1. What this covers
This policy applies to the FilingEye website, the FilingEye Chrome extension, and the API behind both. They share one account and one backend, so they share one policy.
The data controller is [LEGAL ENTITY NAME], contactable at [PRIVACY CONTACT EMAIL].
2. What we collect
Account data
When you sign in, our authentication provider gives us your name, email address and a stable account identifier. We never see or store your password — you sign in through your identity provider, and we only ever receive a signed token we can verify.
What you do in the product
- Which filings you have analyzed, recorded as the filing's public SEC identifiers and the billing period, so an allowance can be counted and so the same filing is never charged to you twice.
- The questions you ask in chat, and the answers returned.
- Your watchlist: which companies you follow, which form types you want alerts for, and whether each is set to analyze-and-email or notify-only.
- Your plan, your usage against it, and when it resets.
Operational data
Error reports, request timing and counts of how often features succeed or fail. We use these to keep the service working and to size capacity.
Payment data
Card details are handled entirely by our payment processor. They do not pass through our servers and we never store them. We hold only the subscription status and billing period the processor reports back.
3. The Chrome extension
The extension runs on sec.gov only. It has no permission to read any other site, and it does not run anywhere else.
When you open a filing on EDGAR and ask for an analysis, the extension sends us the filing's public identifiers — the company CIK, the accession number and the document name — together with your session token. That is what leaves your browser.
It does not send us the page you are reading. Our backend fetches the filing from EDGAR itself using those identifiers. The extension does not read, collect or transmit your browsing history, your open tabs, your bookmarks, or the contents of any page on any other site.
No client-supplied figures are accepted by the analysis API. A request names a filing and nothing else. That is a deliberate design choice — it is what guarantees two people asking about the same filing get an identical answer — and a side effect is that there is very little for the extension to send in the first place.
4. How filings reach the AI model
Being specific about this matters more than the usual boilerplate, so:
- All model calls are made by our backend. Neither the website nor the extension ever holds the model provider's API key, and neither calls the provider directly.
- What we send the provider is the text of the SEC filing being analyzed — a public document — plus, for chat, the question you asked.
- The figures in the product are not produced by a model. Financial ratios and forensic scores are computed by a fixed engine reading the filing's XBRL. The model summarizes and assesses tone.
- Our AI provider is [AI PROVIDER NAME], and under our agreement with them your inputs are [CONFIRM: not used for model training].
One analysis is produced per filing and cached, then served to everyone who asks about that filing. That cache is derived from a public document and is not associated with you. Your chat questions are not cached that way — they are yours, and are stored against your account.
5. What we do not do
We do not sell, rent or trade your personal data. We run no advertising, no ad networks and no third-party tracking pixels, and we do not build advertising profiles.
- We do not track your browsing outside sec.gov and our own site.
- We do not share your watchlist, your questions or your usage with other users.
- We do not use your questions to train a model of our own.
- We do not sell aggregate data about what our users are researching.
6. Why we are allowed to hold it
Where the GDPR applies, we rely on performance of a contract for account data, usage counts and anything needed to deliver and meter the service you have signed up for; on legitimate interests for operational data used to keep the service running and secure; and on consent for optional analytics cookies, which you can decline without losing any functionality.
7. Where it is stored
Account and product data are held in a managed Postgres database with row-level security, so a query can only return rows belonging to the authenticated account. Data is encrypted in transit and at rest. Our primary hosting region is [HOSTING REGION].
If you are in the EEA or UK and your data is processed outside it, that transfer is covered by [TRANSFER MECHANISM, e.g. Standard Contractual Clauses].
8. How long we keep it
| Data | Kept for |
|---|---|
| Account and watchlist | While your account is open |
| Chat history | While your account is open, unless you delete it sooner |
| Usage and allowance records | Up to 24 months, for billing and dispute resolution |
| Error and request logs | 30 days |
| Billing records | As long as tax and accounting law requires |
| Cached filing analyses | Kept as part of the shared service — derived from public documents, not linked to you |
When you delete your account, personal data is removed within 30 days, except billing records we are legally required to retain.
9. Who else processes it
| Processor | What for |
|---|---|
| Supabase | Authentication and database hosting |
| [AI PROVIDER] | Generating summaries, sentiment and findings from filing text |
| Stripe | Subscription payments |
| [EMAIL PROVIDER] | Sending filing alerts and account email |
| [HOSTING PROVIDER] | Running the website and API |
We read filings from the SEC's EDGAR system. EDGAR is a public government service; we send it filing requests, not anything about you.
10. Your rights
Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or export it. If you are in the EEA or UK you also have the right to object to or restrict processing and to complain to your local data protection authority.
If you are a California resident, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA, so there is no opt-out to offer.
Email [PRIVACY CONTACT EMAIL] and we will respond within 30 days.
12. Children's data
FilingEye is a professional research tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We will update this page when the product changes. If a change materially affects how we handle your data, we will email account holders before it takes effect, and the date at the top of this page will always reflect the current version.
14. Contact
Questions about this policy, or a request about your data, go to [PRIVACY CONTACT EMAIL].