Privacy Policy

1. Information we collect

Information you provide: your email address and password when you create an account; your chosen username; the portfolio holdings you enter (such as tickers, position sizes, share counts, and asset types); any feedback you submit; and your email if you join a waitlist or newsletter. Authentication is handled by Supabase; we do not store your password in readable form.

Information collected automatically: basic usage and device data (such as pages viewed, approximate performance metrics, IP address, and browser type) through Vercel Analytics and Speed Insights, which are designed to be cookieless and not to build cross-site advertising profiles; and essential cookies used to keep you signed in.

Information from third parties: if you sign in with Google, we receive your basic profile (name and email); if you subscribe to a paid plan, our payment processor (Stripe) provides us with subscription and billing status. Stripe handles card data under PCI-DSS; we do not receive or store full payment card numbers.

2. Categories of information and how they are used

For California residents and for transparency generally:

• Identifiers (email, username, IP) — from you and your device — to create and secure your account.
• Financial information (portfolio holdings, tickers, position sizes) — from you — to compute analytics, scores, and projections.
• Commercial information (subscription and billing status) — from Stripe — to manage paid plans.
• Internet/usage activity — from your device — for security, analytics, and improvement.
• Inferences (scores, rankings, archetypes) — generated by us — to provide the Service.

We treat your portfolio holdings as sensitive, apply least-disclosure, and never sell them.

3. Data controller and legal bases

Finsight Labs Ltd is the data controller responsible for your personal data. Under the UK GDPR (and the EU GDPR for users in the EEA), we rely on: performance of a contract (account, holdings, scores, subscriptions); our legitimate interests (security, rate limiting, product improvement); your consent (marketing email, which you may withdraw); and legal obligation (financial and tax records).

4. How we share information

We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals. We share information with service providers who process data on our behalf: Supabase (authentication and database), Vercel (hosting and analytics), Stripe (payments), Upstash (rate limiting), and Google (sign-in, if used). When we retrieve market data from providers such as Financial Modeling Prep, Yahoo Finance, CoinGecko, FRED, and Dataroma, we send asset identifiers (tickers), not your personal information. We may also disclose information to comply with law, to protect our rights, and in connection with a merger or acquisition.

5. Public information

If you choose to share a competition result or share card, certain information becomes publicly visible and may be indexed by search engines — your username, archetype, competition rank, and risk metrics. Do not use a username or enter information you are unwilling to have shown publicly. (Separately, our featured investor profiles display public SEC Form 13F filing data for well-known public figures and funds, not the holdings of ordinary users.)

6. Google user data

When you sign in with Google, we access only your basic profile (name and email) to create and authenticate your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

7. Cookies

We use essential cookies to keep you authenticated and to operate the Service, and limited, cookieless analytics to understand usage and performance. You can control cookies through your browser settings, but disabling essential cookies may prevent you from signing in.

8. Data retention

We retain holdings, scores, and account data while your account is active, and delete them on account deletion (subject to backups expiring on a rolling basis). Billing records are retained as required for tax and accounting purposes. Waitlist and newsletter emails are retained until you unsubscribe. Rate-limiting data is short-lived.

9. International transfers

We and our service providers may process and store information in the United States and other countries. Where we transfer personal data out of the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), the EU Standard Contractual Clauses, and/or the EU-US Data Privacy Framework, as applicable.

10. Your rights

If you are in the UK or EEA, you have rights under the UK/EU GDPR to access, correct, delete, export (port), object to, or restrict processing of your personal data, and to withdraw consent. California residents have comparable rights under the CCPA/CPRA, including to opt out of sale or sharing (we do neither). To exercise any right, contact us at support@finsightlabs.co; we may need to verify your identity and will respond within the time required by law (one month under the UK/EU GDPR; 45 days under the CCPA). You may lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority, or, for California, the California Privacy Protection Agency or Attorney General. We will not discriminate against you for exercising your rights.

11. Marketing emails

We send marketing or newsletter emails only with your consent, and every such email includes an unsubscribe link.

12. Security

We use reasonable technical and organizational measures, including encryption in transit, to protect your information. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

13. Children's privacy

The Service is not directed to, and is not intended for use by, individuals under 18. We do not knowingly collect personal information from children.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice.

15. Contact

Questions about this Policy or your information can be sent to support@finsightlabs.co. If you are in the EEA or UK and we are required to designate a representative, that information will be provided here.