Public browsing
The site does not load advertising trackers or sell browsing data. A saved company watchlist stays in your browser’s local storage. External links open other providers’ services, which have their own privacy policies.
Purchases and passwords
Our hosted payment provider and its card processor handle payment details. We store the purchase reference, email, amount, currency and entitlement status. We do not receive or store complete card numbers. Supabase manages password authentication and email verification. The site uses an essential HttpOnly session cookie with a maximum one-hour lifetime.
Preventing account sharing
We allow one active browser session per member. A new sign-in replaces the previous session. We store a digest of the active session token, account identifier, email, sign-in time, expiry and cumulative sign-in count. We do not fingerprint devices or store raw IP addresses for member analytics. Temporary hashed request identifiers support rate limiting.
Page access records
We record the signed-in account, page identifier and access time when a protected page is requested. Only the authorised owner can view this dashboard. A request log does not prove that content was read. Protected pages display the buyer’s email as a personal-use watermark.
Email choices
The weekly buyer newsletter requires opt-in in your account. Brevo processes contact details, delivery and unsubscribe activity. You can unsubscribe using the email link or account controls. Essential purchase, confirmation and password-reset messages are separate from the newsletter.
Retention, providers and your rights
Page-access records are removed after 180 days by scheduled maintenance. Expired sessions and request-limit records are removed. Purchase records are retained as needed for access, dispute resolution and applicable accounting obligations. Hosting, Supabase, Payhip, the chosen card processor and Brevo may process data in other countries under their terms. Contact sponsor@bourseistanbul.com to request access, correction or deletion; some transaction records may need to be retained. The seller’s legal identity and correspondence address must be supplied before sales are enabled.