Privacy Policy

Information you provide

• Account data: When you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Watchlists: Stock tickers and notes you add to your watchlists.
• Saved models: Valuation model parameters you save (e.g. DCF assumptions).

Information collected automatically

• Usage data: Daily search counts and AI research generation counts (for tier limit enforcement only).
• Session data: A session cookie to keep you signed in. Contains no personal information — only a random session identifier.

Information we do NOT collect

• Passwords: Google OAuth exclusively. We never see, store, or process passwords.
• Payment details: Card numbers, billing addresses, and payment data are processed entirely by Stripe. We only store a Stripe Customer ID (a random reference string).
• Portfolio holdings: We do not track which stocks you search for, how long you view them, or your actual investment positions.
• Tracking pixels or ad data: No advertising trackers, analytics scripts, or third-party tracking pixels.

• To provide and maintain the Service (authentication, watchlists, subscription management)
• To enforce tier-based usage limits (daily search and AI call counts)
• To communicate with you about your account or subscription (only when necessary)
• To detect and prevent fraud or abuse of the Service

We do NOT use your data for advertising, sell it to third parties, or share it with data brokers. Ever.

The Service integrates with these third-party providers, each with their own privacy policies:

We use a single essential cookie for authentication sessions. This cookie:

• Contains only a random session identifier (no personal data)
• Is required for the Service to function (keeping you signed in)
• Is deleted when you sign out or when it expires
• Is HTTP-only and secure (cannot be accessed by JavaScript or sent over unencrypted connections)

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Database encryption at rest (provided by Supabase / PostgreSQL)
• OAuth 2.0 for authentication (no password storage)
• Stripe PCI-DSS compliance for payment processing
• Environment-variable-based secret management (no hardcoded credentials)

No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security.

• Account data: Retained as long as your account is active. Deleted within 30 days of account-deletion request.
• Watchlists and saved models: Deleted immediately when you delete them, or within 30 days of account deletion.
• Usage counts: Reset daily. No historical usage data is retained.
• Stripe data: Managed by Stripe per their retention policies. We can request deletion of your Stripe customer record.

All users

• Access: You can view all data we store about you in your Settings page and Watchlists.
• Deletion: Request complete deletion of your account and all associated data by emailing privacy@alanintelligence.com. We will process within 30 days.
• Export: You can export your financial analysis data via the CSV export feature.

California residents (CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect about you
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Not be discriminated against for exercising your rights

EU/EEA residents (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access, correct, or delete your personal data
• Restrict or object to processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

Our legal basis for processing is: (a) contract performance (providing the Service), (b) legitimate interests (fraud prevention, service improvement), and (c) consent (where required).