Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Veko ("Veko", "we", "us") collects, uses, and protects your personal data when you use useveko.com (the "Service"), and describes your rights under the EU General Data Protection Regulation (GDPR) and equivalent EU/EEA law. It should be read together with our Terms of Service.

1. Who is responsible for your data

The data controller for the Service is the operator of Veko, an individual sole trader established in the European Union / European Economic Area, trading as "Veko Financial Technologies". For any privacy question or to exercise your rights, contact us at [email protected].

2. Data we collect

Data you provide

• Account data — your email address, username, and password (stored only as a salted hash, never in plain text).
• Billing data — when you subscribe to Supporter, your payment is processed by Stripe. We do not receive or store your full card number; we store a Stripe customer/subscription identifier, your subscription status, and the billing email associated with it.
• Content you create — portfolio holdings and transactions, watchlists, saved reports, and research notes you enter.
• Correspondence — messages you send us by email.

Data collected automatically

• Authentication & security data — login timestamps and IP address, used to secure your account and rate-limit failed sign-in attempts.
• Usage data — basic records of which companies you view or compare, so the Service can show recent activity.
• Technical data — cookies and standard server logs (see Cookies).
• Advertising data — where you consent to personalised advertising, our advertising partner receives your IP address, device and browser information, and the pages you view on Veko (see Advertising). We do not receive this data in a form that identifies you.

3. How and why we use your data

• To create and operate your account and provide the Service.
• To process Supporter subscriptions, renewals, and related billing.
• To display advertising, which funds free access to the Service, and — only with your consent — to make that advertising more relevant to you (see Advertising).
• To send transactional emails (email verification, password reset, and important service or billing notices).
• To secure the Service, prevent abuse, and troubleshoot problems.
• To comply with legal obligations, including accounting and tax record-keeping for payments.

We do not sell your personal data for money, and we never share the content you create on Veko — your portfolio, watchlists, or research notes — with advertisers. We do not use your account data to target advertising. Note that under some non-EU privacy laws (such as the California Consumer Privacy Act) serving personalised ads can itself be treated as a "sale" or "sharing" of personal information; you can decline personalised ads at any time as described under Advertising.

4. Legal bases for processing

Under the GDPR we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the Service and manage your subscription under our Terms.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud and abuse, and maintain and improve it, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — to retain billing and tax records as required by law.
• Consent (Art. 6(1)(a)) — for storing or reading non-essential cookies and for personalised advertising. We ask for this through a consent banner before any advertising cookie is set, and you may withdraw consent at any time.

5. Cookies

Strictly necessary and preference cookies

These are set without consent because the Service cannot work without them (or because you asked for them):

• Session cookie — keeps you logged in.
• CSRF cookie — protects forms against cross-site request forgery.
• Theme preference — remembers your light/dark choice.
• Consent record — remembers the advertising choices you made in the consent banner.

Advertising cookies

Veko is free to use and is funded by advertising. Our advertising partner, Google, and its ad-technology vendors may set cookies or read similar identifiers on your device to serve, cap, and measure ads. These are set only after you consent via the banner shown on your first visit. If you decline, Google may still serve non-personalised ads, which use only coarse context (such as the page you are on) rather than a profile of you.

You can change or withdraw your choice at any time — see Advertising. Supporters browse the Service with no ads and no advertising cookies at all.

6. Advertising

We use Google AdSense to display advertising on the Service. When an ad loads, Google receives your IP address, information about your browser and device, and the page you are viewing, and may use cookies or similar identifiers. Google acts as an independent controller for this processing.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to Veko and other sites on the internet.
• You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info/choices and youronlinechoices.eu.
• You can review the vendors that may process your data, and the purposes they process it for, in the consent banner itself.

Changing your mind. If you are in the EEA, the UK, or Switzerland, you can reopen the consent banner at any time using the Privacy & cookie settings link in the site footer, and grant or withdraw consent per purpose and per vendor. Withdrawal does not affect processing carried out before you withdrew.

More information is available in How Google uses information from sites that use its services and Google's Privacy Policy.

Prefer no ads? The paid Supporter plan removes all advertising and all advertising cookies from your account.

7. Who we share data with

We share personal data only with service providers ("processors") that help us operate the Service, and only as needed:

• Stripe — payment processing and subscription management.
• Our email provider — to deliver transactional emails.
• Our hosting/infrastructure — to run and store the Service.

Separately, Google (AdSense) processes technical and advertising data when ads load, as described under Advertising. Google is not our processor for that activity — it acts as an independent controller under its own privacy policy.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service. We do not send your personal data to the SEC or market-data sources — those connections carry only company identifiers, not information about you.

8. International data transfers

Some of our processors and partners (for example, Stripe and Google) may process data outside the EU/EEA, including in the United States. Where that happens, the transfer is protected by appropriate safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy mechanism (for example, the EU–US Data Privacy Framework).

9. How long we keep your data

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records longer to meet legal obligations — in particular, billing and tax records, which are retained for the statutory period required in the relevant jurisdiction.

10. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict or object to certain processing;
• receive your data in a portable format (data portability);
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data-protection supervisory authority if you believe we have not handled your data lawfully.

11. Security

We take reasonable technical and organisational measures to protect your data, including encrypted transport (HTTPS), hashed passwords, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond appropriately to any incident.

12. Children

The Service is not directed to children and is intended only for users aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact

Questions about this Privacy Policy or your personal data? Contact us at [email protected].