Privacy Policy

You give us:

• Email address: when you request a verification code, subscribe, or sign in. We send a 6-digit code to verify it and store a hashed form of the code.
• Account password: stored by our authentication provider in hashed form. We never see it in plain text.
• Messages you send us: the Help form on your account page (email address, category, message) and the contact form on aster-ridge.com (first name, surname, email address, message).
• Research requests: the ticker symbols you submit and the memos generated for you.

Created when you subscribe and pay:

• Payment and billing information: Link and Stripe collect your card details and billing address on their checkout page; we do not receive or store full card numbers. Stripe sends us records of your subscription, invoices, and charges, which include your name, email address, billing address, the card's brand, last four digits, expiry month and year and issuing country, amounts, tax, and payment status. We keep these records.
• Subscription status: trial and billing dates, plan, and Stripe customer and subscription identifiers.
• Acceptance records: the Terms and Risk Disclosure versions you accepted and, for visitors in the EU, the EEA and the UK, your request for the service to start immediately, with your email address and the time.

Collected automatically:

• IP address: recorded when you request a verification code (to limit abuse), and the country derived from it by our hosting provider (to decide whether to ask for analytics consent and whether the EU withdrawal terms apply at checkout).
• Where you came from: the campaign parameters (utm_source, utm_medium, utm_campaign) and the first page you visited, stored in your browser and attached to your verification request, your subscription and, if analytics is on, your analytics events.
• Usage analytics (PostHog): pages viewed, clicks, browser and device type, approximate location derived from your IP address, and a random identifier. After you sign in, analytics events are linked to your account's internal identifier; your email address is not sent to analytics. Session recording is off.
• Error reports: the error message, the page, and technical details when the site fails.

• To provide the service and bill you: verify your email, create and secure your account, generate memos, enforce usage limits, run the trial and subscription, apply tax, process refunds and chargebacks, and send the emails the subscription requires (verification codes, account invitation, enrollment confirmation, the reminder before your first $79 charge, replies to your messages). Basis: performance of our contract with you.
• To keep tax and accounting records: payment records and acceptance records. Basis: legal obligation.
• To prevent abuse and attribute signups: rate limits on verification codes, one trial per email address, error reports, and recording which campaign or page brought you. Basis: our legitimate interests in securing the service and measuring which channels work, which do not override your rights because the data is limited to what is listed above.
• To measure and improve the site with analytics: Basis: your consent for visitors outside the United States, given in the banner and withdrawable at any time under Cookie settings; for visitors in the United States, our legitimate interest, with the same Decline option.

We do not sell personal information and do not share it for cross-context behavioral advertising. We share it with these service providers, each for the purpose stated:

We also disclose information when required by law or to protect our rights. If Aster Ridge Research is involved in a merger, acquisition, or sale of assets, personal information may be transferred to the successor, which remains bound by this policy for information collected under it.

Our providers process data in the United States. If you visit from outside the United States, your information is transferred there. For transfers from the EU, the EEA, the UK, and Switzerland we rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum) in the provider's data processing terms.

• Analytics (PostHog cookie and local storage): Visitors in the United States: set on the first visit. Visitors elsewhere: set only after you choose Accept in the banner. Anyone can change the choice at any time with Cookie settings in the site footer, which reopens the banner; Decline stops analytics and deletes its cookie and stored identifier.
• Sign-in session (local storage): set when you sign in.
• Attribution, consent choice, and checkout progress: attribution (campaign parameters and first page) in local storage; your consent choice in a cookie shared by aster-ridge.com and platform.aster-ridge.com (kept 1 year) and in local storage; checkout progress in session storage (cleared when the tab closes). These are needed for the site to work and are not shared with anyone except as described in §3.

Deletion runs automatically every day.

• Change your email address and password on your account page.
• Cancel your subscription at any time from your account page.
• Give or withdraw analytics consent at any time with Cookie settings in the site footer. Withdrawing consent does not affect processing before it.
• Everyone: request a copy of your information, a correction, or deletion by emailing support@aster-ridge.com from your account email address; that is how we verify the request. We answer within 30 days. Deletion covers the account, its memos and messages, and its analytics profile in PostHog; payment and acceptance records are kept for the periods in §6.
• EU, EEA and UK: you also have the rights to restrict processing, to data portability, and to object to processing based on our legitimate interests, and you may complain to your local data protection authority or, in the UK, the Information Commissioner's Office.
• California and other US states with privacy laws: you have the rights to know, access, correct, and delete your personal information. We do not sell or share it and do not use sensitive personal information for any purpose that would require a right to limit. We will not discriminate against you for exercising these rights, and you may use an authorized agent, whom we may ask to show your signed permission.

Data is encrypted in transit. Passwords and verification codes are stored hashed. Access to the database is limited to the service and the operator.

The service is not directed to anyone under 18, and we do not knowingly collect their information.

We post any change on this page with a new version and effective date, and email subscribers about material changes before they take effect.