Privacy Policy & Data Protection

1. Data Controller

The legal entity responsible for the collection, processing, and safeguarding of your personal data is:

2. Legal Bases for Processing (GDPR Article 6)

Under the GDPR, we only collect and process personal data when we have an lawful basis:

• Performance of a Contract (Art. 6(1)(b)): To authenticate your account, deliver proprietary Moat Score calculations, process your PRO subscription via Stripe, and provide customer support.
• Legitimate Interests (Art. 6(1)(f)): To secure our infrastructure, prevent DDoS attacks or payment fraud, optimize user experience, and ensure software availability.
• User Consent (Art. 6(1)(a)): For optional statistical analytics cookies (Google Analytics 4) and optional financial notification emails. You can withdraw your consent at any time.

3. Information We Collect & How It Is Used

We believe in strict data minimization. We only collect information strictly required to operate our service:

• Account Information: Your email address and cryptographically salted/hashed password when you register. Name, phone number, and country are optional.
• Payment & Billing Data: Handled entirely through Stripe, Inc. MoatPicks does not store, process, or have access to raw credit card numbers or security CVV codes. Stripe processes transactions under strict PCI-DSS Level 1 compliance.
• Technical & Telemetry Data: IP address (anonymized), browser type, operating system, and interaction timestamps required for rate-limiting, system security, and session authentication.

4. Third-Party Sub-Processors

We partner only with industry-leading, certified infrastructure providers who meet rigorous GDPR and security requirements:

• Stripe Payments Europe, Ltd. (Ireland / USA): Manages subscription checkout, recurring billing, customer portal, and invoice delivery. Complies with EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).
• Google Analytics 4 (Google Ireland Ltd. / Google LLC): Used with IP anonymization for aggregated, non-personalized product analytics. Controlled via our Cookie Consent banner.
• Hostinger International Ltd. (Lithuania / EU): High-performance VPS cloud servers, firewalls, and encrypted database infrastructure hosted within the European Union.
• Hostinger Titan Mail: Encrypted email communication channels (info@moatpicks.io).

5. Cookies & Tracking Technologies

We use essential cookies strictly necessary for application operation (keeping you logged in, storing your language preference, and managing your cookie consent state).

Optional performance and analytics cookies (GA4) are loaded only when you select "Accept All" on our Cookie Consent Banner. If you select "Essential Only", analytics tracking is immediately disabled via window['ga-disable-G-SVVXX3D9DL'] = true.

6. Your Rights Under GDPR (Articles 15–22)

As an individual in the European Economic Area (EEA), UK, or worldwide, you hold complete autonomy over your data:

• Right of Access (Art. 15): Request a full copy of the personal data we store about you.
• Right to Rectification (Art. 16): Correct any inaccurate or incomplete personal information.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Permanently delete your account and all associated personal data from our active databases.
• Right to Restrict Processing (Art. 18): Request limits on how your data is processed under specific circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable JSON format.
• Right to Object (Art. 21): Object to any processing based on legitimate interests.

7. Data Retention & Security Measures

We retain your account details as long as your account remains active. If you delete your account, personal data is purged within 30 days, except records we are required to retain by law (such as Stripe fiscal transaction logs retained for statutory tax audit periods).

All data in transit is protected using modern TLS 1.3 / SSL 256-bit encryption. Access to server environments is restricted through key-based SSH authentication, regular security patches, and automated firewall defenses.

8. Age Restrictions & Minors

MoatPicks.io is intended strictly for individuals who are at least 18 years of age (or the age of legal majority in your jurisdiction). We do not knowingly solicit or collect personal data from anyone under 18.

9. Contact & Regulatory Inquiries

If you have questions regarding this Privacy Policy or wish to lodge a complaint, please contact us first at:

📧 Email: info@moatpicks.io
💬 Online Contact Form: https://moatpicks.io/contact

If you are an EU citizen and feel your concerns were not adequately addressed, you have the statutory right to lodge a complaint with your local EU Data Protection Authority (e.g., AEPD in Spain, CNIL in France, BfDI in Germany, or the ICO in the UK).