Privacy Policy

1. Data Controller

The controller of your personal data is Scorise Agency Sp. z o.o., with its registered office at al. Reymonta 54, 01-842 Warszawa, Poland, VAT-EU: PL1133001016 (hereinafter referred to as "Controller", "we", or "us").

We operate the website https://www.sentisignal.com and the SentiSignal platform, providing AI-powered market sentiment analysis services.

For any questions regarding your personal data or this Privacy Policy, please contact us at: [email protected]. For general inquiries: [email protected].

2. Legal Basis for Processing

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), the Polish Act of 10 May 2018 on the Protection of Personal Data, and — for users in the United States — the California Consumer Privacy Act ("CCPA") and other applicable US state privacy laws. The legal bases for processing are:

• •Article 6(1)(a) GDPR — Consent: Processing based on your explicit consent, e.g., for analytics cookies, newsletter subscription, and marketing communications.
• •Article 6(1)(b) GDPR — Contract performance: Processing necessary for the performance of a contract (providing our services, managing your account, processing payments).
• •Article 6(1)(c) GDPR — Legal obligation: Processing necessary to comply with legal obligations (e.g., tax, accounting requirements).
• •Article 6(1)(f) GDPR — Legitimate interest: Processing necessary for our legitimate interests, such as ensuring platform security, fraud prevention, service improvement, and aggregated analytics.

3. Data We Collect

3.1 Account Data

When you register for an account, we collect:

• •Email address (required)
• •Full name (optional)
• •Password (stored in irreversibly hashed form using bcrypt)
• •Account creation and update timestamps

3.2 Security Data

If you enable two-factor authentication (2FA), we additionally store:

• •TOTP secret (encrypted, for authenticator app verification)
• •Hashed recovery codes
• •2FA activation and verification timestamps

3.3 User Preferences

As you use the platform, we store your preferences to personalize your experience:

• •Watchlist selections (assets you follow)
• •Topic preferences (e.g., DeFi, Regulation, NFT)
• •Priority settings for watched assets

3.4 Payment Data

If you subscribe to a paid plan, payment processing is handled by Stripe, Inc. We store:

• •Stripe customer and subscription identifiers
• •Subscription plan tier and status
• •Billing period dates

We do not store your credit card number, CVV, or full payment card details. All payment information is processed directly by Stripe in accordance with PCI DSS standards. See Stripe's Privacy Policy.

3.5 Newsletter Data

If you subscribe to our newsletter, we collect your email address and, optionally, your first and last name. We use this data solely to send you market analysis updates, product news, and relevant content. You can unsubscribe at any time using the link in every email.

3.6 Technical & Log Data

When you use our platform, we automatically collect:

• •IP address (logged for security monitoring of unauthorized access attempts)
• •Browser type and version
• •Operating system
• •Pages visited and timestamps
• •Referrer URL

IP addresses are used for security purposes and are not linked to user accounts in persistent storage.

3.7 Aggregated Engagement Data

We track aggregated click counts on news articles for content quality purposes. This data is not linked to individual users.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our platform. In accordance with EU Directive 2002/58/EC (ePrivacy Directive) and GDPR, analytics and marketing cookies are only activated after you provide explicit consent via our cookie consent banner.

4.1 Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled:

4.2 Analytics Cookies (Consent Required)

These cookies are set only if you consent. They help us understand how visitors use our platform:

4.3 Marketing Cookies (Consent Required)

We may use marketing cookies to measure the effectiveness of advertising campaigns. Currently, this may include:

• •Meta (Facebook) Pixel — for measuring ad performance and audience insights (if activated)

Marketing cookies are only loaded after you grant explicit consent for this category.

4.4 Google Consent Mode v2

We implement Google Consent Mode v2, which ensures that Google services (Analytics, Tag Manager) respect your consent choices. By default, analytics_storage and ad_storage are set to "denied" until you opt in.

4.5 Server-Side Tracking

We use server-side tagging via Stape.io and Google Tag Manager Server Container to process analytics data. This means some tracking requests are routed through our first-party domain rather than directly to third-party servers, reducing your browser's exposure to third-party cookies while maintaining analytics accuracy. The same consent rules apply — no data is collected without your consent.

5. Third-Party Services and Data Transfers

We share personal data with the following third-party service providers, who process data on our behalf under appropriate data processing agreements:

International Data Transfers

Some of our service providers (Google, Microsoft, Stripe, Meta) are based in the United States. Data transfers to the US are conducted under the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection as required by GDPR Chapter V.

6. Purposes of Data Processing

We process your personal data for the following purposes:

• •Account management — creating and maintaining your user account, authentication, and session management.
• •Service delivery — providing personalized market sentiment analysis, watchlists, topic preferences, and AI-generated content.
• •Payment processing — managing subscriptions and processing payments through Stripe.
• •Newsletter & communications — sending market analysis updates and product news to subscribers (consent-based).
• •Security — protecting against unauthorized access, monitoring for abuse, and maintaining platform integrity.
• •Analytics & improvement — understanding how users interact with our platform to improve features and user experience (consent-based).
• •Legal compliance — fulfilling legal obligations including tax and accounting requirements.
• •Advertising measurement — evaluating the effectiveness of marketing campaigns (consent-based, if applicable).

7. Data Retention

We retain your personal data for the following periods:

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. You can exercise these rights by contacting us at [email protected]:

• •Right of access (Art. 15) — You have the right to obtain confirmation of whether your personal data is being processed and to access a copy of that data.
• •Right to rectification (Art. 16) — You have the right to request correction of inaccurate personal data.
• •Right to erasure (Art. 17) — You have the right to request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• •Right to restriction (Art. 18) — You have the right to request restriction of processing in certain circumstances.
• •Right to data portability (Art. 20) — You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• •Right to object (Art. 21) — You have the right to object to processing based on legitimate interests, including profiling.
• •Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• •Right to lodge a complaint (Art. 77) — You have the right to file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, website: uodo.gov.pl.

We will respond to your request within 30 days of receipt. In complex cases, this period may be extended by an additional 60 days, of which you will be informed.

9. Additional Rights for California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• •Right to know — You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes of processing, and the categories of third parties with whom we share your data.
• •Right to delete — You have the right to request deletion of your personal information, subject to certain exceptions.
• •Right to opt out of sale — We do not sell your personal information. If this changes, you will be provided with a "Do Not Sell My Personal Information" link.
• •Right to non-discrimination — We will not discriminate against you for exercising your CCPA rights.
• •Right to correct — You have the right to request correction of inaccurate personal information.
• •Right to limit use of sensitive data — You may limit the use or disclosure of sensitive personal information.

To exercise your CCPA rights, contact us at [email protected]. We will verify your identity before processing your request. We will respond within 45 days.

Categories of Personal Information (CCPA Disclosure)

Under the CCPA, we collect the following categories of personal information:

• •Identifiers: Name, email address, IP address, account ID
• •Commercial information: Subscription records, purchase history
• •Internet activity: Browsing history on our platform, search history, interaction data
• •Geolocation: Approximate location derived from IP address

We do not sell personal information and have not done so in the preceding 12 months.

10. Other US State Privacy Rights

If you reside in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or other US states with comprehensive privacy laws, you may have similar rights to access, correct, delete, and opt out of certain data processing. Please contact us at [email protected] to exercise your rights. We will respond in accordance with the applicable state law timelines.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• •Passwords are hashed using bcrypt with a cost factor of 12 (irreversible)
• •All data is transmitted over HTTPS (TLS encryption)
• •API authentication uses timing-safe comparison to prevent timing attacks
• •Database access is restricted through parameterized queries (SQL injection prevention)
• •Session tokens are cryptographically signed JWT tokens
• •Two-factor authentication (TOTP) is available for enhanced account security
• •Content Security Policy (CSP) and HSTS headers are enforced
• •Database connections are isolated with role-based access controls

12. Children's Privacy

Our services are not directed to individuals under the age of 16 (or 13 for US residents, as applicable under COPPA). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected], and we will take steps to delete such data.

13. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. Our platform honors DNT signals by default — analytics and marketing cookies are not loaded unless you provide explicit consent via our cookie consent banner, regardless of DNT settings.

14. Managing Your Cookie Preferences

You can manage your cookie preferences at any time by clicking the cookie settings button in the consent banner on our website. You can also control cookies through your browser settings:

• •Google Chrome
• •Mozilla Firefox
• •Safari
• •Microsoft Edge

Please note that disabling essential cookies may affect the functionality of the platform.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. For material changes affecting your rights, we will provide additional notice (e.g., via email or a banner on the platform).

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us: