Privacy Policy

Notstocks ("Notstocks", "we", "us", "our") operates notstocks.com and all related sites, applications and interfaces (the "Platform"), an 18+ prediction market on which users place wagers for entertainment. We are the data controller for the personal data described in this policy. You can reach us at privacy@notstocks.com.

Because the Platform is a gambling product, some of the data we process — age and identity verification, staking behaviour, responsible-gambling indicators and self-exclusion records — is processed specifically to keep minors and excluded players out and to protect players from harm.

This policy explains what personal data we collect, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, how we protect it, and what rights you have. It applies to visitors, registered users, listing submitters and anyone who contacts us.

This policy sits alongside our Terms & Conditions. Third-party services you reach from the Platform have their own policies; we are not responsible for them.

Data you give us:

• Account data — name, email address, password (stored only as a salted hash), display preferences.
• Verification data — where required, identity documents, date of birth (used to confirm you are 18 or over), address, nationality, and source-of-funds or source-of-wealth information.
• Financial data — deposit and withdrawal requests, payment references, wallet or account identifiers, transaction amounts and status.
• Player-protection data — any deposit, loss or stake limits you set, cooling-off requests, self-exclusion requests and the periods they cover, and anything you tell us about your gambling.
• Listing data — company names, websites, descriptions, logos and any other content you submit.
• Support data — the content of emails, complaints, reports and other correspondence.

Data generated by your use of the Platform:

• Wagering activity data — stakes placed and settled, open and closed positions, balances, winnings, fees, watchlists and searches.
• Responsible-gambling indicators — patterns such as rapidly increasing stakes, chasing losses, long unbroken sessions or repeated failed deposits, which we monitor to identify possible gambling harm.
• Technical data — IP address, approximate location derived from it (also used to check that you are not wagering from a blocked jurisdiction), device and browser type, operating system, language, referring pages, timestamps and interaction logs.
• Security data — authentication events, session identifiers, rate-limit and abuse-detection signals.

Data from third parties:

• Authentication providers — where you sign in with Google or Apple, we receive your name, email address and provider identifier. We never receive your password.
• Payment providers — payment status, reference identifiers, and limited fraud and compliance signals.
• Public sources — information about referenced companies gathered from publicly available websites and news sources. This concerns companies, not our users, although public business contact details may incidentally be personal data.

We do not knowingly collect special-category data (such as health or biometric data) and ask you not to send it to us. Where identity documents are required, we process them solely for compliance purposes.

Performance of a contract with you: creating and administering your account; accepting and settling wagers; maintaining balances, positions and history; processing deposits, winnings and withdrawals; handling listings and paid listings; providing support.

Compliance with legal obligations: age and identity verification; anti-money-laundering checks; sanctions screening; gambling-related record keeping, player-protection and reporting duties that apply to us; accounting and tax records; responding to lawful requests from authorities and gambling regulators.

Legitimate interests: keeping minors and self-excluded people off the Platform; detecting and preventing gambling harm; securing the Platform and preventing fraud, market manipulation, multi-accounting and bot activity; measuring and improving the service; debugging and capacity planning; enforcing our Terms; establishing, exercising or defending legal claims; managing risk; sending service messages about your account.

Consent: optional marketing emails, optional analytics or personalisation where required by law, and any use that we specifically ask you to agree to. You may withdraw consent at any time without affecting processing already carried out. We do not send gambling marketing to anyone who has self-excluded or opted out.

Vital or public interest: rarely, where necessary to prevent serious harm — including serious gambling harm — or to cooperate with authorities.

Automated processing: we use automated systems to detect abusive wagering patterns, suspicious payments, multi-accounting and signs of problem gambling. Such systems may result in limits, restrictions or closure of your account. You may ask for human review of any decision that significantly affects you by writing to privacy@notstocks.com.

Trading activity is displayed on the Platform in anonymised form: the public trade tape shows the listing, side, size, price and time, but not the identity of the trader.

We do not publish your name, email address, balance, holdings or portfolio to other users. If we ever introduce public profiles, leaderboards or social features, participation will be optional and clearly explained before you opt in.

Listing submissions may be displayed publicly, including any logo or description you provide. Do not submit personal data in listing content that you do not want published.

We do not sell your personal data. We share it only as described here:

• Service providers acting on our instructions — hosting and database infrastructure, authentication, email delivery, error monitoring, analytics, customer support tooling and AI-analysis providers. They may only process data for us and under contract.
• Payment, age-verification and compliance providers — to process deposits and withdrawals, confirm that you are 18 or over, verify identity, screen against sanctions lists and prevent fraud. These providers act as independent controllers for their own compliance duties.
• Gambling regulators and self-exclusion schemes — where we hold or apply for a gambling licence, we share data with the competent gambling authority and with any national self-exclusion register that applies to us, to check whether you are excluded and to record exclusions you request.
• Authorities and professional advisers — where required by law, court order or regulatory request, or to establish, exercise or defend legal claims.
• Business transfers — in connection with a merger, acquisition, reorganisation or sale of assets, subject to this policy continuing to apply.

Analytical content about referenced companies is produced using third-party AI infrastructure. We do not send your account data, balances or personal identifiers to those systems as part of that analysis.

Our providers may process data outside your country, including outside the European Economic Area. Where that happens, we rely on an adequacy decision, on the European Commission's Standard Contractual Clauses, or on another lawful transfer mechanism, together with additional technical and organisational safeguards where needed. You may request information about the safeguards that apply by writing to privacy@notstocks.com.

We use strictly necessary cookies and local storage to keep you signed in, to remember your preferences, to maintain session security and to apply rate limits. These are required for the Platform to function and cannot be switched off from within the Platform.

Where we use optional analytics or performance technologies, we ask for your consent first where the law requires it, and you can withdraw that consent at any time.

You can block or delete cookies in your browser settings, but the Platform may not work correctly if you block strictly necessary cookies.

We keep personal data only as long as necessary for the purposes described, then delete or anonymise it. Indicative periods:

• Account and profile data — for the life of the account and up to 12 months after closure, unless a longer period is required.
• Transaction, deposit, withdrawal and fee records — up to 7 years (or longer where local accounting and anti-money-laundering law requires).
• Identity-verification records — up to 5 years after the end of the relationship, as required by anti-money-laundering rules.
• Self-exclusion, cooling-off and player-limit records — for the duration of the exclusion or limit and at least 7 years afterwards, so that we can keep excluded players out and evidence that we did so.
• Responsible-gambling monitoring records and any interaction with you about your gambling — up to 5 years.
• Security, abuse-detection and access logs — typically up to 24 months.
• Support correspondence — up to 3 years after the matter is closed.
• Anonymised market and price data — retained indefinitely; it no longer identifies you.

Where a legal claim, investigation or regulatory request is pending, we retain relevant data until it is resolved.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed password storage, row-level access controls in our database, least-privilege access for staff and systems, server-side validation of all balance- and price-affecting operations, logging of privileged actions, and monitoring for abuse.

No system is completely secure. You are responsible for using a strong, unique password, keeping your credentials confidential and notifying us immediately at security@notstocks.com if you suspect unauthorised access.

Where a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours where required, and we will inform affected users without undue delay where the risk is high.

Subject to the conditions and exceptions in applicable law, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have data deleted where we no longer have a lawful basis to keep it.
• Restriction — limit our processing in certain circumstances.
• Portability — receive data you provided to us in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent.
• Human review — of automated decisions that significantly affect you.
• Complain — to the data protection authority in your country of residence.

To exercise a right, email privacy@notstocks.com from your registered address. We respond within one month and may extend by two further months for complex requests, telling you why. We may need to verify your identity. We may refuse or charge a reasonable fee for manifestly unfounded or excessive requests.

Please note that erasure does not extend to records we are legally required to keep, such as transaction and anti-money-laundering records, nor to anonymised market data that no longer identifies you.

EEA and UK: where the GDPR or UK GDPR applies to our processing, the legal bases above are those in Article 6 GDPR (and the UK GDPR). Notstocks is established in Anjouan, an autonomous island of the Union of the Comoros, and is not established in the EEA; you may complain to the data protection authority in your country of residence.

California: we do not sell or share personal information as those terms are defined in the CCPA/CPRA. California residents may request disclosure, deletion and correction, and may not be discriminated against for exercising those rights.

Other jurisdictions: where local law grants you broader rights than this policy describes, those rights apply.

Notstocks is an 18+ gambling product. It is not intended for anyone under 18, and we do not knowingly collect data from children. We verify age at registration and may require documentary proof of age at any time.

If we learn that an account belongs to someone under 18, we will close it, void the wagers, return the deposited balance where lawful to do so, and delete the data we are not required to keep. If you believe a child has registered, contact privacy@notstocks.com.

We do not target gambling marketing at minors and do not knowingly profile anyone under 18.

You can ask us at any time to set a deposit, loss or stake limit, to apply a cooling-off period, or to self-exclude, by writing to support@notstocks.com. We record these requests as personal data and act on them as described in our Terms.

Because these records exist to protect you and to satisfy our player-protection duties, we cannot delete a self-exclusion or limit record on request while it is in force or during the retention period that follows it — deleting it would let the exclusion be bypassed.

If you tell us about gambling harm, we treat that information as confidential and use it only to protect you, to decide on limits or exclusion, and to keep the records our duties require.

We may update this policy to reflect changes to the Platform, to our providers or to the law. The current version is always published here with a "last updated" date, and material changes will be notified through the Platform or by email where reasonably practicable.

For any privacy question, request or complaint, contact privacy@notstocks.com. For security reports, contact security@notstocks.com. For other legal matters, contact legal@notstocks.com.