Privacy notice
Who is responsible
D M Arnsby, trading as StockRetriever, is responsible for personal data used to operate this website. Address: 81 Spring Hill, Bristol, BS15 1XW, United Kingdom. Email: contact@stockret.com. This notice was updated on 8 November 2026.
Accounts and payments
We use your name, email, password hash, verification status, sessions and accepted notices to provide and secure your account. We record the exact research notice and subscription agreement you accept, its version and time. Stripe processes checkout, card details, invoices, subscriptions, refunds and fraud checks. We retain its account/payment identifiers, billing country, payment status and necessary transaction information; we do not receive your full card number. Eligible international purchases use Stripe as merchant of record, as shown at checkout. Stripe also processes information for its own payment, fraud and legal responsibilities.
Research, AI and reuse
Watchlist names remain in your browser. For signed-in accounts, we record ticker membership and a random browser identifier for up to 30 days of inactivity to choose the shared live-price feed. Each account counts once per ticker; other customers cannot see your identity or lists. We store your research requests, saved results and usage so you can revisit work and we can apply access and usage limits. AI actions send the request and relevant market data to OpenAI, our initial AI provider. Account credentials and payment information are not included. Private account histories are not included in shared generation. Compatible research specifications and generated results may be reused across customers to avoid duplicate AI calls; account identities are not attached to these shared results. Do not put personal, confidential or sensitive information into research prompts. Contact us if you accidentally do. The provider/model and data dates are recorded with results. OpenAI API data is not used to train its models by default; provider safety logs can be retained for up to 30 days. We request no persistent Responses API storage. This is not a claim of zero provider retention.
Why we use this information
We rely on performance of our contract for accounts, research, subscriptions and service messages; legal obligations for necessary financial and compliance records; and legitimate interests for security, abuse prevention, reliability, service statistics and efficient reuse of non-personal research. We consider your rights when using legitimate interests. We do not sell your account data. Registration does not enrol you in marketing, and no marketing campaign is sent without a separate appropriate basis. We do not use account data to make automated investment suitability or credit decisions.
Service providers and international processing
The website and database run on a Spaceship server in the United States. Spacemail handles service email; Stripe handles payments; OpenAI handles requested AI work. Authorised support providers may process data where their services operate, including outside the UK. We use provider data-processing terms and applicable international-transfer safeguards, including contractual clauses where required. Contact us for details or a copy of the safeguards relevant to your data. Providers may retain their own records for legal, security and payment purposes under their privacy notices.
Cookies and local storage
We use an essential login cookie and browser storage for appearance, workspace settings and saved local research. Login sessions expire and can be revoked by signing out or resetting your password. Verification and reset links expire and are single use. These functions do not require advertising trackers. No advertising or optional analytics cookies are activated by account registration.
Retention and deletion
We keep account and saved research information while needed to provide your account. You can request closure, correction or deletion by email. We aim to remove unnecessary account and research data within 30 days of a verified closure request. Necessary payment, accounting and agreement records may be kept for up to six years after the relevant relationship or financial period, and longer only where a legal obligation or live dispute requires it. Sent email bodies are cleared from our delivery queue. Expired login and recovery tokens are regularly removed. Shared research is reused for a limited freshness period and may remain archived for reproducibility; if it contains personal information, request its removal. Server backups retain frequent copies for seven days and daily copies for up to 30 days. Encrypted recovery copies also exist on the operator’s secured computer; deletion requests include review of those copies. Backups are restricted to recovery, and deletion instructions must be reapplied after a restore.
Your choices and rights
Contact contact@stockret.com to request access, correction, deletion, restriction or a portable copy of your information, or to object to processing based on legitimate interests. These rights depend on the applicable circumstances; some financial/legal records cannot immediately be deleted. We may ask for proportionate verification of identity and normally respond within one month. You may complain to the UK Information Commissioner’s Office at ico.org.uk or your local data-protection authority. Providing account and payment information is necessary for the corresponding service; optional marketing consent can be withdrawn without affecting the service.
Security and changes
Passwords are stored as one-way hashes. Access is restricted, service connections are encrypted and database backups are encrypted and restore-tested. No service can promise perfect security. We publish updates to this notice and notify you of material changes affecting how your personal information is used.