Privacy Policy

This policy explains what personal data Gapbell collects, why, and what your rights are.

1. Who is responsible

The controller of your personal data is:

• Operator: Mykyta Melnyk
• Address: Warszawa, Mokotów, Poland
• Contact: gapbellcom@gmail.com

2. What we collect

• Account data. Your email address and, if you sign in with Google, GitHub or Discord, your name and profile picture from that provider. If you sign up with a password, we store only a salted hash of it, never the password itself.
• Subscription data. Whether you have a Pro subscription, its status and renewal date, and your Stripe customer ID. Card details are entered on Stripe's page and never reach us.
• Alerts. The alerts you create (symbols, price levels, keywords), the notifications they produce (kept for 30 days), and, if you turn them on, your browser's push subscription and whether you want alerts by email.
• Morning brief. Only if you subscribe, in Settings or from the card on the site: the fact that you subscribed and the date of the last email sent to you. If you subscribe without an account we keep your email address, the time you confirmed it and the same date, and delete the address when you unsubscribe.
• Where you came from. If you arrive through one of our campaign links or from another website, we keep the campaign name or the site's address for up to 30 days and, if you then create an account, store it with the account so we can see which channels work. This applies only to visitors outside the EEA, the United Kingdom and Switzerland.
• Upgrade steps. For signed-in accounts, which pricing or locked pages you opened and when you started or completed checkout, so we can see where people stop before upgrading.
• Technical data. Your IP address and request details in server logs and for rate limiting, to keep the Service secure and running.
• Data on your device. Watchlists, saved screens and display preferences are stored in your browser, not on our servers.

3. Why we use it, and on what basis

• To create your account and provide the Service, including your subscription (performance of a contract).
• To check your alerts and notify you when they fire, in the app and by browser push (performance of a contract).
• To send you the weekday morning brief, only if you subscribe and confirm your address (your consent, which you can withdraw at any time from Settings or the link in each email).
• To email you your alerts, only if you turn that on and confirm your address (your consent, which you can withdraw at any time from the alerts page or the link in each email).
• To keep the Service secure and prevent abuse (our legitimate interest).
• To learn which campaigns and websites bring people to Gapbell, so we spend on what works (our legitimate interest).
• To learn where people stop before upgrading to Pro, so we can improve the Service (our legitimate interest).
• To keep accounting and tax records for payments (a legal obligation).

We do not sell your data, and we do not build advertising profiles.

4. Who we share it with

These providers process data on our behalf, only to deliver the Service:

• Vercel, which hosts the Service.
• Neon, which hosts our database.
• Stripe, which processes payments and handles billing.
• Google, GitHub and Discord, only if you choose to sign in with them.
• The push service of your browser (for example Google, Apple, Mozilla or Microsoft), only if you turn on browser notifications; it relays the alert text to your device.
• Resend, which sends our emails (sign-up confirmations and, only if you turn them on, alert emails and the morning brief).

The “Ask AI” buttons open Claude (Anthropic) or Perplexity in a new tab, with a question about the page you are on already written in. That question holds market information shown on the page, such as a price, a headline or an economic event, and nothing about you. It goes from your browser to the service you choose, not through us; we cannot see your chat, and that service's own terms and privacy policy apply from there.

Some of these providers are based outside the European Economic Area. Where personal data is transferred there, it is protected by the safeguards these providers offer, such as standard contractual clauses.

5. Cookies

We use an essential cookie to keep you signed in. Outside the EEA, the United Kingdom and Switzerland we also set one first-party cookie (gb_attr, 30 days) when you arrive through a campaign link or another website, to measure which marketing works; it holds only the campaign or website name and is removed when you create an account. We do not use third-party advertising or tracking cookies.

6. How long we keep it

Account data is kept until you delete your account. Payment records are kept for as long as accounting and tax law requires. Server logs are kept for a short period.

7. Your rights

Under the GDPR you can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interest. Contact us using the details above. You also have the right to complain to your data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).

8. Changes

We will update this page if our practices change and show the date at the top.