Legal

Privacy Policy

What we collect

We collect only the minimum information needed for the service to function:

Account data: your username, email address, and a salted hash of your password. We also record the time of your last login and the country and city it came from (no IP address is stored), for account security.
Usage data: your membership dates, the reports you open, and the payment reference from Stripe.
Security audit data: server IP address and request timestamps for fraud prevention and security audit logs.
Analytics: aggregated, cookie-free page-view statistics (no personal identifiers are stored in raw logs for more than 90 days).

How we use your data

To create and authenticate your account.
To process membership payments through Stripe (see Terms of Service, section 4).
To keep an audit record of membership payments, refunds and changes.
To send you email notifications (receipts, account security alerts) - never marketing newsletters unless you explicitly subscribe.
To send new report alerts if you subscribe with your email address. You confirm the address first, and every alert has an unsubscribe link. Subscriptions are removed when you unsubscribe.
To monitor and protect the security of our service.

Cookies

We use only an essential session cookie (MFC_SESSION) for authentication and a preference cookie for the cookie banner. We do not use tracking, advertising, or analytics cookies. See our full Cookie Policy for details.

Payments

Card payments are processed by Stripe Payments Ltd. We do not store card numbers. Stripe handles its own privacy and cookie notices - you can review them on Stripe's website.

Data retention

We retain account and transaction data for as long as your account is active and for at least the period required by accounting regulations. Audit logs and security-relevant data (IP addresses, request timestamps) are retained for 90 days. You may request account deletion at any time.

Your rights

Under applicable data protection laws (including the GDPR), you have the right to:

Know what personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (subject to accounting and audit retention requirements).
Object to or restrict certain processing.
Export your data in a portable format.
Lodge a complaint with a data protection authority.

Payment and transaction history must be kept for accounting and audit purposes, so we cannot fully delete those records until the legally required retention period expires.

Contact

Use the contact form for any privacy request, or email [email protected]. We aim to respond within 30 days.

International transfers

Data may be transferred to and processed in countries outside your residence, including the European Economic Area and the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for such transfers.

Last reviewed: November 1, 2026.