Privacy statement

What we keep about you

• Newsletter. Your email address and the date you signed up, plus a confirmation code, an unsubscribe code and the current state (pending, confirmed, unsubscribed). Nothing else: no name, no IP address, no profile.
• Account. If you create an account, our authentication service stores your email address and an internal identifier. Setting a password is optional: with one, that same service also stores a hashed form of it, which neither we nor anyone else can read back; without one, a sign-in link is the way in.
• Your profile. What you fill in or choose yourself: your first and last name, your role and how you found us (if you answer those), your currency, whether you want email from us and the moment you said so, and the moment you accepted the terms. The site adds a few things to make the dashboard work: its layout, when you last visited it, and whether you have seen the short tour.
• API keys and connected apps. If you create an API key we keep a hashed form of it and its first characters (so you can tell your keys apart), when it was made and last used, and a log of the requests made with it: when, which endpoint, the question asked and how many rows came back. If you connect an AI app to your account we keep that connection until you disconnect it.
• CSV exports. Each export is logged against your account (when, and which list), to keep the daily limit.
• Subscription. If you have access to the paid pages we keep one record against your account identifier: whether it is active, which plan, until when, and where that answer came from. No amount, no payment details, no card, no invoice — those live with whoever handles the payment, and today that is nobody: access is granted by hand while the payment method is being chosen. Reading it is something only you and we can do, enforced by the database and not by our code.
• Send log. Per newsletter sent we record that you received it, so you do not get it twice. That hangs off your subscription record and is deleted as soon as you unsubscribe, when you delete your account, or when you ask us to by email.
• Watchlist. If you follow a company we keep three things: your internal account identifier, that company’s identifier (the LEI from the public register) and the moment you started following it. No notes, no reading behavior, no history of what you looked at. Only you can retrieve your own watchlist; that is enforced in the database itself, not just in the code.
• Filing alerts. These are off unless you switch them on yourself, on your account page. Once on, we keep four things: your account identifier, the address to deliver to, that the setting is on and since when. Per alert we then record that a particular filing went to you — that is what guarantees the same filing never reaches you twice. No email address is stored in that ledger, and it holds nothing beyond your identifier, the filing and the moment. Every alert has an off switch that needs no sign-in and leaves your newsletter untouched.
• Fund managers you follow. If you follow a manager on the fund filings pages we keep the same three things: your internal account identifier, that manager’s identifier (the CIK the US SEC issues) and the moment you started following. One entry per manager, not per SEC filer identity. Only you can retrieve your own list, and that is enforced in the database itself.
• Fund filing alerts. A separate setting with a separate off switch, off unless you switch it on yourself. What we keep is exactly what is listed under Filing alerts above: the same four things, and a ledger that records only that a particular SEC filing went to you, without your email address.
• Members of Congress you follow. If you follow a member on the investors pages we keep the same three things: your internal account identifier, that member’s identifier (the key the House Clerk’s filings are published under, which is also the address of their page here) and the moment you started following. One entry per member, not per district: a member who moves district keeps the same entry. Only you can retrieve your own list, and that is enforced in the database itself.
• Congressional filing alerts. A separate setting with a separate off switch, off unless you switch it on yourself. What we keep is exactly what is listed under Filing alerts above: the same four things, and a ledger that records only that a particular filing went to you, without your email address.
• Your watchlist in the newsletter. If you have an account and follow companies, your newsletter opens with a block about those companies. For that we link your subscription to your account identifier and read your watchlist. Not a single new data point is added, and that block consists solely of facts that are visible to everyone on the site too, at the same moment. If you follow nothing, or have no account, you get exactly the same email as everyone else.
• Tying your subscription and your account together. If you first signed up without an account and later sign in with the same email address, we record your account identifier on that subscription. That lets you manage it from your account page and makes the block above work. No data point is added: that field already existed and had simply stayed empty. It only happens on an exact match of the email address — which the sign-in link proved you own — and never on a subscription that already belongs to someone else. If you would rather not have that link, you can unsubscribe from the newsletter on your account page or delete your account.
• Your portfolio. If you import a transaction export from your broker on My portfolio, we keep the file’s rows as you uploaded them (so a better reader can read them again without a new upload), and each buy and sell from it: date and time, product, ISIN, exchange, quantity, price, currency, the amounts in EUR, costs and the order number. With each import we keep the broker, the file name, a checksum of the file and when you uploaded it. Your positions are calculated from this; they are not stored separately. Only you can retrieve your portfolio, and that is enforced in the database itself. It is not used for anything else: not in the newsletter, not in alerts, not in the API, and not shown to anyone.

What we don’t do

• No tracking cookies. The register and the ranking work without a single cookie. Only when you sign in do we set a cookie that keeps you signed in — that is not tracking.
• No advertising, no tracking, no reselling.
• Counting visits and measuring speed. Our host, Vercel, counts page views and measures how fast pages load (Vercel Web Analytics and Speed Insights). Neither sets a cookie or stores anything in your browser. What is recorded is the page (its address without anything after the question mark, except a short source tag such as “utm_source=x” on links in our own posts, with a six-character tag that says which of our posts was clicked, not who clicked it), the referring site, the type of device and browser, and the country; a visitor is recognized only within one day, through a hash that is discarded after 24 hours. Nothing of it is linked to your account, and we cannot see who you are in it.
• No supplementing the names from the register with data from elsewhere. What you see is what the AFM publishes.

Why we are allowed to keep it

We use your email address only to send the newsletter you signed up for, or to make your account work. The legal basis is your consent (you confirm the sign-up yourself) for the newsletter, and performance of the service for your account. We send no email other than the one you asked for. Within that, we use your watchlist for two things, both of which you switch on yourself: starting your newsletter with the companies you chose, and — if you turn on filing alerts — telling you when a new filing at one of those companies becomes visible. The managers you follow are used for one thing, which you also switch on yourself: telling you when one of them files a new 13F. The members of Congress you follow are used for that same one thing, also only if you switch it on: telling you when one of them files a new report. Nothing else, and never about a company, a manager or a member you do not follow. Your portfolio is used for one thing: showing it to you on My portfolio, with every buy and sell kept with its date, so that later figures on the page can look back.

Who else sees it

Supabase (the database and the sign-in), Resend (delivering the mail), Vercel (hosting the site, its server logs and the visit counting described above), GitHub (runs the job that sends the newsletter) and Oracle Cloud (the server that sends the filing alerts). They process your data on our instructions and not for themselves. Some of them are based outside the European Economic Area, mainly in the United States; data that leaves the EEA does so under each provider’s data processing terms.

How you delete everything

• Unsubscribe from the newsletter: every email has an unsubscribe link at the bottom. No sign-in needed. The send log goes at once; the subscription record itself (your address and that you unsubscribed) is deleted 12 months after you unsubscribe. A sign-up you never confirmed is deleted after 30 days.
• Stop following one company: remove it from your list under Account settings → Following, or with the button on the company page. The row is deleted, not flagged.
• Stop following one manager: remove it from the list onAccount settings → Following, or with the button on the manager’s page. The row is deleted, not flagged.
• Stop following one member of Congress: remove them from Account settings → Following, or with the button on that member’s page. The row is deleted, not flagged.
• Stop the filing alerts: the off switch at the bottom of every alert, or the button on your Account settings → Notifications. The three kinds — companies, fund managers and members of Congress — have their own switch and their own off link, none of them touches another, and none of them touches your newsletter.
• Delete your portfolio: the button “Delete my portfolio” on My portfolio. Every import, with its rows, and every transaction is deleted at once, not flagged. That works with or without a subscription.
• Delete your account and everything attached: sign in and choose “Delete account” on your account page. That immediately erases your account, your profile, your subscription, everything you follow, every alert setting and every send history — including the ledgers, which the pipeline itself never deletes from — and your API keys, their request log, your export log and your portfolio. Your own request stands above that rule.
• Prefer email? Send a request to support@insiderradar.nl and we will delete your data.

Your rights

You have the right to access your data, to correct it, to have it deleted, and to withdraw your consent. You can download what we keep about your account yourself with “Download my data” on your account page. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Questions? Email support@insiderradar.nl.

Who is responsible

Data controller: InsiderRadar
Contact: support@insiderradar.nl