How we handle personal data.

Scope and controller

Eaglewing Research is an independent equity research provider based in Geneva, Switzerland. References to “Eaglewing Research,” “we,” “us,” or “our” in this notice refer to the research provider operating under that name.

This notice applies when you visit eaglewingresearch.com, read our research, submit an on-demand private company research request, or access an authorized administrator area. Eaglewing Research is the controller of personal data processed for these purposes.

Personal data we may process

Website and technical data

When you request a page, our hosting infrastructure may process technical information needed to deliver and protect the website. This may include your IP address, request date and time, requested URL, referrer, browser and device information, approximate location derived from an IP address, and diagnostic or security events.

Anonymous performance measurements

We use Vercel Speed Insights to understand website performance. Vercel states that these measurements are not tied to an individual visitor or IP address. The measurements may include the page route and URL, network speed, browser, device type, operating system, country, Web Vitals, and the time an event was received.

Administrator information

The public website does not offer visitor accounts. Authorized administrators use Supabase Authentication, which processes account identifiers such as an email address, authentication records, and session information. This information is used only to secure and operate the private publishing area.

Information you provide

When you submit an on-demand private company research request, we process the stock ticker and email address you provide, the time of submission, our request classification and queue status, and privacy-preserving fingerprints derived from your browser session, network address, and browser information. We encrypt the email address before storing it and use a keyed email fingerprint to maintain one contact record for that normalized email address. Every valid recorded ticker submission remains a separate request linked to that contact record, including repeated requests. We store keyed fingerprints, rather than raw network addresses or browser identifiers, for duplicate detection and abuse prevention. We do not request suitability, portfolio, risk-tolerance, or other personal financial-profile data for this service, and the requester’s identity does not alter the company analysis.

We also publish one aggregate count of all successfully recorded ticker requests. The count includes every valid recorded request irrespective of classification or later research status and does not reveal tickers, email addresses, or individual request details.

If you contact us through an external channel, we may process the details and content you provide so we can respond. Please do not send sensitive personal information that is unnecessary for your request.

Why we process personal data

We process information only where reasonably necessary to:

• deliver, maintain, and improve the website;
• understand technical performance and resolve errors;
• protect the website, database, and administrator area from misuse;
• authenticate authorized administrators and support research publishing;
• classify, prioritize, and manage on-demand private company research requests;
• measure aggregate request frequency, repeat use, and service retention so we can understand and improve the service;
• prevent abusive or excessive submissions through limited technical fingerprints;
• respond to communications and privacy requests; and
• comply with applicable legal obligations and enforce our rights.

Where another law requires a specific legal basis, we rely as appropriate on our legitimate interests in operating and securing the platform, steps connected with a request or agreement, compliance with legal obligations, or consent where consent is required.

Immediate request classification is an operational intake step. It does not produce investment advice, create an Official Eaglewing Pick, publish research, or make a decision with legal or similarly significant effects. Any later automated release decision evaluates only whether a company-research artifact satisfies the applicable EWRS evidence and integrity controls; it does not evaluate the requester or the suitability of an investment for that person. Submitting a research request does not subscribe you to promotional email. We do not sell personal data or use it for targeted advertising, and we will not use the stored address for promotional messages unless we introduce a separate lawful opt-in.

Service providers and international processing

We use selected providers to operate the platform:

• Vercel provides website hosting, delivery infrastructure, technical logs, and anonymous Speed Insights measurements.
• Supabase provides the database, private research-request storage, and administrator authentication infrastructure.
• Financial Datasets provides structured company financials, filings, and balance sheets for private company research.
• OpenAI provides bounded web search context and recent market reporting for company research. The system is designed not to send a requester’s email address or personal financial profile to the model.
• Google Gemini provides the core analytical engine for the EWRS private-research workflow. The system is designed not to send a requester’s email address or personal financial profile to the model.
• Resend provides email delivery for transactional service communications (immediate request acknowledgement and final outcome notifications, including secure private report links when research is completed).

These providers may process information in Switzerland, the European Economic Area, the United States, or other countries in which they or their subprocessors operate. When personal data is disclosed outside Switzerland, we seek to use the contractual, organizational, and technical safeguards made available by our providers and required by applicable Swiss data-protection law.

You can review the providers’ current information in the Vercel Privacy Notice, Vercel Speed Insights privacy documentation, Supabase Privacy Policy, Financial Datasets Privacy Policy, OpenAI Privacy Policy, Gemini API terms, and Resend Privacy Policy.

We may also disclose information when required by law, to protect rights or security, or to professional advisers who are subject to appropriate confidentiality duties.

Cookies and similar technologies

The public website does not currently use advertising cookies or nonessential cookies for behavioural tracking. Vercel Speed Insights reports anonymous performance measurements without identifying individual visitors.

The private administrator area uses strictly necessary first-party session cookies after an authorized administrator signs in. These cookies maintain and protect the authenticated session. Blocking them may prevent the administrator area from functioning.

We will revise this notice and, where required, introduce a consent mechanism before adding nonessential advertising or behavioural-tracking technologies.

Retention and security

We currently apply no automatic expiry to the encrypted contact identity and associated research-request history while this service operates. We retain these records to manage requests, prevent abuse, preserve request history, and measure aggregate usage and repeat engagement. This operational policy remains subject to valid deletion requests and any retention or deletion duty imposed by applicable law. Normalized source extracts and private research work products are designed for a 90-day content-retention period, while nonpersonal integrity hashes, cost records, and operational audit metadata are designed for three years. A future secure report link is designed to expire seven days after issuance; link expiry does not by itself delete the underlying request. Technical logs and performance information follow the retention settings and operational periods of the relevant service provider. Administrator account records are retained while access is authorized and for any reasonable period needed to protect the platform or meet legal obligations.

We use proportionate technical and organizational measures intended to protect information, including secure transport, application-level encryption for stored request email addresses, keyed fingerprints, row-level database controls, and restricted administrator privileges. No internet service can guarantee absolute security.

Your data-protection rights

Subject to the conditions and limits of applicable law, you may ask whether we process personal data about you and request access, correction, deletion, or another remedy available under Swiss data-protection law. Depending on where you live, you may have additional rights.

We may need to verify your identity before responding. You may also contact the Swiss Federal Data Protection and Information Commissioner about a data-protection concern.

Contact and changes

Privacy questions and requests may be sent to contact@eaglewingresearch.com or through the official Eaglewing Research LinkedIn page.

We may update this notice when our services, providers, or legal obligations change. Material changes will be reflected on this page with a revised effective date.

For the financial and research limitations that apply to our publications, please also read our Disclosures and Terms of Use.