Privacy Policy
1. Who is responsible
BullVox (bullvox.app) is built and run by Lorenz K., based in Austria. For anything related to your data, contact [email protected].
2. What we collect, and why
Browsing (no account): the site works without an account. We use Google Analytics 4 and a first-party event log (page path, clicked elements, an anonymized visitor hash — never your name or precise location) to understand what works on the site, plus two cookies: bv_var (assigns you to an A/B design variant) and bv_eu (remembers which consent rules apply to you).
Analytics consent: if you're visiting from the EU/EEA, the UK or Switzerland, Google Analytics only runs after you click "Allow" in the cookie banner (Art. 6(1)(a) GDPR) — you can change your choice any time via "Cookies" in the footer. Elsewhere, analytics runs by default on the basis of our legitimate interest (you can still opt out via the same footer link). The first-party event log is cookieless and anonymized and runs on legitimate interest (Art. 6(1)(f) GDPR).
Account: if you create an account, Google Firebase Authentication stores your email address and, if you sign in with Google or Apple, the identifier those providers share. We keep your account record (user ID, email, creation date) to operate your login. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Premium subscription: payments are processed entirely by Stripe. We never see or store your card details — we store only your Stripe customer/subscription IDs and subscription status to unlock Premium. Stripe also determines applicable taxes from your billing country. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (invoicing, Art. 6(1)(c) GDPR).
Emails: the newsletter and stock-watchlist updates use double opt-in — you only receive recurring emails after you click the confirmation link. We store your email address, language, confirmation state and unsubscribe token. Transactional emails (account welcome, receipts) accompany your account and purchases. Sending is handled by Resend. Legal basis: consent for the newsletter (Art. 6(1)(a) GDPR, revocable any time via the unsubscribe link in every email), contract for transactional mail.
Local storage: to avoid loading screens, your browser caches small flags (e.g. whether you're signed in or Premium) in localStorage. They stay on your device and are cleared on sign-out.
3. Who processes data for us
We use a small set of processors, each bound by data-processing agreements: Cloudflare (hosting, edge network, database), Google (Firebase Authentication, Google Analytics), Stripe (payments), Resend (email delivery, EU region). Some providers process data outside the EU/EEA; where that happens it is covered by the EU–US Data Privacy Framework or EU Standard Contractual Clauses.
We never sell your data, and we don't share it with anyone beyond these processors.
4. How long we keep things
Account data: until you delete your account. Billing records: as long as tax law requires (in Austria, generally 7 years). Newsletter data: until you unsubscribe — after which your address is kept on a suppression list so we don't email you again. Analytics events: aggregated, without direct identifiers.
5. Your rights
Under the GDPR you can request access to, correction of, or deletion of your data; ask for a copy (portability); object to processing based on legitimate interest; and withdraw consent at any time (e.g. via the unsubscribe link). Write to [email protected] — we answer within a month. You can also complain to the Austrian Data Protection Authority (dsb.gv.at).
6. Third-party content
BullVox analyzes public YouTube videos of finance creators. Creator names, channel data and public statements shown on the site are processed on the basis of legitimate interest in reporting on publicly made statements (Art. 6(1)(f) GDPR). Links to YouTube open YouTube's own service, subject to Google's privacy policy.
7. Changes
When the stack or the product changes, this policy is updated and the date above moves. Material changes to how we use account data are announced by email.