Privacy Policy

What we collect

• Account details: your email address, the name you give, your password (stored only as a salted hash), language and display preferences. If you sign in with Google, we receive your email address and name from Google.
• Your investment profile: the mandate, risk tolerance, time horizon and benchmark you choose in Settings.
• Broker statement data: when you upload an Interactive Brokers statement we keep the parsed result — positions, cash balances, trades, dividends and fees. This includes the IBKR account number and the account alias or holder name printed on the statement.
• Analysis results: the analytics, AI insights and top-up plans generated for your portfolio.
• Billing records: your plan, subscription status, payment dates and amounts, any promo code you used, and the payment reference from our payment provider. We never see or store your card number.
• Feedback you send us, together with the screen you sent it from.
• Email preferences: whether you receive tips and offers, and which of our emails were sent to you and when.
• Security and audit records: sign-ins, account and billing changes, with the IP address and browser type they came from.
• Free checks without an account: when you check a statement on the free check page without signing in, we process it the same way, but no account is involved and no AI provider is used. Before the parsed result is stored we remove the IBKR account number, the account alias or holder name and the descriptions of deposits and withdrawals. The result is reachable only with a random key kept in your browser. Your IP address is used only to limit how many checks can be made, in a counter that forgets it within 24 hours.

What we do not keep

The uploaded statement file itself — including one sent for a free check without an account — is held in temporary storage for at most 10 minutes while it is parsed, then deleted. Only the parsed data described above is stored.

We do not ask for, and never receive, your broker login or any permission to trade. The service is read-only.

Why we use it

• To provide the service: parse your statement, compute analytics, and show them to you.
• To generate AI insights for each portfolio you upload (this starts automatically once its analysis is ready, when you are signed in) and the plans you request.
• To take payment and manage your subscription.
• To keep the service secure, investigate abuse and fix faults.
• To answer your support requests and feedback.
• To email you about using the service: a welcome, tips for getting started, a note when your analysis is ready, a monthly reminder to re-check your portfolio, and occasional offers for paid plans. You can turn these off in Settings or with the unsubscribe link in any of them. Emails your account needs to work — verification codes, password resets, payment notices — are not affected.

The legal bases are performance of our contract with you, our legitimate interest in running a secure and reliable service and in telling you about the service you signed up for (you can object at any time by unsubscribing), and compliance with accounting and tax law for billing records. We do not sell your data and do not use it for advertising.

Who else processes it

We share only what each provider needs to do its job:

• Hetzner Online (Germany) — hosts the servers and database.
• Anthropic — receives portfolio figures (holdings, weights, sector and risk measures, your stated mandate) to generate AI insights and plans. It does not receive your email, name or account number.
• Market data providers (EODHD, Yahoo Finance, SEC EDGAR) — receive ticker symbols only, to fetch prices and company financials.
• WayForPay (Ukraine) — processes card payments. Your card details are entered on WayForPay's page, not ours.
• Google — only if you choose to sign in with Google.
• Resend (Resend, Inc., USA; sending from the EU region) — delivers our emails: verification codes, password resets and, unless you opt out, product emails.
• Plausible Analytics (EU) — counts page views and a few product events without cookies and without collecting personal data.

Cookies and local storage

We use one session cookie to keep you signed in and one security cookie to protect forms against cross-site requests. Your browser's local storage remembers your language and theme, and, after a free check, the key to its result until you save it or it expires. We use no advertising or tracking cookies, so there is no cookie banner.

How long we keep it

• Account, portfolio and analysis data: while your account exists, including earlier uploads unless you choose to replace them.
• When you ask us to delete your account, we delete your account and portfolio data within 30 days.
• Billing records: for as long as accounting and tax law requires, even after the account is deleted.
• Sign-in sessions expire after 7 days.
• Free checks without an account: an unsaved result is deleted within 24 hours. If you create an account and save it, it becomes your account's portfolio data, kept as above.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, or ask for it in a portable format. Write to support@apulseai.com from the email address on your account and we will answer within 30 days. You can also complain to your local data protection authority; in Ukraine that is the Ukrainian Parliament Commissioner for Human Rights.

Security

Traffic is encrypted with HTTPS, passwords are hashed, and access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach that affects your data we will tell you without undue delay.

Children

The service is for adults. Do not use it if you are under 18.

Changes and contact

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.

Questions: support@apulseai.com.