Privacy Policy

1. Introduction and data controller

CREATIVE SYNDICATES TECH LTD (Company Number: 17003909, England and Wales), trading as Chartloom ("we", "us", or "our"), operates the Chartloom financial research and data visualization platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services (the "Service"). We are the data controller for the personal data we process in connection with the Service.

We are committed to handling your data in line with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Personal data we collect

We may collect and process the following categories of personal data:

• Account and identity data: Email address, password (stored in hashed form), and optionally display name, username, and profile picture (avatar) when you register or update your profile. If you sign in using a third-party provider (such as Google or X), we receive limited profile information from that provider (typically your name, email address, and profile picture) as part of the authentication process. We use this data only to create and manage your Chartloom account and do not share it with other third parties.
• Authentication and session data: Session tokens and related data stored in cookies and used to keep you logged in and to secure your access.
• User content: Data you create while using the Service, such as portfolios, watchlists, alerts, tier lists, notes, scenario models, dashboard layout and column preferences, and similar content linked to your account.
• Support and feedback: When you contact us for support or submit a bug report or feature request, we collect the information you provide (e.g. reason, description, and for bug reports optionally steps to reproduce, browser/device info) together with your account identifier.
• Email communications and preferences: Email delivery data, unsubscribe or suppression preferences, and related metadata needed to send, manage, and respect your choices about Chartloom emails.
• Payment and subscription data: Subscription status and related identifiers are processed by our payment provider. We do not store your full payment card details; billing and payment data are handled by our payment processor in accordance with their privacy policy.
• Usage and analytics data: We use a privacy-focused analytics service to collect anonymized usage data (e.g. hostname, language, referrer, screen size, page title, URL). We do not send your name or email to analytics. Where we identify a user for analytics, we use only an anonymized user ID and role; admin and moderator accounts are excluded from analytics identification.
• Technical and operational data: Logs may include IP address, user agent, and similar technical data where necessary for security, rate limiting, and operating the Service.

3. How we use your data

We use your personal data to:

• Create and manage your account and authenticate you.
• Provide, maintain, and improve the Service (including storing and displaying your user content and preferences).
• Process subscriptions and manage access.
• Respond to support requests, bug reports, and feature requests.
• Send service messages needed to run the account, including confirmation, security, billing, a factual welcome, and notices when trial access starts or ends.
• Send product tips, feature updates, and promotional offers only where you have opted in and have not withdrawn that choice.
• Understand how the Service is used, using cookie-less aggregate analytics, to improve the Service.
• Protect the security and integrity of the Service (e.g. rate limiting, abuse prevention, enforcing our terms).
• Comply with legal obligations and defend our legal rights.
• Public posts: We do not treat a public social post as permission to reuse it. If we want to display a review or comment, we ask for permission or use only what the platform's terms allow for embedding. You can ask us to remove a featured post by contacting the address in Section 14.

We do not sell your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

Where we need your data to perform our contract with you (e.g. account and payment data), we cannot provide the Service without it. Other information is voluntary unless otherwise stated.

Creating an account does not opt you into promotional email. Service messages (confirmation, security, billing, a factual welcome, and trial access notices) are sent because they are needed to provide the account. Product tips, feature updates, and promotional offers are sent only if you tick the optional box at registration or turn that choice on in account settings. You can withdraw that choice in settings, or by using the unsubscribe link in those emails. Withdrawal does not affect service messages. Contact unsubscribe@chartloom.com.

4. Legal basis for processing (UK GDPR)

We process your personal data only where we have a valid legal basis:

• Contract: Where processing is necessary to perform our contract with you (e.g. account management, providing the Service, processing subscriptions).
• Legitimate interests: Where we have a legitimate interest that is not overridden by your rights, including securing the Service, responding to support requests, and sending service notices that are not promotional.
• Legal obligation: Where we must process data to comply with applicable law.
• Consent: For optional product tips, feature updates, and promotional offers. Consent is separate from the Terms, starts unticked, and can be withdrawn at any time. Withdrawal does not affect processing that happened before withdrawal. We keep an append-only record of the choice.

5. Cookies, local storage, and analytics

We use a minimal number of cookies, all of which are strictly necessary for the operation of the Service. We do not set any non-essential, advertising, or tracking cookies.

Cookies we use:

Because all cookies we set are strictly necessary for the Service to function, no cookie consent banner is required under the UK Privacy and Electronic Communications Regulations (PECR) or the EU ePrivacy Directive.

Analytics:

We use Umami for cookie-less aggregate analytics (page views, referrer, screen size, and country). It does not use advertising cookies and we never send it your name or email address. When you are signed in, sessions are associated only with a pseudonymous internal account ID and subscription tier; admin and moderator accounts are excluded from analytics. We do not load advertising pixels or send conversion events to advertising networks.

Local and session storage:

We use your browser's local storage and session storage to store preferences (e.g. theme, dashboard layout, column visibility) and to cache data for performance. For the affiliate referral programme we may temporarily store an optional referral code (such as chartloom_pending_affiliate_ref payload for up to 60 days where supported) solely to associate qualifying sign-ups with creators you arrived from via an approved affiliate link — not for cross-site behavioural advertising or third-party profiling. This data stays on your device until cleared or superseded except where synced by normal account flows. Clearing storage may reset preferences. You may clear browser storage anytime; attribution may lapse if referral context is erased before checkout.

Affiliate programme data

If you apply to the Chartloom Affiliate Programme, we collect application information you submit (for example display name, social handle or website, payout method, PayPal email or UK bank details where provided, records of acceptance of programme terms, and whether you grant optional permission to use a social media profile picture on a branded referral page). We use this to evaluate applications, calculate commissions from subscription billing data, investigate fraud, administer payouts, and satisfy tax and accounting obligations.

Where you grant profile-picture permission, we may obtain a publicly available image from the social account or website you provide, store a copy in private Chartloom storage, and display it on your branded affiliate referral page (and ordinary previews of that page). The legal basis is your consent; you may withdraw it by contacting us at the details in Section 14, after which we will remove the image from the public page within a reasonable time.

When referral relationships exist, we process the minimum linkage data needed to attribute paid subscriptions to creators (such as internal user identifiers and Stripe identifiers for invoices or charges). The in-product affiliate dashboard does not expose referred individuals' emails or comparable contact details to affiliates.

Payout details are handled with restricted access. PayPal and bank processors also process data under their own policies when you are paid through them.

6. Third-party processors and international transfers

We use trusted third-party service providers who process personal data on our behalf (as processors or sub-processors), including:

• Authentication and database hosting (and related infrastructure).
• Payment and subscription processing.
• Anonymized analytics.
• Where we use third-party services for features such as AI-generated summaries or financial data, those providers may process data in accordance with their own policies and our agreements.

Some of these providers are outside the United Kingdom, including hosting, payments, email delivery, and analytics providers in the United States or European Economic Area. Where we transfer personal data outside the UK, we use an adequacy regulation or the UK International Data Transfer Agreement / Addendum to the EU standard contractual clauses. You can ask for a copy of the relevant safeguard, or a summary of it, by emailing support@chartloom.com.

7. AI and automated processing

We use artificial intelligence (AI) to generate research summaries from publicly available sources, including SEC filings (such as 10-K and 10-Q), analyst estimates, institutional ownership, insider trades, and other market data. This processing is used only to provide informational content within the Service. We do not use automated decision-making that produces legal effects or similarly significant effects on you. Where we use third-party AI providers to generate such content, those providers process data in accordance with their own policies and our agreements with them.

8. Data retention

We keep account data while the account is open and for up to 24 months after closure, unless a longer period is required for tax, payment, or legal claims. Consent and email-suppression records are kept for up to 6 years so we can show what was agreed and what was withdrawn. Security logs are kept for up to 12 months. Aggregate analytics are kept without an account identifier. Payment records follow the retention period required for tax and accounting.

9. Your rights (UK GDPR)

Under UK data protection law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data in certain circumstances.
• Restriction: request that we restrict processing in certain circumstances.
• Data portability: request a copy of your data in a structured, machine-readable format where applicable.
• Object: object to processing based on legitimate interests. You have an unconditional right to object at any time to the use of your data for direct marketing.
• Withdraw consent: where we rely on consent, you may withdraw it at any time.
• Lodge a complaint: with the Information Commissioner's Office (ICO) in the UK: ico.org.uk/make-a-complaint.

To exercise any of these rights, please contact us at the details below. We will respond within one month (we may extend by a further two months where necessary for complex or numerous requests, and we will inform you of any extension). You may update your profile through your account settings, request a copy of your data, or submit an account deletion request through the Data & Privacy section of your account settings.

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. These include secure authentication, encryption in transit, access controls, and use of reputable infrastructure and processors. No method of transmission or storage is completely secure; we encourage you to use a strong password and to keep your login details confidential.

11. Children

The Service is not intended for individuals under 18 (or the age of legal majority in your jurisdiction). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete it.

12. Additional rights for California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

• Right to know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you. The categories we collect are described in Section 2 above.
• Right to delete: You have the right to request deletion of your personal information, subject to certain exceptions. You may submit a deletion request through your account settings or by contacting us.
• Right to opt out of sale or sharing: We do not sell your personal information, nor do we share it for cross-context behavioral advertising. Because we do not engage in these activities, there is no need to opt out.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact us at the details in Section 14 below. We will verify your identity before processing your request.

13. Changes to this policy

We will post updates on this page and change the "Last updated" date. For a material change we will also email the account address or show a notice in the Service before the change applies. If you do not agree, you can close the account. Continued use is not treated as consent to optional email.

14. Contact and data protection enquiries

CREATIVE SYNDICATES TECH LTD (trading as Chartloom)
Castle House, High St, Ammanford SA18 2NB
Company Number: 17003909 (England and Wales)

For privacy-related requests, to exercise your data protection rights, or for any questions about this Privacy Policy, please contact us at support@chartloom.com, through the support options in your account settings, or on the Platform. For email unsubscribe requests, you may also contact unsubscribe@chartloom.com.