Privacy Policy

This Privacy Policy applies to Obelion Terminal (the “service”), operated by Obelion Inc. (“we”, “us”, or “our”), including our website at https://obelion.net and our desktop and mobile applications. For the purposes of applicable data protection laws, Obelion Inc. is the data controller responsible for your personal data processed through the service.

This policy does not apply to third-party websites, products, or services that we do not own or control, even where they are linked from within the service. We encourage you to review the privacy practices of any third-party services you use.

We collect the following categories of information:

• Account data. When you register, we collect your email address and authentication credentials. Authentication is handled through Supabase Auth; we do not store your raw password.
• Profile and preferences. Settings, watchlists, saved layouts, indicator configurations, and other preferences you create while using the service.
• Usage, device, and log data. Information automatically collected when you interact with the service, such as IP address, browser and device type, operating system, pages and features used, timestamps, and diagnostic or crash data.
• Support content. The content of support tickets, correspondence, and any information you voluntarily provide when contacting us.
• Payment data. Subscription and billing transactions are processed by Stripe. We receive limited information such as your subscription status and the last four digits of your card and billing metadata. We do not store full payment card numbers.
• Cookies and local storage. We use cookies and similar technologies to keep you signed in, remember preferences, and operate the service. See Section 10 below.

We use the information we collect to:

• provide, operate, and maintain the service;
• authenticate you and secure your account;
• process subscriptions, billing, and related transactions;
• detect, prevent, and respond to security incidents, fraud, abuse, and other harmful activity;
• respond to your support requests and communicate with you;
• analyze usage to understand, maintain, and improve the service and develop new features;
• comply with our legal obligations and enforce our agreements, including the Terms.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal data:

• Performance of a contract. To provide the service you have requested, manage your account, and process your subscription.
• Consent. Where you have given consent, for example for certain cookies or optional communications. You may withdraw consent at any time.
• Legitimate interests. To secure, maintain, and improve the service, prevent fraud, and understand how the service is used, where such interests are not overridden by your rights.
• Legal obligation. To comply with applicable laws, regulations, and lawful requests.

We do not sell your personal data. We share information only in the following circumstances:

• Service providers and sub-processors who process data on our behalf and under our instructions, including: Supabase (database and authentication), Stripe (payment processing), Resend (transactional email), our hosting and content-delivery providers, and product analytics providers if and when enabled.
• Legal and safety disclosures. Where required to comply with applicable law, legal process, or enforceable governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, and to investigate fraud or security issues.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

We are based in the United States, and your information may be processed and stored in the United States and in other countries where we or our sub-processors operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal data across borders, we take steps to ensure appropriate safeguards are in place, such as standard contractual clauses or other lawful transfer mechanisms, to protect your information consistent with this policy and applicable law.

We retain your personal data for as long as your account is active or as needed to provide the service to you. We may retain certain information for longer where required to comply with legal, tax, or accounting obligations, resolve disputes, or enforce our agreements.

You may request deletion of your account and associated data (see Section 9). We will honor such requests subject to information we are legally required or permitted to retain.

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit, access controls, and authentication safeguards.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security, and you provide information to the service at your own risk.

Depending on your location, you may have the following rights regarding your personal data.

GDPR / UK GDPR rights

• access to the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restriction of processing in certain circumstances;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent where processing is based on consent.

California (CCPA / CPRA) rights

• the right to know what personal information we collect and how it is used;
• the right to request deletion of your personal information;
• the right to correct inaccurate personal information;
• the right to opt out of the “sale” or “sharing” of personal information — note that we do not sell your personal data.

To exercise any of these rights, contact us at privacy@obelion.net. We will respond consistent with applicable law. You will not be discriminated against for exercising your rights, and you may have the right to lodge a complaint with your local data protection authority.

We use cookies, local storage, and similar technologies to operate the service, keep you signed in, remember your preferences, and understand usage. For details about the specific technologies we use and how to manage them, see our Cookie Policy.

The service is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@obelion.net and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy here and revise the “Last updated” date above. Your continued use of Obelion Terminal after an update becomes effective constitutes your acceptance of the revised policy.