1. Introduction
This Privacy Policy describes how SHB Terminal ("Company", "we", "us", or "our") collects, uses, stores, and shares your personal information when you use the SHB Terminal platform and related services ("Service").
This policy applies to all users of SHB Terminal worldwide. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.
This Privacy Policy is GDPR-compliant for users in the European Union and CCPA-compliant for residents of California. Where applicable, your additional rights under these laws are described in Section 6.
2. Information We Collect
We collect the following categories of information:
- Full name (provided during registration)
- Email address
- Password — stored as a secure bcrypt hash. We never see or store your plaintext password. Authentication is managed by Clerk.
- Subscription status and billing history (transaction IDs only — see Payment Data below)
- We do not store your payment card number, CVV, or bank details at any point.
- All payment processing is handled by Lemon Squeezy, our Merchant of Record. Lemon Squeezy stores your payment information under PCI-DSS Level 1 compliance.
- We receive only a transaction ID, subscription status, and renewal date from Lemon Squeezy.
- Pages visited and features used within the platform
- Search queries entered (stock tickers, company names)
- Watchlist contents and portfolio journal entries you choose to save
- Trading journal entries and broker CSV files you upload
- Session duration and frequency of use
- IP address and approximate geographic location (country/city level)
- Browser type, version, and language settings
- Operating system and device type
- Referral URL and entry page
- Error logs and crash reports
3. How We Use Your Information
We use the information we collect exclusively for the following purposes:
- Service delivery: To authenticate you, maintain your account, and provide the features you have subscribed to.
- AI personalisation: To generate personalised AI insights, trade ideas, and coaching feedback based on your journal entries and watchlist.
- Billing & payments: To manage your subscription via Lemon Squeezy, send billing confirmations, and handle renewals and cancellations.
- Service improvement: To understand how the platform is used, identify and fix bugs, and prioritise new features.
- Communications: To send account-related emails (receipts, password resets, policy updates) and, with your consent, product newsletters.
- Security: To detect, prevent, and respond to fraud, abuse, and security incidents.
- Legal compliance: To meet obligations imposed by applicable law and respond to lawful requests from authorities.
4. Third-Party Services
SHB Terminal integrates the following third-party services to deliver the platform. Each provider processes data as described and has their own privacy policy.
Handles all payment processing, tax calculation and remittance, and subscription management. Lemon Squeezy is the Merchant of Record, meaning your purchase is legally with Lemon Squeezy. They store your payment card details under PCI-DSS Level 1 compliance. We share your email address for invoice delivery.
Manages user registration, login, session management, and multi-factor authentication. Clerk stores your email and hashed password. We do not have access to your plaintext credentials.
Powers AI stock analysis, trading coach features, and natural-language insights. Queries sent to Anthropic may include stock ticker symbols and anonymised journal data, but never your name, email, or payment information. Anthropic does not use API queries to train their models.
Provides real-time stock prices, earnings data, analyst estimates, and market news. Only your server-side API requests are sent to Finnhub — no personal data about you is transmitted.
Provides financial statements, ratios, discounted cash flow data, and SEC filing information. Only server-side API requests are sent — no personal user data is transmitted.
Hosts the SHB Terminal web application. Vercel processes server request logs that may include IP addresses and HTTP request metadata. Vercel's infrastructure is SOC 2 Type 2 certified.
5. Data Retention
We retain your personal data for as long as your account is active. The following retention rules apply:
To request early deletion of your account and all associated personal data, email privacy@shbterminal.com with the subject line "Account Deletion Request".
6. Your Rights (GDPR & CCPA)
Depending on your jurisdiction, you have the following rights regarding your personal data. We honour these rights for all users, regardless of location.
Request a copy of all personal data we hold about you, in a readable format.
Request permanent deletion of your account and all associated personal data (right to erasure / right to be forgotten).
Receive your account data (watchlists, journal entries) in CSV or JSON format.
Request correction of inaccurate or incomplete personal information we hold about you.
Opt out of marketing emails at any time via the unsubscribe link in any email, or by emailing us. You cannot opt out of transactional emails (receipts, security alerts).
Withdraw any consent you have given for optional data processing at any time, without affecting the lawfulness of prior processing.
EU residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.
California residents (CCPA): We do not sell your personal information. You have the right to know what personal information is collected, the right to delete, and the right to non-discrimination for exercising your rights.
8. Security
We implement industry-standard security measures to protect your personal data:
- All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
- Passwords are stored as bcrypt hashes with a work factor of 12 — we never see your plaintext password
- Authentication sessions are managed by Clerk with support for multi-factor authentication (MFA)
- Payment data is handled exclusively by Lemon Squeezy under PCI-DSS Level 1 compliance — we never touch card details
- Access to production databases and user data is restricted to authorised personnel on a strict need-to-know basis
- We conduct regular security reviews and promptly patch known vulnerabilities
No method of data transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. If you discover a security vulnerability, please disclose it responsibly to security@shbterminal.com.
9. Children's Privacy
The Service is not directed at, and is not intended for use by, persons under the age of 18. We do not knowingly collect personal data from children under 18.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@shbterminal.com. We will promptly delete any personal data collected from a child upon verified request.
10. Contact Information
For any privacy-related questions, requests, or concerns, please contact us using the appropriate channel below. We aim to respond to all enquiries within 5 business days.