Privacy Policy

• We use account, research, billing, and technical information to provide and protect the Service.
• Your watchlists, prompts, notes, and saved research are private account content unless you choose to share them or disclosure is required to provide a feature.
• We do not use your private research workspace as a public recommendation feed.
• We use service providers for infrastructure, payments, email, verification, market data, and AI-assisted features.
• On the public pages, and only as your cookie choice allows, we use Google Analytics and the X and Meta advertising pixels to see how visitors find us; none of them run in the research workspace.
• You can ask about, access, correct, export, or delete eligible personal information through our contact page.

FinKut is operated by FINKUT LLC, a limited liability company organized in Wyoming, United States, 30 N Gould St Ste N, Sheridan, WY 82801, USA. FINKUT LLC decides how and why personal information is processed for the Service (the data controller, where that term applies).

Privacy questions and requests: support@finkut.com or the Contact page. Please do not send sensitive information in a support message unless we ask for it.

When you create an account or use the research workspace, we may collect your username, email address, verification events, product settings, watchlists, saved charts, chat prompts, the filings you select for analysis, notes, support messages, billing and entitlement events, and records of your interactions with the Service.

We also collect limited technical information such as IP addresses in short-lived security and rate-limit records, IP-derived hashes stored with consent and contact records, user-agent details, session and CSRF cookies, device/browser information, timestamps, error logs, rate-limit events, and usage counters. When you register, we record how you first found us: the campaign tags of the link you followed, the name of the referring website, and the page you landed on (see the Cookie Policy). We do not need your brokerage credentials to provide the Service.

We use information to create and secure accounts, verify email addresses, operate research and file-analysis workflows, save your workspace, enforce plan limits, process payments, answer support requests, prevent abuse, investigate security events, improve reliability, and comply with legal obligations.

We do not make an investment suitability decision about you. Product usage data may be aggregated or de-identified for reliability and product analysis.

Where data-protection law requires a lawful basis, we generally process account and workspace data to perform our contract with you, security, product operations, and our own measurement of how visitors find us based on legitimate interests, billing and records to comply with legal obligations, and optional communications based on consent. Google Analytics runs on consent where the law requires it (the European Economic Area, the United Kingdom, and Switzerland) and otherwise on legitimate interests, with an opt-out in the Cookie Policy. The X and Meta advertising pixels follow the same rule: consent in those regions, and elsewhere our legitimate interest in measuring our advertising, with the same opt-out. Fields marked as required are needed to create an account or provide the requested feature; other information is optional.

We rely on other companies to run the Service. They receive only what the feature needs:

• Hosting and network: OVHcloud runs our application servers and database in Canada. Cloudflare carries traffic between your browser and our servers and filters abusive requests, so it processes your IP address and request details.
• Payments: Stripe, through its merchant of record Link (Stripe Managed Payments), sells subscriptions, processes your payment details, and handles tax, receipts, and payment support; it receives your name, email address, billing country and address, and payment details. Card data does not reach our servers.
• Email: Resend, with Brevo as a fallback, delivers account, security, and billing email.
• AI features: Nebius (hosting DeepSeek models), OpenRouter (routing to the TypeSafe model), and Google (Gemini) process requests for chat, Reflex, filing, earnings-call, and news analysis.
• Market data and filings: Financial Modeling Prep (FMP), the U.S. SEC EDGAR system, OpenFIGI, and Tavily (news article text). These receive tickers, identifiers, or article links, not your account details.
• Storage: Google Cloud Storage holds filing documents and analysis files.
• Error monitoring: Sentry receives technical error reports (the error, the page address, and browser type) so we can find and fix failures. We do not attach your name, email address, cookies, or the content you submitted.
• Site analytics: Google Analytics counts visits to the public pages of the site. Google receives the page address, the referring address, browser and device details, and whether an account was created or a checkout was opened or completed (plan, list price, and an order reference), and sets its own cookies; we do not send your name, email address, or account content. It does not run in the research workspace, and you can switch it off in the Cookie Policy.
• Advertising measurement: the X pixel (X Corp.; Twitter International Unlimited Company for visitors in the EU) and the Meta pixel (Meta Platforms, Inc.; Meta Platforms Ireland Ltd. for visitors in the EU) run on the public pages while Marketing is allowed. They receive the page address (only pages without personal details in the address), the referring address, your IP address, browser and device details, their own cookies, and these events: that the pricing page was viewed, that checkout was opened for a plan (plan list price), that an account was created, and that a subscription or trial was started (plan list price and an order reference). We do not send your name, email address, or account content, and we have switched off Meta’s automatic event collection and advanced matching. X and Meta use this to tell us which ads led to sign-ups and may use it, under their own privacy policies, to show our ads to people who visited the site. For collecting this data on our site, we and Meta may be joint controllers under Meta’s Controller Addendum; Meta is responsible for its own processing afterwards. The pixels do not run in the research workspace.
• Human verification: Cloudflare Turnstile, when enabled on sign-up, login, and contact forms, receives your IP address and browser signals to evaluate a challenge.
• Content loaded by your browser: Google Fonts, the jsDelivr content network, and TradingView chart widgets are requested directly by your browser, so those providers see your IP address and browser details.

What AI providers receive. When you use Research Chat, the text of your message, a short excerpt of recent messages in that conversation, and the company or filing context you selected are sent to the AI providers above to route the question and write the answer. When you write your own Reflex question, its text is sent the same way. Your watchlists, saved notes, and billing details are not sent to AI providers. Avoid putting personal or confidential information into prompts: providers process requests under their own terms and privacy notices.

The provider set can change as the Service develops; this section is updated when it does.

We keep information for as long as your account is open and for the period needed to maintain billing records, resolve disputes, investigate abuse, debug failures, and meet legal obligations.

• Account content (chats, watchlists, saved charts, screens, and reports) is kept until you delete it or your account is deleted. Deleting a chat removes it from your workspace; the stored record is removed when the account is deleted.
• Account deletion is carried out on request through Contact. It removes your profile and account content. Billing, subscription, and usage records are kept without a link to you where financial or legal record-keeping requires them.
• Support messages, email delivery records, and AI usage records are kept for support, security, and cost accounting; they are not yet on an automatic deletion schedule.
• Security logs are rotated by size and can contain IP addresses.

We will publish fixed retention periods for each category here before the Service leaves beta.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, or opt out of certain processing. California residents may have additional rights concerning categories of personal information and disclosures. European and UK residents may have GDPR-related rights and may contact their supervisory authority.

To submit a request, use Contact and identify the account email. We may verify the request before acting on it, and we may retain a record of the request and its resolution.

We do not sell personal information for money. While Marketing is allowed, the X and Meta pixels on our public pages may count as “sharing” personal information for targeted (cross-context behavioral) advertising under some U.S. state laws. You can opt out by switching Marketing off in the Cookie Policy, and we treat a Global Privacy Control signal from your browser as an opt-out. California residents may request the categories of information collected, sources, purposes, and disclosures, and may exercise applicable access, deletion, correction, or opt-out rights without unlawful discrimination. If GDPR, UK GDPR, or another regional law applies, you may also have the right to complain to the relevant data-protection authority.

We use access controls, authentication, secure transmission, logging, rate limits, backups, and abuse monitoring appropriate to the product and the information involved. No internet service can guarantee absolute security; please do not submit information you are not authorized to use.

FinKut and its providers may process information in countries other than where you live. Where required, we use appropriate contractual, technical, or other safeguards for international transfers, such as the European Commission’s standard contractual clauses or a provider’s certification under the EU-U.S. Data Privacy Framework.

If you apply to the FinKut Partner Program, we use what you send us (your name, email address, country, channel details, and answers) to review the application and to contact you about it. If you become a partner, we also process your payout and tax details to pay commissions and meet legal duties (our partner platform, Rewardful, processes them on our behalf to track referrals and send payouts), and keep commission and payout records for as long as accounting rules require. The Partner Program Terms apply to partners.

If you arrive through a partner's link or use a partner's discount code, we record which partner referred your account so we can pay their commission. Partners see aggregated figures only, such as clicks, sign-ups, payments, and commission amounts. They never see your name, email address, plan details, or account content. The partner-link cookie is described in our Cookie Policy.

The Service is not directed to children and we do not knowingly collect personal information from children in violation of applicable law. Contact us if you believe a child has provided personal information.

We may update this Policy when the Service, provider set, or legal requirements change. We will update the effective date and, where appropriate, notify account holders of material changes through the Service or by email.

Privacy questions and requests: support@finkut.com or Contact.