Legal
Privacy Policy
Effective date: 11 October 2026
This Policy explains what information EdgarStack handles when you use edgarstack.com, the hosted MCP server, or the REST API, and how that information is used.
1. Who We Are
EdgarStack operates edgarstack.com and provides a subscription-based MCP server and REST API that connect AI assistants to public financial data and filings from SEC EDGAR. For privacy questions, contact support@edgarstack.com.
2. Data We Collect
Free tier: We collect your email address to issue and manage a free API key.
Pro subscribers: We collect your email address, subscription status received through Lemon Squeezy, API usage information (including API-key last-used time), watchlist tickers, and alert delivery logs.
Billing details: We do not ask you to enter a name, phone number, or physical address directly in EdgarStack. Lemon Squeezy may send a customer name in subscription webhooks; if provided, the current service stores that name with the customer record. Payment details are handled by Lemon Squeezy.
We do not use advertising cookies or tracking pixels. EdgarStack does not send customer account or usage details to SEC EDGAR; requests to SEC EDGAR retrieve public filings using EdgarStack’s service contact information.
3. How We Use It
- to issue and deliver API keys;
- to authenticate requests, apply plan limits, and prevent abuse;
- to manage subscriptions and provide customer support;
- to maintain watchlists and deliver filing alerts;
- to keep alert delivery records and diagnose service issues; and
- to meet legal obligations.
4. Free Tier Data Retention
For a free key, we retain the associated email address while the key is valid (14 days) unless you upgrade. If the key expires and you do not upgrade, we delete the email address within 30 days after expiry, except where we must retain information to meet legal obligations or resolve a dispute.
5. Third-Party Services
We use these providers to operate EdgarStack:
- Lemon Squeezy — payment processing and subscription status.
- Resend — transactional email, including API-key delivery and filing alerts.
- Supabase — database storage for customer, subscription, API-key, watchlist, and alert records.
- Render — hosting for the website, server, and related services.
- SEC EDGAR — source of public filings and financial data; we do not send customer personal data to SEC EDGAR.
These providers process information under their own terms and privacy policies. Payment information is submitted directly to Lemon Squeezy.
6. Data Storage & Security
We use HTTPS/TLS to protect information in transit and Supabase-managed database encryption at rest. EdgarStack stores API keys as SHA-256 hashes, along with a short prefix for support; the full key is not stored in the customer database. No method of transmission or storage is completely secure, but we take reasonable steps to protect the information we hold.
7. Your Rights
You may request access to, correction of, deletion of, or an export of your personal information by emailing support@edgarstack.com. We may need to verify your request and may retain information where required by law or for legitimate billing and security records.
8. Cookies
EdgarStack does not use advertising cookies or tracking pixels. We use only cookies or browser storage that are essential to authentication, security, or service functionality. Lemon Squeezy may use its own technologies during checkout under its policies.
9. Children
EdgarStack is not directed at children under 16, and we do not knowingly collect personal information from children under 16.
10. Changes
We may update this Policy as the service changes. We will give active Pro subscribers at least 14 days’ notice of material changes, such as by email or a notice on the service.
11. Contact
For privacy requests or questions, email support@edgarstack.com.