Privacy

Controller: Mikael Lindberg, acting in a private capacity, Norway

Contact for privacy questions and requests: support@firmorio.com.

The basis shown is our proposed basis for this beta and is to be confirmed.

• Account. Your email address and an account ID, plus sign-in session data. Purpose: let you sign in without a password and keep your account. Basis: providing the service you asked for (contract).
• Watchlist. The companies you follow, when you added them and the state of the Free plan switch rule. Purpose: show your private watchlist and apply the two-company limit. Basis: contract.
• Investor waitlist. That you joined, when, the page you joined from, your account email as copied at sign-up, and the price text shown. Purpose: contact you about the Investor plan. Basis: your consent, which you can withdraw by leaving the waitlist.
• Coming soon interest. Which upcoming feature you saw, opened or showed interest in, the date and the page. When you press “I’m interested”, your account email is stored with that record. These records are linked to your account, so they are pseudonymous, not anonymous. Purpose: decide what to build. Basis: legitimate interest in improving the product.
• Company requests. The short text you submit, when, the page you sent it from and your account email as copied at submission. Purpose: decide which companies to add. Basis: legitimate interest. Do not include personal information in the text.
• Google sign-in. If you choose Continue with Google, Google can provide identity details such as your email address, name or profile information and a Google account identifier, limited to the basic sign-in scopes we request (openid, email, profile). We do not store Google access or refresh tokens in the app. Purpose and basis: authentication (contract). Google acts under its own terms and privacy notice. Google’s own retention, data location and transfer terms are not described here.
• Sign-in emails. Your address and the sign-in message are processed to deliver the email. Purpose: authentication. Basis: contract.
• This browser. A sign-in session cookie set when you sign in, and a watchlist saved on this device without an account. We do not use advertising tracking or third-party analytics tools.

Our service providers may also keep technical logs, such as IP addresses and device information, for security and operation. We have not documented these in detail yet.

• Supabase: database and authentication for the data above. The database and Auth are in the project’s selected region; some logs, support and operations data may be processed elsewhere, as described in Supabase’s documentation.
• Resend: delivery of sign-in emails.
• Google: identity provider, only when you choose Google sign-in.
• Render: hosts the Firmorio web service in Frankfurt, Germany. Render documents that international transfers may occur and are handled through the mechanisms in its data processing agreement (DPA). We do not claim that all personal data always stays in Frankfurt.
• GitHub: private storage of our source code, not of user data.

Our providers act under their own terms and privacy documentation.

Financial figures and report links come from public filings in the U.S. SEC EDGAR system. They are not personal data about you.

• Account, watchlist and waitlist data: until you delete your account or leave the waitlist.
• Coming soon interest records: target 180 days. Cleanup is run by hand, so records can exist somewhat longer.
• Company requests: target 365 days. Cleanup is run by hand, so records can exist somewhat longer.
• Inactive accounts: Accounts may be deleted after 24 months without sign-in, following reasonable advance notice where practicable.
• Provider logs and backups: retention is set by the provider and has not been verified yet.

You can delete your account under Profile. This removes your account, watchlist, waitlist entry, interest records and company requests. It does not remove company or financial data.

You can ask for access, correction, deletion, restriction of processing, and you can object to processing based on legitimate interest. Where processing is based on consent or contract, you can also ask for your data in a portable format. You can withdraw consent at any time. Contact us using the point above.

You can complain to your data protection authority, in Norway Datatilsynet.

Accounts use email sign-in links. Personal data tables are not directly readable or writable by the public. Access to your data is limited to your signed-in account and to the service provider administration needed to run Firmorio. No system is completely secure.

We may update this statement during the beta. The date above shows the latest update. See also the Terms, which are separate.