Privacy policy

1. Who is responsible

The data controller is flndrn, flndrn, Arch. Makariou III 171, Vanezis Business Center, 4th floor, 3027 Limassol, Cyprus.

Our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus. You may also complain to the authority in the EEA country where you live or work.

2. What we collect

Account data: name, email address, password hash, language preference, and organisation membership when you sign up.

Usage data: pages you open on TheyKnow, device and browser type, IP address, and timestamps. We use this to keep the service running and to investigate abuse.

Alert preferences: which filings you asked to hear about, when you are ready to use alerts.

Affiliate data, if you join that programme: your referral code and whether a referred membership stays paid.

Messages you send through the contact form on theyknow.eu: name and the words you typed. That is a digital fill. We do not ask you to post paper to Cyprus if you used the form.

We do not ask for your broker login, portfolio, or payment card on the marketing site. When billing is live, a payment processor will handle card data. We will name that processor on the subprocessors page before we take a payment.

3. Why we process it (lawful bases)

Contract: to create your account, keep you signed in, send the product you asked for, and handle membership when billing is on (GDPR Art. 6(1)(b)).

Legitimate interests: to keep the service secure, to understand whether the site is working, and to defend legal claims (Art. 6(1)(f)). You may object.

Consent: for any non-essential cookie or optional marketing message. We do not run advertising cookies on this site today.

Legal obligation: invoices, tax records, and requests from a competent authority (Art. 6(1)(c)).

4. What we do not do

We do not sell your personal data.

We do not use your data to give you personal investment advice.

We do not scrape your social accounts.

The congressional filings we show are public US government records about other people, not about you.

5. Sharing

We share data only with processors who work for us, listed on the subprocessors page, and only as needed to run TheyKnow.

We may share data if the law requires it, or to protect a person from serious harm.

If we ever sell or reorganise the product, we would only transfer data to a successor who continues TheyKnow under a contract that keeps this policy’s promises.

6. Where data lives

We aim to keep personal data in the European Union. Our intended database is Briven’s EU Postgres. Until that vault is switched on, development copies may sit on the operator’s machines in the EU.

US government filing PDFs are public records hosted in the United States. Fetching them is not a transfer of your personal data.

7. How long we keep it

Account data: for as long as the account exists, then up to 24 months unless a longer legal hold applies.

Security logs: up to 12 months.

Invoices and tax records: as required by Cypriot accounting rules, typically six years.

Contact messages: up to 24 months after we close the thread.

8. Your rights

You may ask for access, correction, deletion, restriction, portability, and to object to processing based on legitimate interests. You may withdraw consent at any time, without affecting earlier lawful processing.

Form on theyknow.eu. That is the only way to reach us. We will answer within one month, or tell you if we need more time (up to two further months for complex requests).

You may lodge a complaint with your data-protection authority. In Cyprus that is the Commissioner for Personal Data Protection.

9. Children

TheyKnow is not for anyone under 18. If we learn that we hold an account for a child, we delete it.

10. Changes

If we change this policy in a way that matters, we will post the new text here and update the date. Material changes will also be flagged in the product when you next sign in.

11. Contact

Form on theyknow.eu. That is the only way to reach us.

We do not publish a staff email address.