Version 3 · Effective October 12, 2026
This Privacy Policy explains how SecFeed, the operator of secfeedapi.com ("SecFeed", "we", "us"), collects, uses, shares and protects personal information when you use our website, API, MCP server, SDKs and related services (the "Service"), and the choices and rights you have. It forms part of our Terms of Service.
SecFeed is the controller of personal information about our account holders and website visitors. Contact: support@secfeedapi.com.
| Category | What | Source |
|---|---|---|
| Account information | Email address; a salted, one-way hash of your password (we never store the password itself); account creation date; the version and time you accepted our Terms. | You |
| Billing information | Stripe customer and subscription identifiers, plan, billing interval and payment status. Card numbers, security codes and bank details are collected and stored by Stripe, never by us. | You, via Stripe |
| Usage information | API keys, number of API calls per key per month, endpoints and parameters needed to serve and troubleshoot requests, webhook URLs you register. | Automatically |
| Security information | IP addresses of signup and login attempts and requests, used for rate limiting, fraud and abuse prevention. | Automatically |
| Website analytics | Pages viewed, referring website, approximate location derived from IP address, browser and device type, and clicks on links and buttons. Form fields and the text you type are never captured, and sessions are not recorded. | Automatically, via PostHog |
| Communications | Messages you send to support and transactional emails we send you. | You and us |
We do not intentionally collect sensitive personal information, and we ask that you do not send it to us.
The Service provides information that companies, funds and individuals filed publicly with the U.S. Securities and Exchange Commission, which can include names, roles, addresses stated in filings, securities transactions and holdings of company insiders and other filers. This information is published by the SEC as public record. We process it to provide accurate, structured access to public securities disclosures, which is our legitimate interest and supports market transparency. Because this data reproduces the official public record, we generally cannot alter it, but you may contact us with concerns and we will review each request in line with applicable law.
Legal bases where the GDPR or UK GDPR applies: performance of our contract with you; our legitimate interests in operating, securing and improving the Service; compliance with legal obligations; and your consent where we ask for it.
We do not use your personal information, queries or API usage to train artificial intelligence models, and we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
We do not sell your personal information and do not share it for cross-context behavioral advertising. We share it only with:
We use one strictly necessary cookie, sf_session, to keep you logged in (HttpOnly, Secure, expires after 30 days or at logout).
We use PostHog, hosted in the European Union, to understand how visitors use our website (for example which pages are viewed and where visitors come from). It runs without cookies: it keeps a random visit identifier in your browser's session storage, which is deleted when you close the tab, so a visit is counted once and you are not recognized on later visits or on other websites. It does not record sessions and never captures what you type into forms. For signed-in users we also send a small number of account events (signup, card added, key issued, subscription started) linked to an internal account number, not to your email address.
We do not use advertising cookies or tracking pixels and do not track you across other websites. We honor Global Privacy Control as an opt-out of any sale or sharing, which we do not do.
| Data | Kept for |
|---|---|
| Account and API key records | While your account is open, then up to 30 days after deletion |
| Monthly usage counts | Up to 24 months, for billing and dispute handling |
| Signup and login attempt IP records | Up to 15 minutes |
| Website analytics events | Up to 12 months, then deleted or aggregated |
| Server and security logs | Up to 30 days, unless needed to investigate abuse |
| Billing and tax records | As long as required by law (Stripe retains payment records under its own obligations) |
We protect personal information with measures including encryption in transit (HTTPS), salted password hashing, access-restricted secrets, separated databases for customer data, least-privilege service accounts and webhook signature verification. No method of transmission or storage is fully secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and authorities as required by law.
We host the Service in Germany. Our service providers, including Stripe, may process data in the United States and other countries. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Depending on where you live, you may have the right to: access the personal information we hold about you; correct inaccurate information; delete your information; receive a portable copy; object to or restrict certain processing; withdraw consent; and lodge a complaint with your local data protection authority.
California residents have the right to know, delete and correct personal information, to opt out of sale or sharing (we do not sell or share), to limit use of sensitive personal information (we do not collect it), and not to be discriminated against for exercising these rights. You may use an authorized agent.
To exercise any right, email support@secfeedapi.com from your account email. We may need to verify your identity, and we will respond within the time required by law (generally 30 days, or 45 days under California law).
The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
We may update this Policy. The version and effective date appear at the top. For material changes we will notify you by email or on the Service before they take effect.
SecFeed · support@secfeedapi.com