Privacy Policy

This Privacy Policy explains how FinanceLab ("we", "us", "our") collects, uses, and protects your personal data when you use our website and services (the "Service"). We are the data controller for your personal data and are committed to protecting it in line with the UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account data: your name and email address, and a securely hashed password (we never store your password in plain text).
• Subscription data: your plan tier and, where applicable, a customer reference from our payment processor. We do not collect or store your card details — these are handled entirely by Stripe.
• Portfolio data (optional): if you import a portfolio — by uploading a CSV or connecting a brokerage account — we store the holdings you provide (ticker, quantity, cost basis, and the account or broker label). If you connect a brokerage, we also store the account balance your broker reports. We never receive or store your brokerage login credentials: those are entered directly with your broker through SnapTrade’s secure connection portal.
• Usage data: basic technical information such as IP address and interactions needed to operate, secure, and improve the Service (e.g. rate-limiting).
• Anonymous product analytics: we record that certain actions happened on the Service (e.g. a page was viewed, a ticker was searched, a report was generated) so we know which parts of the Service are actually used. These records carry no user ID, no IP address, and no device or session identifier of any kind — they cannot be linked back to you or to any other visitor, and we have no way to reconstruct an individual's activity from them.
• Watchlists & preferences: settings you save, some of which are stored locally in your browser.

2. How we use it

• To create and manage your account and provide the Service;
• To generate an AI portfolio review when you ask for one. Doing this sends your holdings (tickers, quantities, values and public company metrics) and your first name to Anthropic’s API so the narrative can be written. We do not send your email address, account numbers, or brokerage credentials. This only happens when you press “Generate Report”;
• To process subscriptions and payments;
• To communicate with you about your account, security, and service updates;
• To protect the Service from abuse and fraud;
• To comply with our legal obligations.

3. Legal bases

We process your data under the following UK GDPR legal bases: performance of a contract (to provide the Service you sign up for), legitimate interests (to secure and improve the Service), consent (where required, e.g. optional marketing), and legal obligation (e.g. tax and accounting records).

4. Who we share it with (processors)

We use trusted third parties to run the Service. They process data on our behalf under appropriate agreements:

Provider	Purpose
Supabase	Authentication and database (account storage)
Stripe	Payment processing and subscription billing
Vercel	Website hosting and serverless functions
SnapTrade	Read-only brokerage account connection (holdings and balances)
Anthropic	AI-generated analysis narratives (portfolio holdings are sent only when you request a review)
Financial Modeling Prep, TradingView, SEC EDGAR	Market and financial data

We do not sell your personal data.

Filing-sentiment scoring uses the Loughran-McDonald Master Dictionary (T. Loughran & B. McDonald, University of Notre Dame). It runs in your browser on public SEC filing text; no personal data is involved.

5. International transfers

Some providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK-approved standard contractual clauses or adequacy decisions.

6. Cookies & local storage

We use essential cookies and browser local storage to keep you signed in and remember your preferences (such as language and watchlists). These are necessary for the Service to function.

7. Data retention

We keep your account data for as long as your account is active. Imported holdings are kept until you delete them or delete your account, and you can remove any holding at any time from the Portfolio page. Disconnecting a brokerage stops any further sync. If you delete your account, we remove your personal data within a reasonable period, except where we must retain certain records (e.g. billing records) to meet legal obligations.

8. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, contact us at hello@financelab.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit, hashed passwords, and restricting access to personal data. No system is completely secure, but we work to safeguard your information.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes

We may update this Policy from time to time. Material changes will be notified via the Service or by email.

12. Contact

For any privacy questions or requests, contact us at hello@financelab.com.