Privacy policy
Last updated: 7 November 2026
Controller
SSM Ventures UG (haftungsbeschränkt), Kleestädter Straße 19, 64823 Groß-Umstadt, Germany, represented by its managing director Sven Brostmeyer. For privacy questions, write to datenschutz@meqiri.com. We are not required to appoint a data protection officer because fewer than 20 people regularly work with personal data at our company (Section 38 BDSG).
The essentials
We do not sell data and, without your consent, use neither advertising trackers nor third-party analytics. We count visits on our own server without a cookie. The site, the database and the backups are located in Germany. What you create in your account is used only for the features you use and is not passed on. Exception: if you agree in the bar, the site loads the Meta Pixel, which we use to measure how our ads perform.
Visiting the site
The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Nuremberg data centre. We have a data processing agreement with Hetzner (Art. 28 GDPR). To deliver the site, the server processes your IP address, the time, the requested address and your browser identifier with every request. We do not keep access logs. To protect against overload, the server briefly counts requests per IP address in memory without storing them. If the software reports an error, it stays in the server's system log for at most 30 days. All of this also applies when another site embeds our Fear and Greed image: your browser then fetches the image from us. The connection is encrypted. The legal basis is our legitimate interest in offering the site securely and reliably (Art. 6(1)(f) GDPR).
Visit counting
We count visits on our server, without a cookie and without any program in your browser. The server only evaluates what your browser sends anyway when it requests a page: the requested address with campaign details (such as utm_source), the page you came from and your browser identifier. We store nothing on your device for this and read nothing from it (Section 25 TDDDG). The server forms a value from the IP address, the browser identifier and a random value that changes daily, so that a visit counts only once per day and its pages are counted together. This value is pseudonymous. If you are signed in, the count only distinguishes whether your account is from today or older. We do not store the IP address and keep this value for at most two days. After that only totals per day, page, source and device remain (type of device, operating system and browser from the browser identifier). The legal basis is our legitimate interest in improving the site (Art. 6(1)(f) GDPR).
Cookies and browser storage
Without consent we only set cookies that the site technically needs (Section 25(2) no. 2 TDDDG): meqiri_session keeps you signed in, 90 days. meqiri_google links your return to the sign-in you started with Google, 10 minutes. meqiri_etoro_oauth links your return to the eToro connection you started, 10 minutes. meqiri_testzeit remembers that you want to start the trial after signing in, 1 hour. meqiri_einwilligung remembers your choice in the consent bar, 1 year. Without an account, the site stores your watchlist and portfolio in your browser's storage (localStorage). With an account, your browser also remembers the portfolio you last selected, your setting for the tax allowance, the fund type of your ETFs in the tax tab, which columns you chose in the screener and whether you want to see all charts at once. If a page reloads after an error, it remembers until you close the tab when that happened (sessionStorage), so that the page does not keep reloading. This data stays on your device. For prices and dates your browser sends only the ticker symbols to our server, which does not store them. You can delete this data in your browser settings. If you switch on notifications, your browser also stores our service worker (see “Notifications on your device”).
With your consent
If you agree in the bar at the bottom of the page, the cookie meqiri_quelle remembers for 90 days which ad, campaign or page first brought you here. If you create an account during that time, we copy this first source into your account to see which advertising brings new customers. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Your browser then also sends a short signal to our server whenever you move to another page of MEQIRI and every 30 seconds while the page is visible: the address of the page or the time it was visible. This lets us count page views and time on page, only as totals per day. The cookie meqiri_besucher stores only the date of your first visit for one year so that we can recognise returning visits; it contains no identifier. You can withdraw your consent at any time via “Cookie settings” in the footer; we then delete both cookies immediately and your browser stops sending signals. We delete the source in your account on request, at the latest together with the account. The Meta Pixel then also loads, see the next section.
Meta Pixel
If you agree in the bar, the site also loads the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). We use it to measure how our ads on Facebook and Instagram perform. For this, your browser loads a program from Meta and tells Meta which pages you open on our site and whether you created an account or took out a subscription, for a subscription with amount and currency. Meta also receives your IP address, your browser identifier and the cookies _fbp and, if you came from an ad, _fbc (90 days each). We do not pass on your email address, your account, your watchlist or your portfolio. If you are signed in to Facebook or Instagram, Meta can link this information to your account there. So that we report a new account and a subscription only once, the cookie meqiri_meta_ereignis (one hour) and your browser's storage remember this step. We and Meta are joint controllers for collecting the data and transmitting it to Meta (Art. 26 GDPR). The agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for what it does with the data afterwards, see facebook.com/privacy/policy. Meta may transfer the data to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). How long Meta keeps the data is governed by Meta's privacy policy. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings” in the footer. The pixel then stops immediately, we delete its cookies, and from the next page view on it no longer loads.
Account and signing in
An account needs only your email address; we have no passwords. To sign in, we send you a code with a link that is valid for 15 minutes. You can also sign in with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We then receive only your verified email address from Google. What Google processes during sign-in is governed by Google's privacy policy; data may be transferred to the USA. For your account we store your email address, plan, language, mail settings, the day it was created and your last visit. The legal basis is the user agreement (Art. 6(1)(b) GDPR).
What you create in your account
We store your watchlist, portfolio with transactions and savings plans, household budget, price alerts, rules, saved searches, tags and your own weighting in your account so that the features work and you have them on every device. If you upload a file from your broker, our server reads only purchases, sales, dividends and splits from it; we do not store the file itself. To identify securities, we query Financial Modeling Prep and OpenFIGI (Bloomberg) with the ISIN only, never with data about you. For the household budget, your browser reads the file and sends only the transaction lines. Transaction texts may contain names of other people; what they say is up to you. The legal basis is the user agreement (Art. 6(1)(b) GDPR).
Connecting crypto exchanges
If you connect Bitvavo, OKX, BingX or Bitget to your portfolio, we store the API key you created at the exchange (key, secret and, for OKX and Bitget, the passphrase). We also store the exchange, when you connected and last synced, and the reason if a sync fails. Every night and whenever you ask, we use the key to fetch your holdings and history from the exchange (buys, sells, deposits, withdrawals, conversions, staking rewards, futures results and fees) and add the resulting transactions to your portfolio. The purpose is to keep your portfolio in MEQIRI; the legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We only accept keys that can do nothing but read. At OKX, BingX and Bitget, a key with trading or withdrawal rights is rejected and not stored. Bitvavo does not show a key's rights. There you confirm when connecting that the key can only view, and we only call interfaces that read. The key is stored encrypted with AES-256 on our server. It is never shown to you or anyone else, and it is only decrypted for the requests to the exchange, to which we send it for that purpose. We keep it until you disconnect or delete your account, then delete it immediately. Imported transactions stay in your portfolio until you delete them or your account. You can also delete the key at the exchange at any time, after which no further requests are possible. The connection may fail if an exchange changes its interface or is unavailable.
Connecting eToro
If you connect your portfolio with eToro, you sign in at eToro and allow MEQIRI there to read your portfolio. We never learn your eToro password. For this, eToro sends us an access grant (access and refresh token) and an identifier for your account that eToro creates only for MEQIRI. We store the access grant encrypted with AES-256, together with when you connected and last synced and the reason if a sync fails. Every night and whenever you ask, we use it to fetch your portfolio, trading history and dividends from eToro and add the resulting transactions to your portfolio. The access grant only allows reading, no orders and no withdrawals. The purpose is to keep your portfolio in MEQIRI; the legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). If you disconnect or delete your account, we revoke the access grant at eToro and delete it immediately. Imported transactions stay in your portfolio until you delete them or your account.
Emails
We send emails via Brevo (Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France) under a data processing agreement; processing takes place in the EU. We send you sign-in codes, the morning email and price alerts according to your settings, confirmations of cancellation and withdrawal, and replies to your messages. The morning email and alerts contain values from your watchlist and portfolio. You can unsubscribe at any time in your account's mail settings. Brevo counts opens and clicks only anonymously, without linking them to you. We keep a record of which email was sent on which day for a little over a year so that none arrives twice. During the trial we also keep a record of the warnings the morning email sent you, to summarise them on day 7 and in the reminder before the trial ends. We delete this after 30 days. The legal basis is the user agreement (Art. 6(1)(b) GDPR). The reminder before the trial ends also mentions the subscription. The legal basis for this is our legitimate interest in advertising our own similar offers (Art. 6(1)(f) GDPR, Section 7(3) UWG). You can object to this at any time, with one click on the link in the email or when you start the trial, at no cost other than the usual transmission costs (Art. 21(2) GDPR).
Notifications on your device
If you switch on notifications in your account, your browser asks for permission. It then gives us an address at the notification service of its maker (Google for Chrome, Apple for Safari, Mozilla for Firefox, Microsoft for Edge) and two keys. We store them with your account, together with device and browser (such as “iPhone, Safari”), and use them to send short notifications from your morning email: warning signals for your holdings and triggered price alerts. The content is encrypted; the service only sees the address, time and size. For this, your browser stores a small program of ours on the device (service worker). It stores no pages and no data. The legal basis is the user agreement (Art. 6(1)(b) GDPR); storing it on the device is necessary for this function you asked for (Section 25(2) no. 2 TDDDG). You can switch notifications off at any time in your account or in your device settings. We then delete the address and keys, as we do when the service reports the address as expired.
Subscription and payment
Paid subscriptions are handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). We pass on your email address, an internal account number, the plan, whether the launch price applies, and the time you agreed to immediate activation. You enter your payment details directly with Stripe; we never see them. From Stripe we receive the customer number, amounts and the status of your subscription. Stripe also processes data under its own responsibility, for example against fraud, and may transfer it to the USA. The legal basis is the contract (Art. 6(1)(b) GDPR). We keep invoices and payment records until the end of the eighth year after the year of payment, and bookkeeping entries and financial statements until the end of the tenth year (Art. 6(1)(c) GDPR with Section 147 AO and Section 257 HGB).
Cancellation and withdrawal
You can cancel and withdraw without signing in. For this we store your email address, for a cancellation its type, the date you want it to take effect and, for an extraordinary cancellation, the reason, for a withdrawal your name, and also the contract, the time of receipt, your note if you write one, and what we did in response. You receive a confirmation of receipt by email, and a copy goes to our mailbox; for a withdrawal it also contains the order date if you give it. We send the confirmation because the law requires it (Art. 6(1)(c) GDPR with Section 312k(4) and Section 356a BGB). We keep the details as proof until the end of the third year after receipt, even if you delete your account (Art. 6(1)(f) GDPR).
Contact
If you write to us via the contact form or by email, your message arrives in our mailbox at united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany (data processing agreement). We forward messages from the form to this mailbox via Brevo (see Emails). We do not store it in the database. We delete messages once the matter is settled unless commercial or tax law requires longer retention. The legal basis is your request (Art. 6(1)(b) or (f) GDPR).
Waiting list before launch
Until the opening on 7 November 2026 you could sign up on meqiri.com for an email at launch. New sign-ups are no longer possible. We store the address, the time of sign-up and the text that was agreed to. We will not send a launch email, and we will delete the addresses by 30 November 2026. The legal basis is consent (Art. 6(1)(a) GDPR).
Partner programme
If you sign up with a partner's code, we store the code with your account to calculate the partner's commission. The partner only sees how many sign-ups came through the code, on which day and whether they pay, never names or addresses. For partners we store name, email address, code, commission rate and statements. The legal basis is the contract with the partner and our legitimate interest in correct statements (Art. 6(1)(b) and (f) GDPR).
Sharing
The share buttons are plain links. Only when you click one does the service open, for example X or WhatsApp, under its own privacy rules. We do not load any software from these services. Images of your portfolio are created on our server and go only to your device; amounts are pixelated at first.
Features using AI
For some features we use the language model Claude from Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland ("Anthropic"). "Explain this" on stock pages: Claude explains a stock's MEQIRI Score and key figures in plain language. For this we send only public data about the stock to Anthropic, nothing about you, your account, your watchlist or your portfolio. We store the explanation per stock and day and show it to everyone in the same way. No personal data is processed. AI search in the screener: if the search does not fully understand your text, we send it from our server to Anthropic and Claude turns it into filters. We transmit only the search text, not your IP address or your account. Please do not enter personal information; a filter holds back sentences about your personal situation beforehand. If your text nevertheless contains personal data, we process it only to run your search. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f), our legitimate interest in a search in plain language; you can object under Art. 21 GDPR. We do not store the search text permanently: it is kept only in the server's memory so that the same search is not computed again, and it is gone after the next restart. In addition, Claude writes short explanations about companies and coins at night from public sources, for coins with a web search. No data about you is processed. Anthropic processes the data as our processor under Art. 28 GDPR and uses further service providers, mainly data centres of Google Cloud, Amazon Web Services and Microsoft Azure. Processing also takes place in the USA. Anthropic is not certified under the EU-US Data Privacy Framework; the transfer is safeguarded by the EU standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our contract with Anthropic. Anthropic deletes inputs and outputs no later than 30 days after receipt, keeping them longer only in case of a breach of its usage policies (up to two years) or where the law requires it, and does not use them to train its models.
Public data about insiders
For insider transactions we show names, positions and transactions of officers, directors and major shareholders from mandatory filings with the US Securities and Exchange Commission (EDGAR database). This information is public. We process it to inform investors about such transactions (Art. 6(1)(f) GDPR) for as long as we display the filing. Those concerned can object (see below).
Data sources without personal data
Our server fetches prices, metrics and market data from providers such as Financial Modeling Prep, CoinGecko and DefiLlama and from authorities such as the SEC and the ECB. We send only public ticker symbols, never data about you. We serve fonts ourselves; the site does not load anything from third-party servers. The exception is the Meta Pixel if you agree (see there).
Recipients at a glance
Hetzner (server and backups), Brevo (emails), united-domains (mailbox), Stripe (payment), Google (only if you sign in with Google), Financial Modeling Prep and OpenFIGI (ISINs only). If you switch on notifications, also the notification service of your browser (Google, Apple, Mozilla or Microsoft). If you connect a portfolio, also Bitvavo, OKX, BingX, Bitget or eToro, which receive your key or access grant and our requests. If you choose another provider's payment method at checkout, such as Klarna, that provider receives the payment data under its own rules. Authorities receive data only where the law requires us to provide it. We do not sell data. For the AI features, also Anthropic. With your consent, also Meta (Meta Pixel).
Transfers to third countries
Server, backups, emails and mailbox are located in the EU. Stripe and Google may transfer data to the USA. Both are certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). Financial Modeling Prep and OpenFIGI in the USA receive only ISINs, no personal data. The notification services of the browsers may deliver notifications via the USA. Google and Microsoft are certified under the EU-US Data Privacy Framework, Apple and Mozilla are not. We transfer the address and the encrypted notification to them because you switch on notifications on your device (Art. 49(1)(b) GDPR). If you connect an exchange or eToro, your key or access grant and our requests go to their servers: Bitvavo and eToro are based in the EU, and so is OKX for customers in the EEA (Malta). BingX and Bitget are based outside the EU, as is OKX's global access, which we use if the EEA access does not know your key. There is no decision of the European Commission on an adequate level of protection for these countries. We transfer the data there because you request the connection to keep your portfolio (Art. 49(1)(b) GDPR). Anthropic also processes the data of the AI features in the USA, safeguarded by the EU standard contractual clauses (Art. 46(2)(c) GDPR). With your consent, Meta may transfer the Meta Pixel data to the USA. Meta is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
How long we keep data
Your account and everything you create in it: until you delete your account. Sign-in: sessions end 90 days after your last visit, sign-in codes after 15 minutes. We count requested codes and failed attempts per address for 24 hours, stored only as a hash. We delete expired ones every night. Visit counting: values for at most two days. Waiting list: until 30 November 2026. Cancellation and withdrawal: until the end of the third year after receipt. Payments and invoices: until the end of the eighth year after the year of payment, bookkeeping entries and financial statements until the end of the tenth year (commercial and tax law). Record of sent emails: a little over a year. Morning email warnings during the trial: 30 days. Devices for notifications: until you switch them off, delete your account or the service reports the address as expired. Sent notifications: 30 days. Error logs 30 days, logs of the nightly runs 90 days. Backups: daily ones 14 days, monthly ones 12 months. Whatever you delete disappears from the backups by then at the latest. Meta Pixel: the cookies _fbp and _fbc 90 days, meqiri_meta_ereignis one hour, at Meta according to its privacy policy.
Deleting your account and downloading your data
In your account you can download all stored data as a file and delete your account. If a subscription is still running, please cancel it first. After deletion only payments, cancellations and withdrawals remain for the periods above, along with your customer record at Stripe under its own periods.
Security
The connection is encrypted, and the server and backups are located in Germany. Sign-in works without passwords, we store session keys only as a hash, and the server can only be accessed with a digital key.
No automated decisions
The MEQIRI Score rates securities, not you. We make no automated decisions within the meaning of Art. 22 GDPR and do not build a profile of you.
Do you have to provide data
You can use most pages without an account. An account needs your email address, and a subscription also needs your payment details at Stripe. Without them it does not work.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to datenschutz@meqiri.com. You can also lodge a complaint with a supervisory authority (Art. 77), for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, P.O. Box 3163, 65021 Wiesbaden, Germany.
Right to object
Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing this data unless we can demonstrate compelling legitimate grounds.
Changes
We update this policy when features or service providers change. The version on this page applies. This is a translation; the German version prevails.