Privacy Policy

1. Who we are and what this policy covers

Walter Grades, Inc. ("Walter," "we," "us," "our"), a Delaware corporation, operates the website at waltergrades.com and related web and mobile applications (together, the "Service"). The Service is an analytics and ratings platform that evaluates investment newsletters and presents grades, scores, and related analytics. For users in the European Economic Area and the United Kingdom, Walter Grades, Inc. is the data controller of your personal data.

This Privacy Policy explains what information we collect, how and why we use it, when we share it, how long we keep it, and the choices and rights you have. It applies to visitors to our site, registered users, and users who connect a Google account to the Service.

Walter is an analytics and information provider — not a financial adviser. Walter is not a registered investment adviser, broker-dealer, or financial planner. Our grades, scores, and analytics are statements of opinion and informational analysis. They are not investment advice and not recommendations to buy, sell, or hold any security.

2. How Walter works with your Gmail — please read this first

Here is exactly what happens, in plain language:

• You choose senders first. Walter accesses nothing until you select specific newsletter senders from your list.
• When you authorize Walter through Google's standard OAuth flow, Walter makes two changes in your Gmail settings — and only these two: it registers a dedicated Walter forwarding address unique to your account, and it creates a filter for each sender you selected that forwards matching messages to that address.
• From then on, Gmail forwards to Walter only the messages from your selected senders. Messages from any sender you did not select never reach Walter. Walter never calls Gmail APIs to read message content.
• Everything is visible and revocable. The filters and forwarding address Walter creates appear in your own Gmail Settings. You can remove any individual rule, change your selected senders in Walter, or disconnect entirely at any time. When you disconnect inside Walter, we immediately revoke and delete our access tokens and remove the filters and forwarding address we created, where Google permits us to do so. If you instead revoke Walter's access from your Google Account first, any remaining rules stay visible in your Gmail Settings and can be removed there directly.

Google API scopes we request, and why:

We request no scope that reads, modifies, sends, or deletes mailbox content.

Google API Limited Use disclosure. Walter's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We treat newsletter emails forwarded from your Gmail as Google user data and apply the same protections to them. We use this data only to provide and improve the user-facing features of the Service described in this policy, and for no other purpose.

3. Information we collect

Information you give us:

• Account information: name, email address, password (stored hashed), and account settings.
• Your selected newsletter senders: the list of senders you authorize Walter to receive.
• Subscription costs you choose to enter, so Walter can show what each newsletter costs you versus what it has produced.
• Payment information: if you purchase a paid plan, payment is processed by our payment processor, Stripe. We do not store full card numbers.
• Communications: messages you send us (support, feedback).

Information we collect automatically:

• Usage and device data: pages viewed, features used, IP address, browser/device type, and similar product analytics, collected via cookies and similar technologies. This analytics data never includes newsletter content (see Section 7).

Cookies and similar technologies. We use two kinds: (a) essential cookies required for sign-in, security, and core functionality, and (b) analytics cookies that help us understand how the Service is used. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working. We honor the Global Privacy Control (GPC) signal where required by applicable law. Because there is no common industry standard for "Do Not Track" browser signals, we do not respond to DNT signals at this time.

Information we receive through your Gmail connection:

• OAuth tokens, encrypted at rest, limited to the settings scopes listed in Section 2.
• Newsletter emails forwarded from your selected senders — sender, date, and content, including any trade ideas, recommendations, or performance claims those newsletters contain.

4. How we use information

We use information for two distinct purposes. We keep these separate on purpose, and we describe both plainly.

(A) To provide the Service to you:

• Authenticate you and operate your account.
• Receive and analyze newsletters from your selected senders.
• Generate and display your scorecards, position tracking, exit alerts, spend-versus-return views, and related analytics.
• Provide customer support and send service-related messages.
• Maintain security and prevent abuse.

(B) To build the Walter ratings and analytics displayed in the Service:

• Newsletter content processed through the Service is extracted into a pooled dataset that powers the grades, scores, peer-group comparisons, and track records displayed in the Service — to you and to other users. The ratings are a user-facing feature of the product; they are the product.
• We use this pooled dataset to develop, test, and improve our rating methodology and to produce aggregated, de-identified insights about newsletters and the newsletter industry.
• Your authorization for this use is obtained separately and explicitly when you connect your account. Section 5 describes it in detail.

Automated parsing and classification of newsletter content is performed solely to provide the user-facing features described in this policy. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models.

5. The Walter ratings database

• What persists and what does not. Raw newsletter messages associated with your account are personal data and are deleted as described in Section 8. What persists in the ratings database is newsletter-level derived analytics — grades, scores, extracted trade records, and track records that describe the newsletters, not you.
• De-identification. The grades and analytics we publish or commercialize describe newsletters. We do not attach your identity to any public or commercial output.
• Persistence. Derived, de-identified analytics may be retained after you disconnect Gmail or delete your account, because they are no longer associated with you and they form the history and integrity of the ratings.
• Methodology independence. Walter's economics are not tied to grade outcomes. Newsletters and publishers cannot pay to influence their grade.

6. How we share information

We share information only as described here:

• Service providers (subprocessors) that act on our instructions under contracts limiting their use of data to providing services to us: cloud hosting and storage (Amazon Web Services), payment processing (Stripe), transactional email delivery, product analytics (usage data only — never newsletter content), and AI processing providers used solely to parse newsletter content under terms that prohibit them from using that data to train their models or for any purpose of their own. A current subprocessor list is available on request at support@waltergrades.com.
• Aggregated and de-identified outputs: we publish and may commercialize grades, scores, and aggregate analytics. These do not identify you.
• Legal and safety: where required by law, legal process, or to protect the rights, safety, and security of Walter, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets. Any successor remains bound by the Limited Use requirements with respect to Google user data.
• With your direction or consent.

The Service and the newsletters we analyze may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and this policy does not apply to them.

7. Limited Use commitments — what we never do

• We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.
• We do not use Google user data for advertising of any kind, and we do not transfer it to any party to build advertising profiles.
• We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
• We do not send newsletter content or any Gmail-derived data to third-party analytics or advertising tools.
• Humans do not read your Gmail-derived data, except: (a) with your explicit consent; (b) where necessary for security purposes or to investigate abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified.
• We do not use Google user data for any purpose other than providing and improving the user-facing features of the Service described in this policy.

8. Data retention and deletion

• Active accounts: your data is retained while your account is active.
• When you disconnect Gmail: we revoke and delete our OAuth tokens immediately, remove the filters and forwarding address we created (where Google permits), and stop receiving your newsletters immediately.
• When you delete your account: your personal data — account information, selected sender lists, OAuth tokens, and raw newsletter messages associated with your account — is deleted within 30 days. Copies in encrypted backups are purged within 90 days. We retain data longer only where required by law, or as needed to complete a transaction or resolve a dispute.
• What persists: derived, de-identified newsletter-level analytics, as described in Section 5.
• How to delete: use account deletion inside the Service, or email support@waltergrades.com. We honor verified requests as required by applicable law. You can also review or revoke Walter's access at any time from your Google Account permissions page.

9. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS) and at rest, encrypted storage of OAuth tokens using managed keys, least-privilege access controls, and logging that excludes message content and credentials. Our security program is built to the OWASP ASVS-based standard required under Google's Cloud Application Security Assessment (CASA) framework for Gmail restricted scopes, with independent assessment and annual revalidation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your privacy rights

California (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect (the categories are described in Section 3) and how we use and disclose it; to access and delete it; to correct inaccurate information; and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. To exercise these rights, email support@waltergrades.com. We will verify your request using your account email address and, where needed, additional account details. You may designate an authorized agent to act for you; we will require proof of authorization. We will not discriminate against you for exercising any of these rights.

Other U.S. state privacy laws. Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale of personal data, or profiling with legal or similarly significant effects. To exercise these rights, or to appeal a decision we make on a rights request, email support@waltergrades.com; appeals are reviewed by someone other than the original decision-maker, and we will respond within the timeframe your state's law requires.

EEA / UK (GDPR), where applicable. Our legal bases are: performance of our contract with you (providing the Service), your consent (Gmail connection and ratings-database use, which you may withdraw at any time), and our legitimate interests (operating, securing, and improving the Service and ratings) balanced against your rights. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority in your country of residence.

11. Children

The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn we have collected such information, we will delete it.

12. International users and data transfers

Walter is operated from the United States, and your information will be processed and stored in the U.S. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Changes to this policy

We may update this policy. We will post the updated version with a new effective date. For material changes affecting how we handle Gmail-derived data or the ratings database, we will provide prominent notice and obtain renewed consent where required.

14. Contact

Questions or requests: support@waltergrades.com

Walter Grades, Inc., a Delaware corporation.