Privacy Policy
What Hesper Atlas collects, why, who processes it, and the rights you have over your data.
This policy explains how we, the data controller for Hesper Atlas, handle your personal data. The short version: we collect the minimum needed to run an account-based subscription service, we use only essential first-party cookies, and we never sell your data.
1Data we collect
| Data | Where it comes from |
|---|---|
| Email address | You, when you create an account. Used to sign you in and to contact you about your account. |
| Password (hash only) | You, at signup. We store only a salted cryptographic hash, never the password itself. |
| Subscription status | Stripe, our payment processor. We store your plan, billing period, and a Stripe customer reference. We never see or store your full card number. |
| Favorites / watchlist & app settings | You, as you use the app (e.g. starred tickers, theme preference, portfolio capital input). |
| Telegram chat ID (optional) | You, only if you connect Telegram to receive daily alert pushes. Removable at any time in Settings. |
| API key metadata (optional) | You, if you create a key for an AI agent: its label, non-secret display prefix, creation and last-used times, and call count. We store only a cryptographic hash of the full key and show the secret once when it is created. |
| OAuth agent connections (optional) | You and the client you choose: the client name, registered redirect URLs, connection and last-used times, authorized signals:read scope, and token-family metadata. Authorization codes, access tokens and refresh tokens are opaque and stored only as cryptographic hashes. They are never shown on your account page. |
| Partner details (optional) | You, only if you join our partner (affiliate) program: your legal name, country, and payout method (e.g. PayPal or bank details), needed to pay commissions and meet tax-reporting duties. Not collected for ordinary accounts. |
| Server and MCP request logs | Automatically: IP address, timestamps, requested paths, user-agent, status and response time. For MCP calls, application telemetry may also record the declared client name/version, protocol operation, selected tool and anonymous/API-key/OAuth access tier. It does not write the surrounding prompt or tool arguments to application telemetry logs. |
When you connect Hesper Atlas through an external AI agent, that provider processes your conversation under its own privacy policy. Hesper Atlas normally receives only the MCP tool request the agent selected and the small typed arguments required by that tool, not the surrounding conversation. The request is processed to return the answer; only the metadata described above is retained in application telemetry.
Unless you join the partner program, we do not collect names, addresses, government IDs, brokerage credentials, or holdings data, and we do not track you across other websites.
2Purposes & legal bases (GDPR)
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the service: account login, watchlists, signals, API access, subscription management, billing | Contract (Art. 6(1)(b)), needed to deliver what you signed up for. |
| Sending daily alerts via Telegram | Contract / consent: this feature runs only if you opt in; disconnecting Telegram stops the processing. |
| Security, abuse prevention, debugging (server logs) | Legitimate interests (Art. 6(1)(f)): keeping the service secure and working. |
| Tax and accounting records of payments | Legal obligation (Art. 6(1)(c)). |
| Service emails about material changes to terms, prices, or this policy | Contract / legal obligation. We do not send marketing emails without separate consent. |
3Processors & recipients
We share data only with the processors needed to run the service, under data-processing agreements:
- Stripe: payment processing and subscription billing. Stripe is an independent controller for payment data; see Stripe's own privacy policy.
- Hosting provider: Render (render.com), runs the servers and database where account data is stored.
- Resend (resend.com): sends our transactional and service email (sign-in links, verification, password resets, the daily digest, and partner notices). Resend processes the recipient email address and message content to deliver it.
- Telegram: delivers alert messages, only if you connect it. Telegram receives the message content (ticker signals) at your chat ID, under Telegram's own terms.
- Off-site backup storage: an S3-compatible object-storage provider holds encrypted database backups for disaster recovery. Backups are encrypted before they leave our server, so the provider stores only ciphertext.
Where a processor is located outside the EU/EEA, transfers rely on appropriate safeguards such as EU Standard Contractual Clauses or an adequacy decision.
An AI client or agent that you independently choose is not a Hesper Atlas processor. Review that provider's privacy and retention terms before sending it personal or confidential information.
We do not sell or rent personal data, and we do not share it with advertisers or data brokers. We disclose data beyond the processors above only if legally required (e.g. a valid court order) or in a business transfer, in which case this policy continues to apply.
4Retention
- Account data (email, password hash, watchlist, settings, Telegram ID, API-key metadata, and OAuth agent-connection metadata): kept while your account exists; OAuth access tokens expire after one hour, refresh tokens after 30 days, and revoked or expired token hashes may remain for up to 90 additional days to detect replay. Deleting the account removes its live OAuth codes, connections and tokens immediately; the remaining account data is deleted from our live systems within 30 days.
- Encrypted backups: deleted account data may persist in encrypted, access-restricted disaster-recovery backups until they rotate out, within 12 months. It is not restored to live systems except to recover from a failure.
- Billing records: kept as long as required by tax and commercial law (typically up to 10 years, depending on jurisdiction), even after account deletion.
- Server logs: rotated and deleted after a short period (typically 30 to 90 days), unless needed for an ongoing security investigation.
- Aggregate MCP adoption counters: daily counts by access type, normalized client family, operation, selected tool and HTTP outcome are kept for up to 400 days. Unknown client names are grouped as “other,” so raw caller-supplied client names are not retained in this table. The counters contain no user id, email, IP address, prompt, arguments or response body.
5Your rights
If you are in the EU/EEA or UK (and in many other jurisdictions), you have the right to:
- Access: get a copy of the personal data we hold about you;
- Rectification: correct inaccurate data (e.g. change your email);
- Erasure: delete your account and data ("right to be forgotten"), subject to legal retention duties for billing records;
- Portability: receive your data in a structured, machine-readable format;
- Restriction & objection: restrict or object to processing based on legitimate interests;
- Withdraw consent: at any time, for consent-based processing (e.g. disconnect Telegram), without affecting prior processing;
- Complain: lodge a complaint with your local data-protection authority.
To exercise any of these rights, email support@hesperatlas.com. We respond within one month.
6Cookies
Hesper Atlas uses first-party cookies only:
- a session cookie, strictly necessary to keep you signed in: an opaque session identifier, nothing else;
- a referral-attribution cookie, set only if you arrive through a partner link (a
?ref=URL). It stores that partner's code so we can credit them if you later subscribe, and it expires after 90 days. It is first-party, is not used for advertising, and does not track you across other sites.
We use no advertising trackers, no analytics cookies, and no third-party tracking pixels. Locally stored preferences (such as your light/dark theme choice) stay in your browser and are never transmitted to us.
7Security
Passwords are stored only as salted hashes. Full API-key secrets, OAuth authorization codes, access tokens and refresh tokens are stored only as cryptographic hashes; OAuth uses PKCE S256, exact resource binding and refresh-token rotation. Traffic is encrypted in transit with TLS and access to production data is restricted. No internet service can guarantee absolute security. If a breach affects your personal data, we will notify you and the competent authority as required by law.
8Children
The service is not directed at children and may not be used by anyone under 18. We do not knowingly collect data from minors; if you believe a minor has created an account, contact us and we will delete it.
9Changes to this policy
We may update this policy as the service evolves. The "Last updated" date above always reflects the current version, and we will notify you (by email or in-app notice) before material changes take effect.
10Contact & data controller
Data controller: Hesper Atlas, Zurich, Switzerland.
Privacy contact: support@hesperatlas.com