Privacy Policy

This privacy policy explains how Kombi Capital Oy (business ID: registered in Finland, hereinafter "we", "us") collects, uses, and shares personal data when you use InsiderPulse (“the Service”). We are the data controller under the EU General Data Protection Regulation (GDPR).

Questions or requests regarding your personal data can be sent via the feedback form on our website.

1. Data we collect

We collect the following categories of personal data:

• Account data — your email address and name when you create an account or sign in via a third-party provider (e.g. Google).
• Usage data — pages visited, features used, browser type, device type, IP address, and approximate location, collected automatically when you use the Service.
• Preference data — companies you add to your watchlist and notification settings you configure.
• Payment data — billing information and subscription status processed on our behalf by Stripe. We do not store full card details.
• API credentials — hashed API keys you generate for programmatic access.
• Communication data — webhook URLs or email addresses you provide for push notifications.

2. Purposes and legal basis

We process your personal data based on your consent (Article 6(1)(a) GDPR) and, where applicable, to perform the contract with you (Article 6(1)(b) GDPR). The purposes for which we process data include:

• Providing and operating the Service, including account management and authentication.
• Delivering features you have requested, such as watchlists and push notifications.
• Processing subscription payments and managing billing.
• Analysing how the Service is used in order to improve it.
• Communicating with you about the Service, updates, or support requests.
• Complying with legal obligations.

Where we rely on consent, you may withdraw it at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

3. Cookies and tracking

We use Google Analytics (via Google Tag Manager) to collect aggregated usage statistics. This involves placing cookies on your device and transmitting data (including your IP address) to Google. You can opt out by using browser-level controls or a browser extension such as the Google Analytics Opt-out Add-on.

4. Service providers and data processors

We use trusted third-party service providers to operate the Service. Each acts as a data processor on our behalf under a data processing agreement:

5. International transfers

All service providers listed above are based in the United States. Transfers of personal data to the USA are made on the basis of the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework. By using the Service you acknowledge that your data may be transferred to and processed in the USA under these safeguards.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law (e.g. accounting records) or where it is contained in backups that are purged on a regular schedule.

7. Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your personal data (“right to be forgotten”).
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, contact us via the feedback form on our website. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

8. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS), hashed storage of credentials, and access controls. No method of transmission over the internet is completely secure, however.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified by updating the “Last updated” date at the top of this page. Continued use of the Service after a change constitutes acceptance of the updated policy.

10. Contact

Kombi Capital Oy
Y-tunnus: 3010906-6
Finland
Email: hello@insiderpulse.io