oernings
DemoGet Started

Privacy Policy

Effective date: 2026-10-05. This policy describes how oernings collects, uses, and shares personal data, in compliance with the EU General Data Protection Regulation (GDPR) and the German Bundesdatenschutzgesetz (BDSG).

1. Controller

The data controller within the meaning of Art. 4 (7) GDPR is:
Ömer Kaya
Frankfurter Str. 41
63150 Heusenstamm, Germany
E-Mail: support@oernings.com

2. What we collect and why

Account creation

When you register we store your e-mail address and a hashed password. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Watchlist + usage

Which companies you add to your watchlist, which earnings reports you read, your notification preferences. Stored to provide the service you signed up for. Legal basis: Art. 6 (1) (b) GDPR.

Usage statistics

Information about how and when you use the service while signed in (for example, the days on which you use it), linked to your account. We use it to analyse and improve the service. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in understanding and improving our service). You can object to this processing at any time (see Section 7).

Payment data (for paying users)

When you subscribe to a paid tier, your purchase is handled by Paddle (see Section 4), which acts as the Merchant of Record — the legal seller for your subscription. Paddle collects and processes your payment and billing details directly, as an independent controller under its own privacy notice. We store only the resulting Paddle customer/subscription identifiers and the subscription state (tier, period end). We never see or store your card details. Legal basis: Art. 6 (1) (b) GDPR.

Server logs

Our infrastructure (Google Cloud Run, Supabase) records request metadata (IP address, timestamp, user-agent, request path) for up to 30 days to ensure stability and detect abuse. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in service stability).

3. Cookies and similar technologies

We use functional cookies strictly required to keep you signed in (authentication session). These are first-party cookies set by Supabase Auth and do not require consent under § 25 (2) TTDSG. We do not use advertising or tracking cookies.

4. Third-party processors

We share data with the following processors strictly to deliver the service. Data Processing Agreements (DPA) per Art. 28 GDPR are in place with each, except Paddle (see note below).

  • Supabase (Supabase Inc., USA / EU regions) — authentication, database, file storage.
  • Google Cloud (Google LLC, USA / EU regions) — application hosting (Cloud Run, Cloud Scheduler).
  • Paddle (Paddle.com Market Ltd, United Kingdom) — Merchant of Record for subscription payments and global tax compliance on paid tiers. Unlike the other services listed here, Paddle acts as an independent controller (not our processor) for the checkout and billing data it collects directly from you — see Paddle's own privacy notice.
  • Resend (Resend.com, USA / EU regions) — transactional e-mail delivery (registration confirmations, notifications, trial reminders).
  • Finnhub (Finnhub.io) — earnings-calendar and stock-price data feed. Finnhub receives no personal data; we send only ticker symbols.
  • Anthropic (Anthropic, PBC, USA) — Claude AI is used to interpret public SEC filings. Filing text is sent for analysis; no personal user data is included in those requests.

5. International transfers

Some processors are located in the USA. Transfers are based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

6. Retention

Account data is kept as long as you have an active account. Server logs are retained for up to 30 days. Usage statistics are kept for up to 13 months and then deleted or anonymised. Billing data is retained for 10 years to comply with German tax law (§ 147 AO). You can delete your account yourself under Settings → Account. Without a paid period running, your account and its personal data are deleted immediately; with a paid subscription, at the end of the period already paid for. Server logs may still contain traces for up to 30 days, and statutory retention obligations remain unaffected. If you used a free trial, we keep a one-way, keyed hash of your email address (not the address itself) after deletion, solely to prevent repeated free trials (legitimate interest, Art. 6 (1) (f) GDPR).

7. Your rights

Under the GDPR you have the right to:

  • Access your data (Art. 15)
  • Correct inaccurate data (Art. 16)
  • Have your data deleted (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)
  • Lodge a complaint with the competent supervisory authority — in Germany, the data-protection authority of your federal state

To exercise any of these rights, contact support@oernings.com.

8. Changes

We may update this policy when our processing activities change. Material changes will be communicated to active users by e-mail.

Last updated: 2026-10-05.