1. Data controller
The data controller for this site is the operator of The Insiders Post. You can reach the data protection contact at [email protected].
Privacy Policy
What we collect, why we collect it, how long we keep it, and how to exercise your rights. Last updated 2026-08-28.
The Insiders Post is a public information service. Almost everything on the site is derived from SEC Form 4 filings, which are public records filed with the U.S. Securities and Exchange Commission. We do not require an account, we do not ask for your name or email to browse, and we do not run advertising. The only personal data we process is what is strictly necessary to operate the service: server logs, the optional analytics cookie described in our Cookie Policy, and any feedback you choose to send us.
2. What data we collect
2.1 Data you give us directly
- Suggestion form: name, email, and the suggestion body. Used only to reply to your feedback and never added to a marketing list.
- Email enquiries: whatever you write to us.
2.2 Data we collect automatically
- Server logs: IP address, user-agent string, request path, status code, and timestamp. Kept for 30 days for abuse detection and then deleted.
- Cloudflare bot-management cookie (
__cf_bm): strictly necessary, expires after 30 minutes of inactivity. See Cookie Policy §4. - Google Analytics 4: only if you click Accept on the consent banner. We configure GA4 with
anonymize_ip: true, so the last octet of your IP address is removed before storage. See Cookie Policy §2.
2.3 Data we do not collect
- No advertising identifiers, retargeting cookies, or third-party trackers.
- No precise geolocation data (only country-level from Cloudflare).
- No biometric, health, financial, or special-category data.
- No data from minors — the site is not directed at children under 16.
3. Lawful basis (GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Serving the website and routing requests | Legitimate interest (Art. 6(1)(f)) |
| Cloudflare bot protection | Legitimate interest (Art. 6(1)(f)) |
| Google Analytics 4 — only after consent | Consent (Art. 6(1)(a)) |
| Replying to your suggestion / email | Pre-contractual / contractual (Art. 6(1)(b)) |
| Complying with a legal request | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with
- Cloudflare, Inc. (USA): CDN, DNS, bot management, optional Web Analytics. Data Processing Agreement in place; transfers under the EU-U.S. Data Privacy Framework.
- DigitalOcean, LLC (USA): hosting the application container. DPA in place; same transfer mechanism.
- Google LLC (USA): Google Analytics 4, only after consent. Transfers under the EU-U.S. Data Privacy Framework.
- Cloudflare Turnstile (USA): bot-protection challenge used on the suggestion form. The challenge runs in the browser and does not set cookies.
We do not sell personal data, and we do not share it with anyone else except where required by law (e.g. a valid court order).
5. Retention
| Data | Retention |
|---|---|
| Server logs | 30 days, then deleted |
| Suggestion form submissions | 24 months, then deleted |
| Email correspondence | 24 months from last contact, then deleted |
| Google Analytics 4 (when consented) | 14 months (Google's default), then auto-deleted |
CookieFirst consent decision (cookiefirst-consent cookie) | Approximately 12 months, then re-prompted |
6. Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15).
- Rectify inaccurate or incomplete data (Art. 16).
- Erase your data, subject to legal retention duties (Art. 17).
- Restrict processing while a dispute is resolved (Art. 18).
- Port your data in a machine-readable format (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time, without retroactive effect (Art. 7(3)). Use the footer's Manage cookies button or write to us.
- Lodge a complaint with your national supervisory authority (e.g. the Agencia Española de Protección de Datos at aepd.es).
To exercise any of these rights, write to [email protected]. We respond within 30 days, free of charge. If your enquiry is complex we may extend that window by up to two further months and will tell you why.
7. EU representative
Under GDPR Art. 27, non-EU controllers must appoint an EU representative. Our EU representative can be reached at [email protected].
8. Security
We protect data in transit with HTTPS (HSTS enabled, TLS 1.2+). Application secrets are bound at runtime via the DigitalOcean App Platform, never committed. Access to the production database is restricted to operators with two-factor authentication. Despite our efforts, no system is 100% secure; if you ever discover a vulnerability, please email [email protected] so we can act fast.
9. Changes to this policy
We will update this page when our practices change. Material changes will also be flagged in the consent banner the next time you visit. The "Last updated" date at the top reflects the most recent revision.