Insider Intel ("we", "us", "our") operates the platform at herriot.ai — a tool for monitoring SEC Form 4 insider-trading filings and generating AI-assisted insights. The platform is currently in closed alpha and accessible by invitation only.
For any privacy-related questions during the alpha period, contact us using the feedback form or email privacy@herriot.ai.
We collect only what is necessary to provide the service:
| Category | Data collected | When |
|---|---|---|
| Account | Email address, password (bcrypt-hashed — we never store the plaintext), first name, organisation name | At sign-up |
| Alert preferences | Alert rule configuration (tickers, transaction types, delivery channels) | When you create alert rules |
| Watchlist | Ticker symbols you add to your watchlist | When you add tickers |
| Feedback | Feedback type, detail text, and optionally your email and first name if provided | When you submit feedback |
| Server logs | IP address, browser user-agent, pages visited, timestamps — retained in standard Railway infrastructure logs | Automatically on each request |
We do not collect payment card details, government identifiers, or sensitive personal data.
We do not use cookies for tracking or advertising. A session token (JWT) is stored in your browser's local storage solely to keep you signed in.
We use personal data for the following purposes only:
We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.
The core content of the platform — SEC Form 4 filings, company details, and insider transaction records — is sourced from the U.S. Securities and Exchange Commission's public EDGAR database. This is public-domain government data, not personal data we collect from you.
AI-generated summaries are produced by Anthropic's Claude API using publicly available filing data. No personal account information is included in those API calls.
We do not sell, rent, or trade your personal data. We share it only with the following infrastructure providers, under contractual data-processing agreements:
We may disclose personal data if required by law, court order, or to protect the rights and safety of users or the public.
We retain your account data for as long as your account is active. Feedback submissions are retained for product improvement purposes for up to 12 months. Server logs are retained for up to 30 days.
If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law.
All data is transmitted over TLS (HTTPS). Passwords are stored using bcrypt with a cost factor appropriate for the hardware. Authentication tokens are short-lived JWTs. Access to the production database is restricted to the application service.
During the alpha period, the platform is protected by an additional HTTP Basic Auth gate. No unauthorised external access to the database has occurred to our knowledge.
Depending on where you are located, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us via the feedback form or at privacy@herriot.ai. We will respond within 30 days.
The platform is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We will update this policy as the platform evolves. Material changes will be communicated by email to registered alpha users before taking effect. The "last updated" date at the top of this page will reflect the most recent revision.