Privacy Policy
Stock Broker Analyzer AI Agent — effective from launch, July 2026
1. Controller
The data controller for this service is the operator listed in our Imprint, which also lists our contact details.
2. What we collect
- Account data: email address and hashed authentication data and session records. If you also use mCoreBrain services with the same email address, the services may use the same underlying authentication infrastructure, but Stock Broker Analyzer account activity remains separated at application level.
- Usage data: your selected country, login timestamps, and refresh-analysis requests
- Payment data: transaction records (amount, currency, status, date) for each paid refresh. Card details are handled entirely by our payment processor — we never see or store your card number
- Generated documents: any PDF analysis you download, and when you downloaded it
- Security data: sign-in verification codes (hashed, never stored in plain text) and a security/audit log of account events (e.g. logins, payments)
- Technical logs: limited server, security, and error logs such as IP address, browser/device metadata, request timestamps, and error events, used only for security, abuse prevention, debugging, and service reliability.
3. What we do not collect
- No name, phone number, or address — signup only asks for email and password
- No brokerage account details, holdings, or trading history — this service analyses public broker information, not your personal investments
- No card or bank details — entered directly into Stripe, never touch our servers
- We do not use your data to generate personalised financial recommendations
4. Who we share data with (sub-processors)
We do not sell your data or share it with third parties for marketing or advertising purposes.
5. Newsletter / update emails (opt-in)
You can optionally subscribe to occasional emails about new features and updates from the footer of this site. We only ask for your email address for this — nothing else. This uses double opt-in: after you submit your address, we send one confirmation email, and you are only added to the list once you click the confirmation link — this stops anyone subscribing an address that isn't theirs.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by clicking the unsubscribe link included in every update email, or by simply not confirming the initial email. Your address is kept only for as long as you remain subscribed, and is deleted once you unsubscribe. If we later move this list to a dedicated email-marketing platform, this notice will be updated to name that processor before the move happens.
6. International data transfers
Your account and analysis data is stored in the EU (Supabase, AWS region eu-north-1, Stockholm). Some sub-processors above (e.g. our payment processor and email delivery provider) are global providers that may process data outside the EU/EEA. Where that happens, it takes place under appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
7. Automated processing
Broker scores are computed automatically from fixed criteria, but this scoring is about brokers, not about you — it does not evaluate you personally, and it does not produce any automated decision with legal or similarly significant effect on you within the meaning of Art. 22 GDPR.
Those broker scores are produced by AI-agent technology from public sources only, and can contain errors — see the AI-generated content and liability disclaimer in our Terms of Use for details.
8. Cookies & local storage
We do not use third-party advertising or tracking cookies. Your login session is kept in your browser's local storage (not a cookie), and your language preference is stored the same way, purely to operate the service.
9. Legal basis & retention
Processing is based on contract performance (Art. 6(1)(b) GDPR) for account and payment data, legal obligation (Art. 6(1)(c) GDPR) for tax/bookkeeping retention of payment records, and legitimate interest (Art. 6(1)(f) GDPR) for security, fraud-prevention, and service-usage records.
Payment records are retained per German tax-law retention requirements regardless of account status. Other account data is retained for the life of your account and deleted or anonymised on request — see "Account deletion" below.
Technical and security logs are retained only as long as necessary for security, debugging, fraud prevention, and legal protection, and are then deleted.
10. Account deletion
You can permanently delete your account from the dashboard at any time. This removes your analyses, dashboard data, and account details from our active systems immediately. We may retain limited records where legally required — for example payment, invoice, tax, fraud-prevention, security, or legal records — for the legally required retention period only. See our Terms of Use for details.
11. Your rights
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interest. Contact info@mcorebrain.com. You may lodge a complaint with your national supervisory authority; as our operator is based in Berlin, the competent German authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
12. Changes to this policy
We may update this policy as the service evolves. Material changes will be reflected here with an updated effective date.