement agencies, or other public authorities where required by applicable law, court order, or legal process. Where permitted by law, we will notify you of such a request before complying.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the acquiring entity as part of the transaction. We will notify affected users by email and through a prominent notice on our website at least 30 days before any such transfer takes effect, and we will ensure the acquiring entity is bound by equivalent data protection obligations.

With Your Consent

We may share personal data with third parties in other circumstances where you have given us explicit consent to do so. You may withdraw such consent at any time.

Data Retention

Pingr retains personal data only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. The following retention periods apply:

After the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual. Anonymised aggregate data may be retained indefinitely for statistical and product improvement purposes.

Security Measures

Pingr implements technical and organisational security measures appropriate to the risk of processing personal data. These measures include:

• Encryption at rest — all sensitive data including API keys is encrypted using AES-256 before storage. Database volumes are encrypted at rest by our hosting provider
• Encryption in transit — all data transmitted between your browser and Pingr's servers is encrypted using TLS 1.2 or higher. All API communications with third-party services use HTTPS
• Password hashing — user passwords are hashed using bcrypt with a per-user salt before storage. Pingr has no access to plaintext passwords
• JWT authentication — API access requires valid signed JWT tokens. Tokens are short-lived and validated on each request
• Rate limiting — all public API endpoints are rate-limited to prevent brute force attacks and abuse
• Environment variable secrets — encryption keys, API secrets, and other sensitive configuration values are stored as environment variables and never committed to source code repositories
• Access control — production database credentials are restricted to authorised Pingr infrastructure only. No direct database access is available from development environments
• Dependency management — Pingr monitors dependencies for known security vulnerabilities and applies security patches on a regular basis

No security measure is perfect. While Pingr takes security seriously and implements industry-standard protections, we cannot guarantee that our systems will never be compromised. In the event of a breach, we will act in accordance with our obligations under applicable data protection law.

Cookies & Local Storage

What We Use

Pingr primarily uses browser localStorage rather than cookies to store user preferences and session data client-side. This includes your authentication token, tier information, watchlist preferences, and fund simulator data. localStorage data does not leave your device except where Pingr explicitly syncs it to our server (for example, when you follow a trade).

Cookies

Pingr uses a minimal number of cookies:

• Essential session cookies — required for the Service to function. Cannot be disabled
• Security cookies — used to protect against CSRF attacks. Required for security

Pingr does not use tracking cookies, advertising cookies, or third-party analytics cookies on its core platform. Our hosting infrastructure (Vercel) may set basic performance cookies; these are governed by Vercel's cookie policy.

Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may prevent the Service from functioning correctly. Clearing localStorage will remove locally stored preferences and fund simulator data — this data may be irrecoverable if not synced to our servers.

International Data Transfers

Pingr's infrastructure is primarily located in the United States (Render, Vercel, Neon). As an Irish-operated platform serving EU users, transfers of personal data to the United States constitute international transfers under GDPR Chapter V.

Pingr relies on the following mechanisms to legitimise international transfers:

• Standard Contractual Clauses (SCCs) — where Pingr's service providers have not obtained adequacy decisions, we rely on SCCs approved by the European Commission to provide appropriate safeguards for transfers. Our key providers (Render, Vercel, Stripe, OpenAI) offer SCCs as part of their enterprise agreements
• Adequacy decisions — where the European Commission has adopted an adequacy decision for the recipient country
• Article 49 derogations — in limited circumstances where SCCs are not available, we may rely on the performance of a contract derogation under Article 49(1)(b) GDPR for transfers strictly necessary to deliver the Service you have requested

You may request a copy of the transfer mechanisms applicable to your data by contacting privacy@pingr.email.

Your Rights

Depending on your jurisdiction, you have the following rights in relation to your personal data. EEA and UK users have rights under GDPR. California users have rights under CCPA. We honour these rights for all users regardless of location wherever reasonably practicable.

Right of Access (GDPR Art. 15 / CCPA)

You have the right to request a copy of all personal data Pingr holds about you, including the categories of data, the purposes of processing, the recipients of your data, and the retention periods that apply. We will respond to access requests within 30 days. For complex requests, we may extend this by a further 60 days with notice.

Right to Rectification (GDPR Art. 16)

You have the right to request that inaccurate personal data about you is corrected without undue delay. You may update most account data directly through your dashboard. For data you cannot update yourself, contact privacy@pingr.email.

Right to Erasure / "Right to be Forgotten" (GDPR Art. 17 / CCPA)

You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, where you object to processing based on legitimate interests, or where processing has been unlawful. We will action erasure requests within 30 days except where retention is required by legal obligation (such as financial records). Note that deletion of your account will result in loss of access to the Service and cannot be reversed.

Right to Restriction (GDPR Art. 18)

You have the right to request that Pingr restricts processing of your personal data in certain circumstances — for example while a rectification request is being assessed, or where you have objected to processing pending verification of our legitimate grounds.

Right to Data Portability (GDPR Art. 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller. To exercise this right, contact privacy@pingr.email.

Right to Object (GDPR Art. 21)

You have the right to object at any time to processing of your personal data based on legitimate interests, including profiling for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately. Where you object to other legitimate interest processing, we will cease unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (GDPR Art. 22)

Pingr does not make decisions about you using solely automated processing that produce legal or similarly significant effects. The conviction scores produced by Pingr are informational outputs, not automated decisions about you personally.

California Rights (CCPA / CPRA)

California residents have the right to know what personal information is collected about them; the right to delete personal information; the right to opt out of the sale of personal information (Pingr does not sell personal information); the right to non-discrimination for exercising privacy rights; and the right to correct inaccurate personal information. To exercise California rights, contact privacy@pingr.email with the subject line "CCPA Request".

How to Exercise Your Rights

To exercise any of the above rights, email privacy@pingr.email with your full name and the email address associated with your Pingr account. We may request identity verification before processing your request to protect against unauthorised requests. We will respond within the timeframes required by applicable law and will not charge a fee for reasonable requests.

Right to Lodge a Complaint

If you believe Pingr has processed your personal data in a manner that violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority. EU users may contact the Data Protection Commission of Ireland (dataprotection.ie) or the supervisory authority in their country of residence. UK users may contact the Information Commissioner's Office (ico.org.uk).

Children

Pingr is not directed at, and does not knowingly collect personal data from, individuals under the age of 18. The Service involves financial data and investment-related content that is intended for adult users only. If you are under 18, you may not use the Service.

If we become aware that we have collected personal data from a person under the age of 18 without parental consent, we will delete that data immediately. If you believe we have inadvertently collected data from a minor, please contact privacy@pingr.email immediately.

Third-Party Services

Pingr integrates with third-party services to deliver its functionality. Each third party operates under its own privacy policy, and Pingr is not responsible for the data practices of third parties except where we have engaged them as data processors under contract. Key third-party services include:

• Alpaca Securities LLC — brokerage services. Alpaca Privacy Policy
• Stripe Inc. — payment processing. Stripe Privacy Policy
• Brevo SAS — email delivery. Brevo Privacy Policy
• OpenAI Inc. — AI text generation. OpenAI Privacy Policy
• Vercel Inc. — frontend hosting. Vercel Privacy Policy
• Render Inc. — backend hosting. Render Privacy Policy
• Yahoo Finance / yfinance — market price data. Pingr sends ticker symbols (not user data) to Yahoo Finance's public API to retrieve market prices

Links from the Pingr platform to external websites are provided for convenience. Pingr has no control over the content or privacy practices of external sites and accepts no responsibility for them.

Marketing Communications

Pingr may send you marketing communications about new features, promotions, and updates to the Service. We will only send marketing communications if you have consented to receive them or where we have a legitimate interest in doing so (for example, communicating with existing subscribers about updates to a service they are already using, subject to your right to opt out).

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your notification preferences in your Pingr dashboard
• Emailing privacy@pingr.email with the subject line "Unsubscribe"

Opting out of marketing communications will not affect your receipt of service-related communications (such as account security notices, billing confirmations, and signal alerts that you have explicitly configured).

Data Processing Agreement

If you are a business subscribing to Pingr on behalf of employees or users, and the nature of your subscription involves Pingr processing personal data on your behalf, you may require a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR.

To request a DPA, please email legal@pingr.email with the subject line "DPA Request" and provide details of your organisation and the nature of the processing. We will respond within 5 business days.

Pingr's standard DPA incorporates the EU Standard Contractual Clauses (2021/914) for transfers to third countries where applicable.

Changes to This Policy

Pingr may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by:

• Sending an email notification to the address associated with your account at least 14 days before the changes take effect
• Displaying a prominent notice on the Pingr dashboard
• Updating the "Effective" date at the top of this page

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Service and may request deletion of your account before the changes take effect.

Previous versions of this Privacy Policy are available on request from privacy@pingr.email.

Contact & Complaints

For any privacy-related enquiries, data subject requests, complaints, or concerns, please contact us:

We aim to respond to all privacy-related requests within 30 days. For complex requests we may extend this period by a further 60 days with written notice. For urgent matters, please include "URGENT" in the subject line.

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction:

• Ireland / EU: Data Protection Commission — dataprotection.ie
• United Kingdom: Information Commissioner's Office — ico.org.uk
• United States / California: California Privacy Protection Agency — cppa.ca.gov

This Privacy Policy was last updated on April 10, 2026 and is effective from that date.