Legal

Privacy Policy

How we collect, use, and protect your data.

Last updated: March 2026

1. Who we are

SeasonHunter is operated by Gandalf Project Srls, a company registered in Italy. We provide a web-based platform for stock seasonality screening and analysis. In this policy, "we", "us", and "our" refer to Gandalf Project Srls.

If you have any questions about this policy or how we handle your data, contact us at support.seasonhunter@gandalfproject.com.

2. What data we collect

We collect only the data necessary to provide the service:

  • Account data: your email address and full name, provided when you register.
  • Payment data: billing information processed by Stripe. We never store your card details — Stripe handles all payment data on your behalf.
  • Usage data: subscription plan and account status, stored to determine which features you can access.
  • Session data: a server-side session token kept in a browser cookie to keep you logged in (see Section 5).

We do not currently collect behavioural analytics, browsing history, or any data for advertising purposes.

3. How we use your data

  • To create and manage your account.
  • To process payments and manage your subscription via Stripe.
  • To enforce access controls (free vs. premium features).
  • To contact you about your account or subscription (e.g. payment failures, plan changes).
  • To comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your data under the following lawful bases:

  • Contract: processing necessary to provide the service you signed up for.
  • Legitimate interests: keeping the platform secure and functional.
  • Legal obligation: retaining records as required by applicable law.
  • Consent: where we explicitly ask for it (e.g. future marketing communications).

5. Cookies

We use one essential cookie: a server-side session cookie that keeps you logged in. This cookie:

  • Is set only when you log in.
  • Expires after 7 days (or at the end of your browser session if you do not check "remember me").
  • Is marked HttpOnly (not accessible to JavaScript) and Secure (transmitted over HTTPS only).
  • Contains no personally identifiable information — only an encrypted reference to your session.

Because this cookie is strictly necessary for the service to function, it does not require your consent under the ePrivacy Directive or UK PECR.

Future analytics: we intend to introduce anonymised usage analytics in the future. When we do, we will update this policy and, where required, request your consent before setting any non-essential cookies.

6. Third-party services

We use the following third-party processors:

  • Supabase — authentication and user profile storage. Your email address and name are stored on Supabase infrastructure. Supabase Privacy Policy →
  • Stripe — payment processing and subscription management. Stripe is PCI-DSS compliant and handles all card data. Stripe Privacy Policy →

These processors are contractually bound to process your data only as necessary to provide their services to us.

7. Data retention

  • Active accounts: data is retained for as long as your account is active.
  • Deleted accounts: personal data is deleted within 30 days of account deletion, except where retention is required by law (e.g. billing records, which may be kept for up to 7 years).

8. Your rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data ("right to be forgotten").
  • Restrict or object to certain processing.
  • Data portability — receive your data in a structured, machine-readable format.
  • Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at support.seasonhunter@gandalfproject.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. International data transfers

Some of our third-party processors — including Supabase and Stripe — may store or process your personal data outside the European Economic Area (EEA) or United Kingdom, including in the United States.

Where such transfers occur, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission, which contractually bind the recipient to protect your data to EEA standards.
  • Processor agreements that require compliance with GDPR and equivalent data protection standards.

By using the Service you acknowledge that your data may be transferred to and processed in countries outside your own, subject to the safeguards described above.

10. Data security and breach notification

We use industry-standard measures to protect your data: HTTPS encryption in transit, HttpOnly and Secure session cookies, hashed passwords via Supabase, and restricted access to production systems. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
  • Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, including a description of the nature of the breach and the steps we are taking to address it.

11. Children

SeasonHunter is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests:
Gandalf Project Srls
support.seasonhunter@gandalfproject.com
Via Angelo Emo 144, 00136 Roma, Italy - P.IVA: IT16244681009