Privacy Policy

1. Information We Collect

Hiram OÜ respects your privacy. We collect minimal information required to provide our service: your name, email address, payment method (handled by Stripe — we never store full credit-card details), and the platform-usage data described below.

At checkout. When you subscribe, Stripe, our payment processor, collects your address (a shipping address, and a billing address where your payment method needs one) and, if you buy as a business, your VAT ID. We need them to charge the VAT of your country and to apply the reverse charge for a business (see our Terms, section 5), and the address also lets you pay with a wallet such as Google Pay or Apple Pay, which can fill it in for you. Nothing is shipped: the shipping address is where you are. Stripe stores these details as our payment processor (see section 5), shows them on your invoices, and fills them in the next time you check out. Our own database does not keep your address or VAT ID: it records your plan, your subscription's status and your invoices (amount, currency, billing period and links to Stripe's copy). One exception: if our system fails to process a payment event that Stripe sends us, a copy of that event, which can include these details, is kept in our database so that our team can investigate the failure.

2. Session Telemetry & Security

For account-security and abuse-prevention, each time you sign in to your Meaterm account (website, dashboard or terminal) we record a row in our login_events table containing:

• The IP address you signed in from, and the country, city, region and timezone that Cloudflare's geo-IP derives from it
• Your browser's User-Agent string, and the device class (desktop / mobile / tablet), browser and OS derived from it
• A device fingerprint: a 16-character hash computed in your browser from your user agent, language, timezone, screen size and colour depth, pixel ratio, number of processor cores, device memory, a small canvas drawing, and your graphics card's vendor and renderer. Only the hash leaves your browser. It is stored only in our database; it is NEVER shared with any third party and is NOT used for cross-site tracking
• How you signed in: with your email address (a password or an emailed sign-in link) or with Google
• An anomaly score (0-100) computed against your own history; if the score is high we email you to confirm the sign-in

The dashboard also writes a row of the same kind, marked “developer tools opened”, when it detects that your browser's developer tools are open, so that our team can review it. That row is not scored and does not trigger the email.

Session telemetry is retained for 90 days and then automatically deleted. You can review every recorded session at dashboard → Profile → Recent sessions, mark them as safe, or use "This wasn't me" to revoke every active session and reset your password.

If your profile has no country or timezone, we fill them in with the country and timezone that Cloudflare's geo-IP derives from the IP address you signed up or signed in from, and we use the country for aggregate statistics about where our users are. We never replace a country or timezone that is already there, and you can change both at any time in Dashboard → Profile.

3. How We Use Your Data

We use your data to: authenticate your account, save your terminal layouts and watchlists, process subscriptions, answer what you ask the AI assistant, the support chat, the research tools and the screener's AI filter (see section 5), detect unusual sign-ins (see section 2), monitor platform performance, and send essential service updates. We do not sell your data.

Some of this is done automatically, by software:

• every sign-in gets an anomaly score (section 2);
• the signup check (section 8) can refuse a new account automatically; contact support and a person will review it;
• once a day we compute an account-health score (0-100) for each account from how recently you signed in, how much of onboarding you have completed, your plan, your open support tickets and whether your payments are up to date. Our team uses it to see which accounts may need help; it does not change what you can do on the platform;
• if you turn it on, Personalized research (section 11).

Feature usage. When you are signed in, we record which of our main features you use: opening the terminal, editing a watchlist, creating a price alert, running the screener, opening a company's financial statements, saving chart drawings, asking the AI assistant and saving a research report. Each record holds the feature, the time and your account ID (for a watchlist edit, also the kind of change, such as adding or removing a symbol), at most once a minute per feature, and never what you entered: no symbols, prices, questions or texts. We use these records, added up across all users, to see which features are used and to improve the product (product analytics, a legitimate interest, section 9; you may object under Article 21). Two of them are recorded by your browser, installing the web app and copying your referral link, and are sent only if you allowed Analytics in the cookie banner. The records are kept for 13 months, then deleted.

4. Cookies & Local Storage

We use first-party cookies (SameSite=Lax) to keep you signed in. The site's own scripts need to read them, so they are not HttpOnly. Your browser's local storage keeps preferences such as your theme and terminal layout, the idle-timeout timestamp and the prompts you have dismissed. Our Cookie Policy lists them.

Every page loads Google Analytics 4 (Google's gtag.js) in Google's consent mode. Until you allow Analytics in the cookie banner it sets no cookies, but Google still receives measurements of the pages you view, without cookies. If you allow Analytics, Google Analytics sets its own cookies to count visits. If you allow Marketing, we tell Google that it may use advertising storage and use your data for advertising and ad personalisation (Google's ad_storage, ad_user_data and ad_personalization signals). You can change your choice at any time with “Cookie preferences” in the footer.

5. Sub-processors

We do not sell, rent, or trade your personal data to third parties. We share it only with the providers listed below, which process it on our behalf to run the service. The DPA column links the data processing terms that apply to each provider; a dash means we have no link to give yet. The list may change as the platform evolves — material updates are posted on /changelog.

Our database (Supabase) is hosted in Zurich, Switzerland. Switzerland is not in the EU, but the European Commission has decided that it protects personal data adequately (an adequacy decision under GDPR Article 45), so personal data can be transferred there without further safeguards.

6. Your Rights (GDPR)

Hiram OÜ (an Estonian private limited company, registry code 14414308, registered address Liivamäe tn 4-33, 10132 Tallinn, Estonia) is the data controller for the processing described here; reach our privacy contact at privacy@meaterm.com. Under the General Data Protection Regulation (GDPR) you have the right to access, correct, export (data portability), and request deletion of your personal data, to restrict processing, and — where we rely on legitimate interest (see section 9) — the right to object under Article 21. You may exercise these rights at any time by contacting us, or from your account at Dashboard → Security: “Request export” asks for a machine-readable copy of your data, which we email to you within 30 days, and “Request deletion” asks us to delete your account, which our team confirms and carries out within 30 days.

When we delete your account, the rows tied to it (your profile, login_events, customer notes, subscription overrides, credits, admin_user_profiles and the rest of your account data) are removed with it through cascading foreign keys. We keep your deletion request (your email address and the reason you gave), so that we can show we handled it, and for 90 days a record that we carried it out, with your email address partly masked. Some logs keep their rows with the link to your account removed: for example, our log of the emails we sent you keeps the address and subject until it is deleted after 180 days. The signup record described in section 8 is not linked to your account; it is deleted 12 months after it was written.

If you believe we have mishandled your data, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or with the supervisory authority in your EU/EEA country of residence.

7. Screen Watermarking

Pages inside the dashboard render a low-opacity watermark containing your email address. This deters account-sharing — leaked screenshots identify the account-holder. The watermark is purely visual; no biometric or device data is captured.

8. Signup Anti-Abuse Fingerprint

The Free plan is a finite, costly resource. To stop a small number of users from creating multiple free accounts to get around the Free plan's limits (a practice that drives prices up for everyone else), our signup page sends a short fingerprint of your browser when you create an account, and we keep a record of it. The record holds:

• Your IP address and the country Cloudflare derives from it
• Your browser's User-Agent string
• A SHA-256 hash of a set of browser signals: canvas paint output, WebGL renderer (GPU model), which of a list of common fonts are installed, screen size, colour depth and pixel ratio, timezone, languages, number of processor cores, touch support, platform, and your reduced-motion, colour-scheme and contrast settings. Your browser sends these signals to our server, which hashes them and keeps only the hash. Records written before this version of the policy also stored the raw signals
• A SHA-256 hash of your email address, trimmed and in lower case. It keeps the address itself out of the record and lets the check tell a different account apart from you signing up again with the same address. The hash is not salted: anyone who already knows your email address can compute the same hash and match it to the record, so it is pseudonymised data, not anonymous data. Only differences in letter case are ignored; an alias such as name+tag@example.com counts as a different address
• Whether the record was flagged for review, and why

If three or more other accounts were created from the same fingerprint or IP address in the last 60 days, new signup attempts from that source are blocked and a clear support-contact message is shown; the blocked attempt is recorded too, but never counts toward anyone else's block. Lower match counts simply flag the record for an admin to review — your signup still completes.

This data is stored only in signup_fingerprints, is used exclusively for fraud prevention, and is never sold or shared. Each record is deleted 12 months after it was written. It is not linked to your account, so deleting your account does not delete it sooner. If you believe you've been incorrectly blocked, contact support and we'll reset the flag.

9. Legal Bases for Processing

We process personal data only where a GDPR Article 6 legal basis applies:

• Contract (Art. 6(1)(b)) — to create your account, provide the Service, and process your subscription.
• Legitimate interests (Art. 6(1)(f)) — account security, anomaly detection, signup anti-abuse / one-account-per-person enforcement (sections 2 and 8), and product analytics: counting which features are used (section 3). We have weighed these interests against your rights and freedoms; you may object under Article 21.
• Legal obligation (Art. 6(1)(c)) — to meet tax, accounting, and other statutory requirements, including charging and declaring the VAT of your country (the address and VAT ID collected at checkout, section 1).
• Consent (Art. 6(1)(a)) — where we ask for it explicitly; you may withdraw consent at any time.

10. Children

The platform is intended exclusively for users aged 18 years or older, in accordance with Terms of Service section 2. We do not knowingly collect personal data from any person under the age of 18. Signing up with an email address requires you to tick a box confirming that you are 18 or older. If we become aware that a person under 18 has created an account, we will close the account and delete the associated personal data without undue delay. If you are a parent or guardian and believe your child has provided us with personal data, please contact privacy@meaterm.com.

11. Personalized Research (opt-in)

If you turn on “Personalized research” in Settings, we use your own activity on the platform (the features and instruments you interact with, recorded in our feature-usage logs) and your watchlist to tailor research insights shown only to you.

• Legal basis: your consent (GDPR Art. 6(1)(a)). We record the date and state of your choice in our consent ledger.
• It is OFF by default — nothing is personalized until you opt in.
• We do not use this data for advertising, for automated decisions producing legal or similarly significant effects (Art. 22), or share it with any third party.
• You may withdraw at any time by switching the setting off — as easy as turning it on (Art. 7(3)). Withdrawal stops personalization immediately.
• This data is included in your data export. When your account is deleted, your consent record and your watchlists are deleted with it, and your feature-usage events are kept without the link to your account.