1.Who is responsible for your data
EdgefulFinder is operated by Jocel Tolentino, an individual based in the Philippines, who is the personal information controller for the data described below. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), the contact point for all privacy matters is [email protected].
This policy covers the edgefulfinder.com website and its analytics platform. It does not cover third-party sites we link to.
2.What we collect
We collect only what the platform needs to run. The complete list is below — if a field is not here, we do not store it.
| Data | Why we hold it |
|---|---|
| Email address | Identifies your account and is the address we contact you at |
| Name | Labels your account. If you sign in with Google, you may supply this; it is optional |
| Password (hashed) | Only when you sign up with email. Stored as a PBKDF2-SHA256 hash with 100,000 iterations — we never store, and cannot read, the original password |
| Plan and role | Determines which features your account may open (Free, Core, Pro or All Access) |
| Account creation date | Account administration and support |
| Session token | Keeps you signed in without re-entering a password. Held in a cookie — see section 3 |
| Saved preferences | Your watchlists, report bookmarks and report templates, so the platform remembers your setup |
| Subscription and payment records | Which plan you paid for, the amount, the reference number and its status — used for billing and support |
What we do not collect: we do not store your card number, e-wallet credentials or bank details. Payment is handled entirely by our payment processor (section 4). We do not buy data about you from brokers, and we do not sell or rent your data to anyone.
3.Cookies
We use one cookie — es_session — which holds your session token. It is set with HttpOnly (JavaScript cannot read it), Secure (sent only over HTTPS), SameSite=Lax (limits cross-site submission), and it expires after 30 days.
The site is server-rendered, so there are no advertising, analytics or tracking cookies. We do not run third-party analytics scripts. Clearing your cookies or signing out ends the session immediately.
4.Who else receives data
We do not sell your data. These are the third parties that legitimately receive something in order for the platform to function:
| Recipient | What it receives | Purpose |
|---|---|---|
| PayMongo | Your email, the plan, the amount and a billing reference | |
| Cloudflare | All traffic to this site, as our hosting provider | |
| Google (if you sign in with Google) | Your Google account identifier and email |
Separately, the platform requests market and economic data from public sources — Yahoo Finance, the CFTC, the U.S. Bureau of Labor Statistics, the Federal Reserve Bank of St. Louis, the U.S. Securities and Exchange Commission and the Bank for International Settlements. These requests are outbound and contain no information about you.
We will also disclose data where the law compels it, or where necessary to establish or defend a legal claim.
5.How long we keep it
- Account data (email, name, hashed password, plan): for as long as your account exists, then deleted on request — see section 6
- Session tokens: 30 days, or immediately on sign-out
- Your watchlists, bookmarks and templates: until you delete them or close your account
- Payment records: retained as long as tax and accounting law requires, even after the account is closed. We will tell you if a request cannot be fully honoured for this reason.
- Market and macro data we have cached: no personal data is involved
6.Your rights under the Data Privacy Act
Under RA 10173 you have the right to:
- Be informed — how your data is processed, which is what this document sets out
- Access — obtain a copy of the personal data we hold about you
- Object and correct — have inaccurate data corrected, or object to processing
- Erasure or blocking — ask us to delete or block your data
- Data portability — receive your data in a machine-readable format where technically feasible
- Complain — lodge a complaint with the National Privacy Commission (privacy.gov.ph)
To exercise any of these, email [email protected] from the address on your account. We will acknowledge and act within 15 working days. The platform does not yet have a one-click export or delete button, so these requests are handled by a person — that is slower than a button, but it is honest about how it works today.
7.Security
Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations, so a database copy does not yield passwords. Session cookies are HttpOnly, Secure and SameSite. Session tokens are random and are invalidated on sign-out. Traffic is encrypted in transit (HTTPS). Access to the database is limited to the operator.
No system is perfect. If a breach affects your data, we will notify you and the National Privacy Commission as required by law.
8.Children
This service is for adults trading or studying financial markets, and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a minor has created an account, email us and we will remove it.
9.Changes to this policy
If this policy changes, the effective date above changes with it. Material changes affecting how we use your data will be announced on the site or by email before they take effect.