Privacy Policy

DFF Enterprises, LLC, an Indiana limited liability company, operates What The Pros Own and decides how the information described here is used. Write to us at 520 S Walnut St #191, Bloomington, IN 47402. Privacy questions go to support@whattheprosown.com.

The list is short, because the product needs very little.

• Your email address, so you can sign in and so we can send what you asked for.
• Your password, stored only as a cryptographic hash. We cannot read it.
• Your watchlist — the funds and companies you chose to follow.
• A record of which email digests we have sent you, so we do not send the same one twice.
• Your subscription state — whether you are on a free or paid plan, when your access runs to, and the identifiers Stripe uses for you. We do not receive or store your card number.

We do not ask for your name, your address, your phone number, your holdings, or anything about your finances. We do not run advertising trackers or third-party analytics.

We hold your email address and password because you cannot have an account without them. We hold your watchlist and digest records because those are the features you asked for. We hold subscription state because we have to know whether you have paid.

All of it exists to deliver the service you signed up for. We do not sell personal information, and we do not share it for advertising.

We are one company running on other companies’ infrastructure. These are the services that hold or process your data on our behalf:

• Supabase — the database and the sign-in system. Your email, password hash, watchlist and subscription state live here.
• Vercel — hosts the website and serves every page you load.
• Stripe — takes payments and holds your card details, which never reach us.
• Resend — delivers account emails and digests, so it sees your email address.
• Railway — runs the scheduled jobs that fetch filings and build digests.

One thing worth being explicit about: we use Anthropic’s Claude to write the plain-English summaries, and we send it only public filing data. No part of your account, your watchlist, or your activity is sent to an AI model.

We will hand over data if a law or a valid legal demand requires it, and we would tell you unless we were forbidden to.

Your account data stays for as long as your account does. Delete your account and we delete your email address, password hash, watchlist and digest records.

Payment records are the exception: Stripe and our own transaction records have to be kept for tax and accounting purposes, generally seven years.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it and close your account. Write to the address above and we will do it.

Depending on where you live you may have further rights. If you are in the European Union or the United Kingdom, the section below applies to you in addition to everything above.

If you live in California, we do not sell or share your personal information, and we never have. Whatever the CCPA does or does not require of a company this size, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it, and we will do it. Those rights are above, and they are not conditional on where you live.

We do not currently accept subscribers in the European Union or the United Kingdom. Checkout is blocked for billing addresses in those countries, and this is deliberate rather than an oversight.

Article 27 of the GDPR requires a company outside the EU that offers services to people in the EU to appoint a representative there. We intend to serve those subscribers and have not yet appointed one, so we are not taking their money in the meantime. This section will be updated, including with the safeguards relied on for transferring data out of the EEA, before that changes.

If you have an account with us and live in the EU or the UK, the rights below apply to you regardless.

The data controller is DFF Enterprises, LLC, at the address above. Write to that address or to the support address for anything in this section.

What we rely on to hold your data

Your email address, password, watchlist and digest records are held to perform the contract you entered into when you created an account. Subscription and payment state is held on the same basis, and for the separate legal obligation to keep tax and accounting records. Security and abuse logs are held on the basis of our legitimate interest in keeping the service working and not being defrauded.

We do not rely on consent for any of it, because none of it is optional to the service. We do not profile you, we make no automated decisions that produce legal or similarly significant effects, and we do not sell personal information.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to our relying on legitimate interests, and ask for your data in a portable form. Where we rely on consent for anything in future, you can withdraw it.

Ask by writing to the support address. We will answer within one month. If a request is complex we may take up to two further months and will tell you within the first month if that happens. We do not charge for this.

Deletion is handled by hand rather than by a button on the site. Write to us and we will delete your account, your email address, the password hash, your watchlist and your digest history. Payment records survive deletion, because tax law requires us to keep them.

Where your data goes

Everything is stored and processed in the United States. The processors named above are all US-based or store US-side.

Because we do not currently accept subscribers in the EU or the UK, we are not transferring their personal data anywhere. When that changes, this section will name the safeguards relied on for those transfers before any such account is opened.

Complaining

If you think we have handled your data badly, tell us first and we will try to put it right. You can also complain to the data protection authority where you live, or to the Information Commissioner’s Office if you are in the United Kingdom. You do not need our permission and you do not have to come to us first.

Data is encrypted in transit and at rest. Access to the database is controlled row by row, so the database itself refuses to hand one account’s data to another. Passwords are hashed and are not recoverable, by us or by anyone.

No system is perfect. If your data is ever exposed in a breach, we will tell you.

We set one kind of cookie: the one that keeps you signed in. There are no advertising cookies and no third-party trackers. Blocking it means you cannot stay signed in.

The service is not for anyone under 18 and we do not knowingly collect data from children. If we learn we have, we delete it.

If we change this policy in a way that matters, we will email you before it takes effect.