Privacy Policy

Visitors — what we collect

We use a product-analytics service to understand how the Service is used and to find and fix errors. When you browse, it records the pages you view, the buttons and links you click, how long you stay, your browser and device type, your approximate location (derived from your IP address), and technical error reports.

It also records sessions — a replay of the page layout and pointer movement — with all on-screen text and everything typed into forms masked in your browser before anything is sent, so recordings contain no names, messages, or form entries.

We do not link analytics to your account or use it to identify you, and we do not sell it.

We also use an advertising pixel from X (Twitter) to measure whether our ads on X lead to visits and subscriptions. It records the pages you view and, if you arrived from one of our X ads, the ad click identifier. When you subscribe, we report the purchase to X — amount, currency and a transaction identifier — but not your name, email or account details.

Browsing the Service stores a small number of values in your browser:

• bz_tour — whether you have seen the intro tour.
• bz_token, bz_user, bz_identities, bz_return_to — created only if you sign in: your session token (expires after 7 days), your display name for the navbar, a cached copy of the unlocked identity data, and the page to return you to after login.
• ph_… — a first-party cookie and browser-storage entry set by the analytics service, holding a random identifier for your browser so that repeat visits count as one visitor.
• bz_twclid — if you arrived from one of our X ads, the ad click identifier, kept for 30 days. X’s pixel may also set its own cookies, governed by X’s privacy policy.
• When you open checkout, our payment provider’s secure payment frame loads and may set its own cookies, governed by that provider’s privacy policy.

You can block or clear cookies and browser storage in your browser settings. The Service works without the analytics ones.

Our hosting infrastructure keeps standard server logs (IP address, requested page, timestamp) for security and operations.

Account holders and subscribers — what we collect and why

When you create an account we collect, depending on how you sign up:

• Email signup: your email address and password.
• X or Google sign-in: your account identifier, display name, email address (where the provider shares it), profile image URL, and — for X — your handle. We receive these from the provider; we never see your password, we cannot post as you, and we do not read your messages.

Subscriptions. Payments are handled by our payment provider, which acts as the merchant of record — the seller of your subscription. It collects your card or other payment details, billing country and email directly, and processes them under its own privacy policy. We never see or store your full card details. From the provider we receive your subscription’s status, plan and billing period, and the provider’s identifiers for your customer record, subscription and transactions.

We use this data to operate your account and subscription: signing you in, showing who is signed in, keeping your subscription status current, and giving subscribers access to the full Service. We also report subscription purchases to X for ad measurement, as described in Section 1. Nothing else. We do not send marketing email.

You may request deletion of your account data at any time via your account or at legal@bullzeye.ai. Deletion does not remove billing and transaction records that we or our payment provider must keep under tax and accounting law.

Sharing

We do not sell, rent, or trade personal data. We share it only with the service providers that operate the Service for us — our cloud and hosting providers, our product-analytics provider (the usage data described in Section 1), X (ad measurement, as described in Section 1), and our payment provider (payments and subscription management; as merchant of record it processes your payment data under its own privacy policy) — under obligations of confidentiality; and where disclosure is required by law or necessary to protect legal rights. Data is processed on infrastructure that may be located outside your country of residence, including in the United States and Israel.

Tracked Accounts — the people the Service reports on

The Service reports on the public financial commentary of a limited set of Tracked Accounts. If you are one of them, this section describes what we hold about you and your rights. This data does not come from you — you have no account with us and never provided us anything. It comes from what you posted publicly.

What we hold: your public posts on the platforms we cover (currently X), and the public profile data attached to them — handle, display name, profile image URL, biographical text, follower count, and verification status — together with the measurements we compute from your posts (the Calls and Scores described in our Terms of Service and Methodology). Profile images are not copied to our systems; where they appear, they are fetched by the viewer’s browser from the platform that hosts them.

Why we hold it: there is a genuine public interest in the accuracy of public statements made to the investing public about publicly traded securities. We process this data to report on that — on your conduct in a public activity you chose to engage in — and for no other purpose. We consider this our legitimate interest and a matter of public interest under applicable data-protection law.

What we don’t do with it: we do not use it for advertising, do not sell it, and do not provide it for use in decisions about your employment, credit, insurance, or housing.

Your rights. Under applicable data-protection law — including the Israeli Protection of Privacy Law and, where it applies, the GDPR — you may ask to inspect the data we hold about you, ask us to correct data that is wrong, incomplete, or misleading, ask us to delete data, or object to our processing of it. Write to legal@bullzeye.ai; we will acknowledge within 14 days and answer as the applicable law requires. Where we decline a request, we will say why, and you may complain to the data-protection authority in your jurisdiction (in Israel, the Privacy Protection Authority).

Retention

Account data is kept until you delete your account. Billing and subscription records are kept for as long as tax and accounting law requires. Data about Tracked Accounts is kept for as long as it is part of the published record, and afterwards as needed for legal compliance. Server logs and analytics data are kept for a limited operational period.

Security

We take reasonable technical and organizational measures to protect the data we hold, including access controls and encrypted transport. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authority as the law requires.

Children

The Service is not directed at children and requires users to be at least 18 years old. We do not knowingly collect data from anyone under 18.

Changes

We may update this policy. Material changes will be posted with an updated “Last updated” date and notified on the Service before taking effect.

Contact: Bullzeye Fintech Ltd (company no. 517399275) · legal@bullzeye.ai