InsiderClue

Privacy Policy

Last updated: 25 Oct 2026

1. Introduction

This Privacy Policy explains how InsiderClue (“InsiderClue”, “we”, “us”) collects, uses and protects personal data when you visit or use our website insiderclue.com (the “Website”).

InsiderClue is based in the Netherlands, and aims to comply with applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”) and relevant national laws in EU Member States.

This Privacy Policy should be read together with our Terms of Use & Disclaimer, which govern your use of the Website.

If you do not agree with this Privacy Policy, you should not use the Website.

2. Who We Are

InsiderClue operates the Website insiderclue.com and presents publicly available financial and market data, including data retrieved via the US Securities and Exchange Commission (SEC) API.

The Website is currently operated on an informal basis and not yet through an incorporated legal entity. Once InsiderClue is incorporated, we may update this Policy to include the legal entity details.

3. What Data We Collect

The Website is free and can be read in full without an account. For visitors who do not create one, we generally collect limited personal data, although visiting a website inherently involves some processing, such as IP addresses. If you do create an account, we additionally process the details you give us for it, as set out in section 3.3.

We may collect the following categories of data:

3.1. Technical and usage data

  • IP address and other identifiers assigned to your device;
  • browser type and version;
  • operating system and device type;
  • referral URL and pages visited;
  • date and time of access.

This comes from two places. One is the web server's own log, which records a request whether or not anything runs in your browser. The other is Google Analytics 4, a measurement tool operated by Google, which runs on the public pages of the Website and not on the pages behind the administrator's sign‑in. It is named here because an earlier version of this Policy promised that any analytics tool would be named before it ran.

It answers one question: how the Website is read. How many people open it, which pages they arrive on and which they go to next, what sent them there, roughly where in the world they are and what they are reading it on. That is so that we know what to write more of and what to fix. It is not used to build a profile of you, to advertise to you, or to recognise you anywhere else.

How it is configured. Google Analytics can be set up in ways that do follow people across the web. Every one of those settings is off here, and they are set in the page rather than promised about it: the file that starts the measurement is assets/analytics.js, it is served from this Website like any other file, and anybody may read it.

  • Your IP address is truncated before it is stored. What remains is enough for an approximate location, a country or a region, and not enough for a connection or a household.
  • Google Signals is off. That is the setting which would join what happens here to the Google account of a visitor signed in to one. With it off, the measurement stays this Website's own and does not become part of a profile held elsewhere.
  • Nothing advertising. Advertising storage, advertising identifiers and personalisation are all refused before the first measurement is taken, and the advertising identifiers are stripped out of what is sent rather than sent and relied upon to be ignored. No advertising cookie is set, no remarketing audience is built, and the Website carries no advertisements.
  • Nothing that identifies you is sent. Not your name, not your email address, not your account, not your session. If you are signed in, the measurement does not know it: a signed‑in reader and a stranger look the same to it, and no attempt is made to work out that they are the same person.
  • Google's own use of it is switched off in the account settings, so the measurement is not fed back into Google's other products, and the measurement itself is kept for two months, the shortest retention Google offers.

What is measured is therefore the page rather than the person: which page was opened and when, which page or search sent you to it, the approximate location, the browser, the device type, the language, and whether this was a first visit or a later one. Google's “enhanced measurement” adds a few events to that where it is left switched on: scrolling to the foot of a page, following a link that leads off the Website, and downloading a file. There is no session recording, no heat map and no mouse tracking on the Website, and nothing here reports what you type.

Apart from Google Analytics, no page on the Website loads a script, a font or an image from anybody else. The Website's content security policy names Google's hosts and the Website's own files, and nothing besides, so nothing else can be loaded accidentally.

Google Ireland Limited acts as our processor for the measurement, under Google's data processing terms; see section 7 on recipients and transfers. The cookies it sets are in sections 3.2 and 6, and why we do not ask you beforehand is in section 5.1.

3.2. Cookies

The Website sets one cookie of its own, insiderclue_member, and it is the session cookie that keeps you signed in. It is set when you open the sign‑in or registration page and while you are signed in. It holds a random identifier and nothing about you.

Google Analytics sets two more, named _ga and _ga_ followed by the identifier of the measurement property. They hold a randomly generated number and nothing else: no name, no address, nothing taken from an account. Their only work is to tell a second visit from a first one, so that one reader opening four pages is counted as one reader rather than four. They last thirteen months from your last visit, are marked Secure and SameSite=Lax, and are set on this Website's own domain rather than on Google's.

One more of our own is set only if you choose columns for your watchlist: wl_cols, which remembers which columns you picked so the watchlist opens the same way next time. It holds the names of those columns and nothing else, lasts a year, and is set when you press the button that shows them. It is a setting you asked for, not a measurement.

That is all of them: four at most, the sign‑in one only if you sign in and the watchlist one only if you pick columns. There is no advertising cookie and no cookie that recognises you on another website. Section 6.3 says how to refuse or remove the analytics ones, and section 5.1 why they are not put to you as a choice first.

If tracking cookies are ever introduced, we will obtain your prior consent in accordance with applicable laws and update this Policy accordingly.

3.3. Account data (optional)

You can create an account, but you never have to: everything on the Website is readable without one. If you do create one, we process:

  • Your name, as you enter it, so that the Website can address you. It is not shown to other users.
  • Your email address, to confirm the account, to let you reset a forgotten password, to tell you when the security settings on your account change, and, for the alerts you switch on, to tell you when a filing matches a saved screen or something changes at a stock on your watchlist. No marketing, and nothing you did not ask for: an alert exists because you pressed a bell, and the same bell stops it.
  • Your country, as chosen from a list.
  • Your password, stored only as a one‑way hash. We cannot read it, and a forgotten password is reset rather than recovered.
  • Two‑factor authentication details, if you switch it on: a secret shared with your authenticator app, and the recovery codes issued with it, stored hashed.
  • Sign‑in records: when you last signed in, how many attempts have failed, and the IP addresses from which sign‑in attempts failed. This last one exists to limit brute‑force attempts and is kept for at most seven days.

Your watchlist. The stocks you put on it, when you added each, and which of its two alerts (insider trades, new numbers) you switched on.

Saved screens. A saved screen is a filter you built on one of the screeners, kept under a name you chose: which companies, which window, which minimum. It is a description of what you wanted to look at and not a record of what you looked at.

Your fair value assumptions, if you save your own for a company: the growth, years and discount rate you entered.

None of these is a history of your reading, and we do not attach one to your account. Each is deleted when you remove it, and all of them go when the account does. A screen or a watchlist stock with an alert switched on keeps two things more: how far through the filings and figures it has already told you, so that the same news is not sent twice, and when the last message went out.

Messages we have sent you. One line per email that left: which kind it was (a confirmation, a password reset, an alert) and when. Not the subject, not what was in it, and not the address it went to, which is on your account already. Two reasons, and neither is about you personally: it is what holds an alert to one message a day, and it is how we know how much mail this site sends before there is any question of charging for it. It goes when the account goes.

An account is stored until you close it. Closing it, from the account page, deletes your name, country, email address, password hash, two‑factor secret and recovery codes immediately; we keep no copy to restore from. We do not attach a record of what you read on the Website to your account.

Emails to your address are sent on our behalf by Mailjet (Mailgun Technologies / Sinch), acting as a processor. See section 7 on recipients and transfers.

3.4. Contact data (optional)

At this time we do not provide formal contact forms or newsletters. If you contact us voluntarily (e.g., via email in the future), we will process the data you provide (such as your name, email address and message content) solely to respond to your inquiry.

4. Purposes of Processing

We process personal data for the following purposes:

  • Website operation: enabling you to access and use the Website, including displaying content and ensuring technical delivery of web pages.
  • Website security: monitoring and protecting the Website against abuse, unauthorised access and other security incidents.
  • Keeping it working and making it better: reading the server's own logs to see what is slow, what is broken and what is being asked for, so that stability, performance and usability can be maintained and improved.
  • Knowing how the Website is read: the audience measurement in section 3.1 (how many people come, which pages they open, what sent them and roughly where they are), so that what is written and built next answers what is actually being read.
  • Telling you what you asked to be told: sending the email alerts you have switched a bell on for, on a saved screen or a stock on your watchlist, and the messages an account needs to work at all, such as confirming an address or resetting a password.
  • Communication (if applicable in the future): responding to messages or inquiries that you send us.

We do not use personal data to provide personalised investment advice, behavioural advertising or profiling for marketing purposes at this stage.

5. Legal Bases for Processing (GDPR)

Under the GDPR, we must have a legal basis for each processing activity. Depending on the specific context, we rely on:

5.1. Legitimate interests (Article 6(1)(f) GDPR)

For:

  • processing technical and usage data necessary to operate, secure and improve the Website;
  • the audience measurement described in section 3.1, which tells us how the Website is read;
  • keeping an account you asked us to create, and the sign‑in records that stop somebody else guessing their way into it.

We balance our interest in providing a functional, secure and improved Website against your privacy rights. We minimise the data collected and, where possible, use appropriate safeguards (such as IP address truncation, aggregation of statistics, and limited retention).

Why the analytics cookies are not put to you as a choice. Dutch law, in Article 11.7a(3) of the Telecommunications Act, does not require consent for cookies used to work out how a website is read, where the effect on privacy is slight. We rely on that exception, and what we rely on it for is the configuration set out in section 3.1, each part of which is a condition of it: the measurement is used for statistics about this Website and for nothing else, it is not joined to any other Google service and feeds no advertising profile, your IP address is truncated, nothing identifying you is sent, and no attempt is made to recognise who you are. Google Ireland Limited processes it on our instructions under a data processing agreement.

Should any of those cease to be true (were the measurement to be joined to an advertising product, or used to recognise a reader across websites), the exception would cease to apply with it, and we would ask for your consent first and say so here before anything changed. In the meantime you may object to the measurement, and refuse it outright, as section 6.3 describes; you do not have to give a reason for refusing it in your browser.

5.2. Consent (Article 6(1)(a) GDPR)

For the email alerts on a saved screen or a stock on your watchlist. Nothing is sent until you switch one on, one screen or one stock at a time, and switching it off is the same button in the same place. No alert is on by default and none can be turned on by us.

The audience measurement in section 3.1 does not rest on consent; section 5.1 says on what it does rest and why. If we use cookies or similar technologies that fall outside that exception (such as tracking cookies, advertising, or profiling for marketing), we will first obtain your explicit consent through a clear choice mechanism (e.g., a cookie banner with opt‑in options), in line with supervisory guidance and case law regarding tracking cookies.

5.3. Legal obligation (Article 6(1)(c) GDPR)

In specific situations, we may process or share data to comply with legal obligations, for example if required by a competent authority or court order.

6. Cookies and Similar Technologies

6.1. The ones we set

As set out in section 3.2, four at most, and no more:

  • insiderclue_member: the session cookie that keeps you signed in, set only on the pages where you sign in or register and while you are signed in. It is strictly necessary for that purpose and so does not require consent; we tell you about it anyway.
  • _ga and _ga_<property>: the two Google Analytics cookies, which hold a random number and let one reader's four pages be counted as one reader. Thirteen months, on this Website's own domain, Secure and SameSite=Lax. They are set for the statistics in section 3.1 and for nothing else, which is why section 5.1 does not ask you first.
  • wl_cols: the columns you chose for your watchlist, set only when you choose them, for a year. It stores a preference you asked for and so does not require consent.

The screeners also remember, for as long as the browser tab is open, whether you left the filter panel open or closed. That is kept in the tab's own session storage, never sent to us, and gone when the tab closes.

There is no advertising cookie, no cookie that recognises you on another website, and no cookie set by any party other than us and Google Analytics.

6.2. Future tracking cookies

If we ever introduce third‑party tracking cookies or similar tools that follow users across websites and build detailed profiles for advertising, we will:

  • obtain prior consent via a clear opt‑in mechanism;
  • provide detailed information about the tools used, their purposes and involved third parties;
  • offer options to withdraw consent at any time.

6.3. Managing cookies, and refusing the measurement

You can manage cookie preferences through your browser settings (blocking or deleting cookies, for one website or for all of them) and, where applicable, through tools we may implement in the future. Deleting the analytics cookies makes your next visit look like a first one; blocking them stops the measurement recognising a return at all. Neither affects anything you can read or do here: the Website works the same without them, and the sign‑in cookie is separate and unaffected.

Three further ways to refuse the measurement outright:

  • Google publishes a browser add‑on that turns Google Analytics off on every website you visit, at tools.google.com/dlpage/gaoptout.
  • Most browsers have a tracking‑protection or content‑blocking setting that stops the script loading. So does any of the common content blockers.
  • You may object to the processing under Article 21 GDPR, on grounds relating to your particular situation. See section 10.

7. Data Sharing and Transfers

7.1. Internal use

We do not sell personal data to third parties. Personal data is used only for the purposes described in this Policy.

7.2. Service providers

We may use third‑party service providers (for example: hosting and email delivery) to operate the Website. These providers may process personal data on our behalf and only in accordance with our instructions. Where required, we enter into data processing agreements that reflect GDPR requirements.

Two providers currently process personal data for us. The first is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which provides Google Analytics and processes what section 3.1 describes (the truncated IP address, the pages opened, the device and the approximate location) on our instructions, under Google's data processing terms. It is not permitted to use that measurement for its own purposes, and the account setting that would let it is switched off.

The second is Mailjet (Mailgun Technologies, part of Sinch), which delivers the emails sent to account holders: address confirmations, password resets, notices about changes to an account's security settings, and the alerts somebody has switched on for a saved screen or a stock on their watchlist. It receives the recipient's email address and name for that purpose. It is used for no other kind of message, and we do not send marketing email.

7.3. Legal requirements

We may disclose personal data if required to do so by law or in response to valid requests by public authorities (e.g., courts, supervisory authorities), to the minimum extent necessary.

7.4. International transfers

If personal data is transferred outside the European Economic Area (EEA), we will ensure that appropriate safeguards are in place, such as:

  • adequacy decisions by the European Commission;
  • standard contractual clauses approved by the European Commission;
  • other appropriate safeguards recognised under the GDPR.

One such transfer happens today. Our contract for Google Analytics is with Google Ireland Limited, but Google LLC in the United States may process the measurement on its behalf. Two safeguards cover it: Google LLC is certified under the EU‑US Data Privacy Framework, which the European Commission has found to offer an adequate level of protection, and Google's data processing terms also incorporate the European Commission's standard contractual clauses, which stand whatever happens to that finding. What is transferred is what section 3.1 lists, with your IP address already truncated and nothing in it that names you.

7.5. Access by us

An administrator of the Website can open it signed in as an account, so that a problem somebody reports can be seen the way they see it. Three things are true of that access and are built into the Website rather than promised about it:

  • it can only look. It cannot change the password, the email address, the country, the name, the second factor, or close the account. Every one of those is refused while it is in use;
  • it cannot read your password. Passwords are stored as a one‑way hash, so there is nothing there to read, and nothing in the Website can set one either;
  • it is recorded. Each use is written to the server log with the account it opened and the administrator who opened it.

It does not change when you last signed in, because you did not.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. This generally means:

  • Server logs and technical data: kept for a limited period (e.g., a few months) for security, troubleshooting and performance monitoring, unless longer retention is necessary in case of specific incidents.
  • Analytics data: kept by Google Analytics for two months, the shortest retention it offers, after which what remains is the aggregate report rather than the individual visit. The cookies that go with it expire thirteen months after your last visit; see sections 3.1 and 6.1.
  • Watchlist, saved screens and fair value assumptions: kept until you remove them, or until the account is closed.
  • Account data: kept for as long as the account exists. You can close your account at any time from the account page, which deletes it immediately and without a copy kept for restoration.
  • Failed sign‑in records: the IP address and the address that was tried, kept for at most seven days, solely to limit brute‑force attempts.
  • Confirmation and password‑reset links: valid for 24 hours and one hour respectively, and recorded as spent once used.

When data is no longer needed, we will anonymise or delete it in a secure way.

9. Data Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures may include:

  • secure hosting environment;
  • restricted access to logs and analytics;
  • encryption or pseudonymisation where appropriate;
  • regular monitoring of the Website’s security.

No system can be guaranteed as completely secure, but we continually strive to maintain an appropriate level of security.

10. Your Rights

Under the GDPR and applicable national laws, you may have the following rights with respect to your personal data:

  • Right of access: to request confirmation whether we process your personal data and to receive a copy of such data.
  • Right to rectification: to request correction of inaccurate or incomplete personal data.
  • Right to erasure (“right to be forgotten”): to request deletion of your personal data where legal conditions are met.
  • Right to restriction of processing: to request that we restrict processing in certain circumstances.
  • Right to data portability: to receive your personal data in a structured, commonly used and machine‑readable format, where legally applicable.
  • Right to object: to object to processing based on legitimate interests, including the audience measurement in section 3.1, on grounds relating to your particular situation. Section 6.3 sets out how to stop that measurement yourself, without waiting for us.
  • Right to withdraw consent: where processing is based on your consent (e.g., future tracking cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, you can contact us as described below. We may need to verify your identity before responding to your request.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

11. Contact

At this stage, InsiderClue does not publish formal contact details on the Website. If and when a dedicated contact email or form is introduced, this section will be updated to reflect how you can reach us for privacy‑related inquiries or to exercise your rights.

In the meantime, you may contact us through any official contact channel that becomes available on the Website.

12. Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time, with or without prior notice, for example to reflect changes in the Website, legal requirements or guidance from data protection authorities.

The most current version of this Privacy Policy will always be available on the Website. Your continued use of the Website after any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the updated Policy, you must stop using the Website.