Privacy Policy

1. Introduction

VestCompass ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our portfolio tracking and analytics platform.

2. Information We Collect

We may collect the following types of information:

• Account Information: Email address and name when you create an account. If you sign in with an email and password, your password is held by our sign-in provider, Google Firebase, not by us.
• Portfolio Data: Information you provide about your investments, including holdings, transactions, cash balances, goals, price alerts and your watchlist, entered by hand or imported from files you upload. VestCompass does not connect to your broker accounts.
• AI Data: Your AI chat conversations and records of your AI usage.
• Usage Data: Information about how you interact with our platform, including features used and time spent.
• Device Information: Browser type, device type, IP address, and operating system, and, if you turn on notifications, your device's push-notification token.

3. How We Use Your Information

We use the collected information for:

• Providing and maintaining our portfolio tracking services
• Generating personalized analytics and AI insights
• Improving and optimizing our platform
• Communicating with you about updates and features
• Ensuring security and preventing fraud

4. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, secure authentication, and regular security audits. Your portfolio data is stored securely and is never shared with third parties for marketing purposes.

5. Data Sharing

We do not sell your personal information. We may share data only in the following circumstances:

• With service providers who assist in operating our platform
• When required by law or to protect our rights
• In connection with a business transfer or acquisition
• With your explicit consent

The service providers we use, and what each receives:

• Google Firebase Authentication signs you in (email and password, Google or Apple). It receives your email address, name and sign-in details.
• Railway hosts our servers and database, and so stores the account, portfolio and AI data described above.
• AI model providers: Groq by default, and OpenAI, Anthropic (Claude) or Google (Gemini) when an Expert user chooses that model. They receive a text description of the portfolio being analysed (its name, holdings, values and income), your chat questions, and, when you import a file, its column headings and a few sample rows. We do not send them your name, email address or account ID.
• Sentry (EU data region) receives crash and error reports from the app: error details, device and operating-system model, and app version.
• Expo delivers push notifications through Apple's and Google's push services. It receives your device's push-notification token and the text of each notification.
• Market-data providers: FCS API, Twelve Data, Marketstack and Finnhub, and, for exchange rates, currency-api and ExchangeRate-API. They receive only ticker symbols and currency codes, never information about you.
• When paid plans are switched on: RevenueCat manages App Store and Google Play subscriptions and receives your account ID and the store's purchase records; Stripe handles payments on our website and receives what you enter at checkout (such as your email address, name and card) and your account ID. Apple and Google process purchases made in their stores.
• On this website: Vercel hosts it and processes visitors' IP addresses; Resend stores and emails the address you give when you join the waitlist; Google Analytics measures visits to the site.

6. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and its data (see how to delete your account)
• Export your data in a portable format
• Opt out of marketing communications

7. Cookies and Tracking

We use essential cookies to ensure the proper functioning of our platform. We may also use analytics cookies to understand how users interact with our service. You can control cookie preferences through your browser settings.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. When you delete your account in the app, your account and portfolio data are deleted immediately; a request sent without the app is completed within 7 days of your confirmation. After deletion we keep only: a one-way hash of your account ID, so a sign-in session that was still open cannot bring the account back; our records of purchase and billing events, with their contents replaced by the word "redacted" and the random internal number your account had, so a late store notification cannot grant a plan twice; and, if you paid on our website, the ID of your deleted Stripe customer record. Our production database has no scheduled backups, so a deletion leaves no copy of your data in a backup. The steps and the full list are on our account deletion page.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us via WhatsApp at +971 52 380 1550.