This Privacy Policy explains how Foremetrics collects, uses and protects your personal data when you use the Foremetrics website and web application (the "Service"), and describes your rights under the EU General Data Protection Regulation (GDPR) and Dutch data-protection law. Capitalised terms not defined here have the meaning given in our Terms of Service. By using the Service you acknowledge this Privacy Policy. Where the law requires consent (for example for non-essential cookies or marketing communications) we ask for it separately, and you can withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
1. Who we are (data controller)
The controller responsible for your personal data is Foremetrics, a sole proprietorship established in the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42054682, with registered address at Le Mairekade 77, 1013 CB Amsterdam, the Netherlands.
For any privacy question or to exercise your rights, contact us at privacy@foremetrics.ai.
2. Personal data we collect and where it comes from
Depending on how you use the Service, we process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account & profile | User ID, email address, display name, profile picture, base currency, theme, trial start/end timestamps, subscription status and expiry, marketing opt-in choice, cash balance used in the portfolio, notification preferences, role assignment and timestamps for acceptance of the Terms and Privacy Policy (incl. version). | You; authentication provider identifiers (Google OAuth, magic-link email). |
| Subscription & billing | Subscription status and expiry, trial end date, trial-reminder tracking, plan, billing interval. Card and bank details are entered directly with Stripe and are not stored by us. | Stripe |
| Your content (Client Data) | Portfolio holdings (ticker, name, exchange, shares, cost basis), watchlist, price alerts (ticker, condition, threshold), saved DCF/projections (bear/base/bull cases) and wealth-tracker monthly entries (invested capital, balances, savings and current account figures). | You |
| Feedback & support | Feedback you submit and any correspondence with us, including support messages, attachments and related metadata when you contact us. | You |
| Notifications | In-app notification status and alerts generated for you (such as earnings, news, price alerts and account/billing notices). | You; the Service |
| Email deliverability | Bounce and suppression data so we do not email addresses that have failed or opted out. | Email provider |
| Technical data | Limited technical and log data (such as IP address and security logs) needed to operate and secure the Service. | Automatically |
| Affiliate data (only if you join the affiliate programme) | Referral code, payout method and payout details, referral and commission records, and per-click metadata. | You; the Service |
We do not intentionally collect special categories of personal data, and you should not enter such data into the Service. The Forecaster and Risk Analyzer run locally in your browser (TensorFlow.js); the data they use does not leave your device.
3. Why we use your data and our legal bases
| Purpose | Detail | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide the Service | Create and manage your account, authenticate you, and deliver the features you use (portfolio, watchlist, alerts, wealth tracker, DCF/projection scenarios, notifications) and provide customer support. | Performance of a contract (Art. 6(1)(b)) |
| Subscriptions & payments | Manage trials, billing, renewals and access via Stripe. | Contract (Art. 6(1)(b)) |
| Transactional emails | Send service messages such as sign-in links, trial and renewal reminders and account notices, billing messages, and price alerts and earnings/news notifications you have subscribed to via your watchlist or portfolio. | Contract (Art. 6(1)(b)) |
| Accounting & tax | Keep invoices and business records. | Legal obligation (Art. 6(1)(c)) |
| Security & abuse prevention | Protect the Service and users, prevent fraud and abuse, and keep the Service reliable. | Legitimate interests (Art. 6(1)(f)) |
| Affiliate programme | Operate the affiliate/referral programme: attribute referrals (via the affiliate cookie), record referrals and commissions, and pay affiliates. | Contract with the affiliate (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Improve the Service & handle feedback | Understand and improve how the Service works and respond to your feedback. | Legitimate interests (Art. 6(1)(f)) |
| Marketing & re-engagement | Send newsletters or re-engagement emails (including to former or expired-trial users). | Consent (Art. 6(1)(a)); or legitimate interests with opt-out |
| Review invitations | After you start a subscription, share your email address with Trustpilot so they can invite you to review the Service. Review invitations are separate from service emails. | Legitimate interests (Art. 6(1)(f)) |
Providing your account data is necessary to use the Service; without it we cannot create or operate your account. Where we rely on consent (for example marketing emails or non-essential cookies), you can withdraw it at any time without affecting prior processing. Where we rely on legitimate interests, you may object as described in section 9.
4. AI features and your data
Some features use artificial intelligence. We have designed these to limit the personal data involved:
- On-device models. The Forecaster and Risk Analyzer run entirely in your browser; no data is sent to us or to any AI provider for these.
- Server-side AI. Other AI requests are routed through the Lovable AI Gateway (in the EU) to Google Gemini and, as a fallback, OpenAI. Only the prompt content a feature needs (such as ticker symbols, public financial figures and your question text) is sent. We do not send your email, name, billing identifiers, identity-linked holdings or login tokens.
- No training on your inputs. Inputs you provide to AI features are sent to Google (Gemini) and/or OpenAI through the Lovable AI Gateway for the sole purpose of generating a response. Under the contractual terms between Lovable and these providers, your inputs and the generated outputs are not used to train their foundation models. Providers may retain request data for a short period (typically up to 30 days) for abuse monitoring and security, after which it is deleted.
As a precaution, please do not enter personal, confidential or sensitive information into any AI feature. AI outputs are provided for general information only and are not investment advice — see the disclaimers in our Terms of Service.
5. Cookies
The Service uses only first-party cookies, which we group as follows: (i) strictly necessary cookies — authentication and session cookies required to operate the Service (no consent required); (ii) functional cookies (remembering preferences such as your theme or last selected ticker); and (iii) a first-party affiliate-tracking cookie, retained for 60 days. With your consent only, we also use Google Analytics (loaded via Google Tag Manager, provided by Google Ireland Ltd.) to measure how the Service is used. Analytics and advertising storage is denied by default (Google Consent Mode v2) and is enabled only if you click "Accept" in the cookie banner; you can change your choice at any time via "Cookie settings". We do not use advertising cookies. Full details are set out in our separate Cookie Notice. You can manage or delete cookies in your browser settings at any time; disabling strictly necessary cookies may prevent the Service from working correctly. The Trustpilot badge shown on the site is a static image and link with no scripts or cookies; clicking it navigates to trustpilot.com, which is governed by Trustpilot's own privacy policy.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers (processors) who help us run the Service, under contracts that require them to protect it and use it only on our instructions:
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Lovable | Platform, hosting, built-in transactional email, managed Google OAuth sign-in and bounce/suppression handling. | Sweden (EEA); email delivery sub-processor Resend (USA) — DPF/SCCs |
| Lovable AI Gateway | AI gateway — routing to Google (Gemini) & OpenAI as sub-processors. | Gateway in the EEA; routes to US sub-processors Google & OpenAI — EU–US Data Privacy Framework |
| Supabase Inc. | Database, authentication and serverless functions. | USA — SCCs |
| Stripe Inc. | Payment processing and subscriptions. | Ireland (EEA, Stripe Payments Europe Ltd.) & USA — SCCs/DPF |
| Financial Modeling Prep (FMP) | Market and financial data provider. | USA — SCCs |
| CoinMarketCap (Datama Solutions Inc.) | Cryptocurrency and tokenized securities market data provider. | USA — SCCs |
| Beehiiv Inc. | Newsletter delivery (only if we launch a newsletter and you subscribe to it). | USA — appropriate safeguards (DPF/SCCs) |
| Trustpilot A/S | Sends review invitations to subscribers on our behalf (receives your email address when your subscription starts). | Denmark (EEA) |
We may also disclose data where required by law, to protect our legal rights, or in connection with a business transfer. If we launch a newsletter, we intend to use Beehiiv as our provider, or any similar provider, and will update this Policy accordingly before doing so.
7. International data transfers
Some providers are located outside the European Economic Area (mainly in the United States). Where that is the case, we rely on appropriate safeguards under the GDPR: the EU–US Data Privacy Framework where the provider is certified (for example Google and OpenAI), or the European Commission's Standard Contractual Clauses (Module 2021/914) for the others, together with additional measures where needed. You can ask us for more information about these safeguards using the contact details above.
8. How long we keep your data
We keep personal data only as long as necessary for the purposes above. As a guide:
- Account, profile and your content: for as long as your account is active. After you delete your account, we delete or anonymise this data within 90 days, unless we must keep it longer by law.
- Billing and tax records: seven (7) years, as required by Dutch tax and accounting law.
- Marketing and re-engagement email address: for former or expired-trial users, up to 24 months after your last activity, after which the email is deleted. You can opt out at any time.
- Suppression list (opt-outs and bounces): retained for as long as needed to make sure we continue to honour your opt-out.
- Feedback and support correspondence: up to 24 months.
- Server, security and application logs (including IP addresses): up to twelve (12) months, after which they are deleted or anonymised, unless a longer period is needed for an ongoing security investigation or legal claim.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased (the "right to be forgotten") in certain circumstances;
- restrict or object to our processing, including objecting to processing based on legitimate interests and to direct marketing at any time;
- receive certain data in a portable, machine-readable format; and
- withdraw any consent you have given, at any time.
To exercise any of these rights, email us at privacy@foremetrics.ai. We will respond within one month. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in your EU country of residence.
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. The Service's tools and AI features are informational and do not decide anything about you.
10. How we protect your data
We use appropriate technical and organisational measures to protect your personal data, including encrypted connections, access controls, authentication through Google sign-in and passwordless magic links (we do not store passwords), and trusted processors. No online service can be guaranteed to be completely secure, but we work to keep your data safe and to address any incident promptly.
11. Children
The Service is intended for users aged eighteen (18) or older (or the age of majority in your jurisdiction, if higher). We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us and we will delete it.
12. Changes to this Policy
We may update this Privacy Policy from time to time. If a change is material, we will notify you by email or within the Service before it takes effect. The "Last updated" date above shows when this Policy was last revised.
13. Contact
If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@foremetrics.ai, or write to Foremetrics, Le Mairekade 77, 1013 CB Amsterdam, the Netherlands.