Privacy Policy

DataPorium, LLC ("DataPorium," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes the personal information we collect from or about you, how we use and disclose it, and the rights and choices you have, when you visit or use our website at https://dataporium.tech, our applications, APIs, AI-generated reports, and all related services (collectively, the "Services").

By accessing or using the Services — whether or not you create an account — you acknowledge that you have read and understood this Privacy Policy. Your use of the Services is also governed by our Terms of Use, which is incorporated by reference.

This Privacy Policy does not apply to information that we process on behalf of business or enterprise customers under a separate written agreement; in those cases, the customer's agreement governs that data, and the customer is the controller.

1. Personal Data We Collect

1.1 Personal Data You Provide

• Account Information. When you create an account with email, we collect your name, email address, and password (stored only in hashed form). If you sign up using a third-party identity provider such as Google or Microsoft, we receive the basic profile information that provider returns to us — typically your name, email address, and the fact that the provider has verified the email — based on the permissions you authorize.
• Payment Information. Payments are processed by Stripe, Inc. We do not see or store your card number, CVV, or full billing address. From Stripe we receive a customer ID, a subscription ID, and invoice history (such as amount paid, currency, plan, and date), which we store to manage your subscription, send receipts, and meet our tax and accounting obligations.
• Saved Content. We store items you choose to save in your account, including favorites and watchlists, saved investment scenarios, per-property overrides, UI preferences, scheduled reports, and any support messages or attachments you send us. We do not store your AI chat prompts or AI responses on our servers; recent chat history is kept only on your device for up to 48 hours.
• Communications. When you contact us by email or through in-app support, we collect your name, contact information, the contents of your message, and any attachments.
• Other Information You Provide. Information you provide when you respond to a survey or apply a coupon or referral code.

1.2 Personal Data We Receive Automatically When You Use the Services

• Log and Security Data. We receive your IP address and user-agent string from your browser, primarily for rate-limiting, bot detection, and abuse prevention.
• Usage Data. We log metadata about your API and feature usage — such as the endpoint called, HTTP method, response status, latency, AI model used, and credits consumed — for billing, capacity planning, and service operation. We do not log the contents of your prompts, requests, or responses.
• Approximate Location. We infer your general location (typically country or region) from your IP address for security and fraud-prevention purposes. We do not collect GPS or other precise-location data.
• Analytics. We use Vercel Analytics and Vercel Speed Insights, which are privacy-respecting and cookie-less, to understand aggregate page views, feature usage, and performance. These services do not set tracking cookies, do not collect personal identifiers, and do not build cross-site advertising profiles.
• Cookies and Similar Technologies. We use cookies and local storage to operate the Services, keep you signed in, remember your preferences, and secure your account. See §4 (Cookies and Tracking) for details.

1.3 Personal Data We Receive From Other Sources

• Authentication providers (such as Google or Microsoft sign-in) provide the basic profile information you authorize.
• Payment processor (Stripe) provides confirmation of payment, fraud signals, and dispute notices.
• Publicly available sources (such as public company filings, public datasets, and the open internet), which DataPorium uses to build, curate, and enrich the data products that make up the Services. This material is about companies, securities, and markets, not about end users.

We do not knowingly collect biometric data, government identifiers (such as Social Security numbers), precise geolocation, or special categories of data (such as racial or ethnic origin, religion, health, or genetic data). If you submit such information voluntarily (for example in support correspondence), we will treat it under this Policy and delete it where reasonable.

2. How We Use Personal Data

We use Personal Data for the following purposes:

• Provide and operate the Services, including authenticating you, processing your subscription and payments through Stripe, saving your settings and Saved Content, and providing customer support.
• Operate the AI features by forwarding your prompt to the AI provider and returning the response.
• Maintain, secure, and improve the Services, including diagnosing errors, preventing fraud and abuse, blocking sanctioned users, mitigating denial-of-service attacks, monitoring service health, and conducting internal analytics.
• Develop new features, including by analyzing aggregated and de-identified usage patterns. DataPorium does not use your individual prompts or personal Content to train any third-party large-language model, and we do not sell your prompts or Content to AI vendors for model training.
• Remember your saved settings (theme, font, watchlists, saved scenarios, column layouts, and similar preferences) so the Service appears the way you configured it.
• Communicate with you, including transactional emails (such as receipts, password resets, security alerts, and material changes to these terms) and service announcements. We will only send marketing communications where you have provided the required consent or opt-in.
• Comply with legal obligations, including tax, accounting, anti-money-laundering, sanctions screening, export-control, audit, and lawful-process requirements; and to enforce our Terms of Use and protect the rights, property, safety, and security of DataPorium, our users, and the public.
• Aggregate and de-identify Personal Data so that it no longer identifies any individual, and use the resulting aggregated or de-identified information for any lawful purpose, including improving our Services, conducting research, publishing usage statistics, training internal scoring and ranking models that are proprietary to DataPorium, and developing new commercial products. Once data is aggregated or de-identified, it is no longer treated as Personal Data under this Policy, and we will not attempt to re-identify it except as required by law.

2.1 AI Features

Some Services use third-party AI models (such as those operated by OpenAI, Anthropic, or X-AI) to generate reports, summaries, and analyses. When you use those features:

• Your prompts and any inputs you submit may be transmitted to the AI provider so that they can produce a response.
• We use the AI providers' API offerings, under which the providers contractually do not train their general-purpose models on API inputs by default.
• We do not store your prompts or the AI's responses on our servers. Recent chat history is kept only in your browser's local storage for up to 48 hours.
• AI-generated outputs may contain errors, omissions, or fabricated content. You should not rely on them as professional advice. See our Terms of Use for further detail.

2.2 Legal Bases (EEA, UK, and Switzerland)

Where the EU General Data Protection Regulation, the UK GDPR, or Swiss data-protection law applies, we rely on the following legal bases:

• Contract — to provide the Services you have requested and to administer your account.
• Legitimate interests — to secure and improve the Services, prevent fraud and abuse, conduct internal analytics, market our Services to existing customers in a balanced way, and operate our business.
• Consent — for any non-essential cookies, marketing emails to non-customers, and any other processing for which consent is required. You may withdraw consent at any time without affecting prior processing.
• Legal obligation — to comply with applicable law, lawful requests from authorities, and tax, accounting, sanctions, and similar obligations.

3. How We Disclose Personal Data

We disclose Personal Data in the following circumstances:

• Vendors and service providers. We disclose Personal Data to vendors who support the Services on our behalf, bound by contractual confidentiality and data-protection obligations and permitted to use the data only to perform services for us. These currently include:
  • Hosting and infrastructure — Vercel, Inc. (web hosting and analytics) and Google LLC / Firebase (database, authentication, file storage).
  • Payments — Stripe, Inc.
  • AI model providers — OpenAI, Anthropic, X-AI, and similar providers, to which we transmit your prompt and necessary context so they can return a response.
• Affiliates. We disclose Personal Data to entities that control, are controlled by, or are under common control with DataPorium, who may use the information consistent with this Policy.
• Business transfers. If DataPorium is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your Personal Data may be reviewed during diligence and transferred to the successor or affiliate as part of that transaction.
• Legal, safety, and rights protection. We may disclose Personal Data to law enforcement, regulators, courts, or other third parties (i) to comply with applicable law, regulation, subpoena, court order, or other lawful process; (ii) to enforce our Terms of Use; (iii) to detect, prevent, or address fraud, security, technical, or abuse issues; (iv) to protect the safety, rights, property, or security of DataPorium, our users, or the public; or (v) to defend against legal claims.
• Aggregated or de-identified data. We may disclose aggregated or de-identified information that does not identify any individual to partners, researchers, or the public for any lawful purpose.
• With your direction or consent. We may disclose Personal Data with your explicit consent or at your direction.

We do not sell your Personal Data, and we do not "share" Personal Data for cross-contextual behavioral advertising as those terms are defined under California or other US state privacy laws. We do not use or process sensitive Personal Data for the purpose of inferring characteristics about a consumer.

4. Cookies and Tracking

4.1 What We Set Today

The Services currently set only strictly necessary cookies and local-storage entries:

• Authentication — Firebase auth session cookies / IndexedDB entries that keep you signed in.
• Payment — Stripe checkout cookies set during a payment session.
• Functional local storage — your theme/font preference, your acknowledgment of legal updates, and recent AI chat history (kept on your device only, up to 48 hours).

We do not set advertising, marketing, or cross-site tracking cookies. Our analytics provider (Vercel Analytics and Speed Insights) is cookie-less.

4.2 Your Choices

You can manage cookies through your browser settings, including blocking or deleting cookies. Disabling strictly necessary cookies will prevent the Services from functioning. We honor Global Privacy Control (GPC) signals where required by law. Because there is no industry consensus on how to interpret browser "Do Not Track" signals, the Services do not respond differently to them.

5. Retention

We retain Personal Data only for as long as we need it to provide the Services or for other legitimate business purposes — such as to resolve disputes, enforce our agreements, prevent fraud and abuse, comply with our legal obligations, and protect the security of our systems.

• Account data is retained for the life of your account and for a reasonable period thereafter to handle returns, disputes, and chargebacks (typically up to 7 years for financial-record purposes).
• Saved Content (favorites, scenarios, overrides, preferences, scheduled reports) is retained until you delete it or close your account.
• AI chat history is kept only on your device for up to 48 hours and is not retained on our servers.
• Usage and security logs (including apiUsageLogs and IP-based rate-limit data) are typically retained for up to 24 months, and may be retained longer in aggregated or de-identified form.
• Payment and tax records are retained for the period required by applicable tax, accounting, and financial-services law (typically up to 7 years).
• Backup copies are overwritten on a rolling schedule and may persist briefly after deletion from primary systems.
• Records of legal requests, abuse, and security investigations may be retained for as long as needed to satisfy the underlying legal or safety purpose.

When Personal Data is no longer needed, we delete or anonymize it. Where deletion from active systems is not immediately feasible (for example, in encrypted backups), we will isolate the data from further processing until deletion is possible.

6. Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit, restricted access on a need-to-know basis, hashed credential storage, audit logging, and infrastructure provided by reputable cloud vendors (Google Cloud / Firebase and Vercel).

However, no Internet or email transmission, and no system of electronic storage, is ever fully secure. You are responsible for safeguarding your account credentials and for promptly notifying us at info@dataporium.tech of any suspected unauthorized use of your account.

In the event of a security incident affecting your Personal Data, we will provide notice in accordance with applicable law.

7. International Data Transfers

DataPorium is headquartered in California, United States. We process and store Personal Data on servers located in the United States and in other countries where our affiliates and service providers are located.

Where required, we rely on appropriate transfer mechanisms — such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent Swiss safeguards — for transfers from the EEA, UK, and Switzerland to countries that have not received an adequacy decision. By using the Services, you understand that your information will be transferred to and processed in the United States.

8. Your Rights

Depending on where you live, you may have some or all of the following rights with respect to your Personal Data:

• Access the Personal Data we hold about you.
• Correct or update inaccurate or incomplete data.
• Delete your Personal Data, subject to applicable exceptions.
• Restrict or object to certain processing.
• Portability — receive a copy of your data in a structured, commonly used, machine-readable format.
• Withdraw consent where we rely on your consent.
• Lodge a complaint with your local data-protection authority (in the EEA, UK, or Switzerland) or applicable state attorney general (in the United States).
• Be free from retaliation for exercising any of these rights.

You can also delete your account at any time from your settings page (Danger Zone), which will remove your account and associated Saved Content from active systems, subject to the retention exceptions in §5.

To exercise any other right, email us at info@dataporium.tech from the email address associated with your account, with the subject line "Privacy Request." For verification, we may ask you to confirm specific details associated with your account before fulfilling the request. We will respond within the time required by applicable law (typically 30 days, extendable as permitted).

We may decline a request where permitted by law, including where it is unduly burdensome, repetitive, would compromise the privacy of others, or would prevent us from complying with legal obligations.

8.1 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written authorization signed by you, and we may require you to verify your identity directly with us.

8.2 Appeals

If we deny a request, you may appeal by replying to our denial email. We will respond within the time required by applicable law.

8.3 A Note About AI Output Accuracy

AI-generated outputs may contain inaccurate or fabricated statements about individuals. Because of how the underlying models work, in some cases we may not be able to correct or remove specific factual statements within model outputs. If you believe an AI-generated output contains inaccurate Personal Data about you, contact us at info@dataporium.tech and we will consider your request based on applicable law and the technical capabilities of the underlying models.

9. Additional U.S. State Disclosures

Some U.S. state privacy laws (including those of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws in force) require specific disclosures.

9.1 Categories of Personal Data Collected, Used, and Disclosed

We collect the categories of Personal Data described in §1, use them for the purposes described in §2, and disclose them to the categories of recipients described in §3. In the prior 12 months, we have collected the following categories of Personal Data, as those terms are defined under California law:

• Identifiers — name, email, IP address, account ID.
• Commercial information — subscription plan and transaction history (received from Stripe).
• Internet or other electronic network activity — usage metadata and security logs (endpoint, method, status, latency, model, credits, IP, user agent).
• Geolocation data — approximate, IP-based country or region only.

9.2 No Sale, No Sharing, No Targeted Advertising, No Sensitive-Data Inferences

We do not "sell" Personal Data, do not "share" Personal Data for cross-contextual behavioral advertising, do not process Personal Data for "targeted advertising," and do not process sensitive Personal Data for the purpose of inferring characteristics about a consumer, in each case as those terms are defined under applicable U.S. state law. We do not knowingly sell or share Personal Data of consumers under 16.

9.3 California-Specific Rights

California residents have the rights described in §8 above, plus the right to know what categories of Personal Data we collected, the sources, the purposes, and the categories of third parties to whom we disclosed it.

9.4 Shine the Light

California Civil Code §1798.83 entitles California residents to request, once per year, information regarding our disclosure of certain categories of Personal Data to third parties for the third parties' direct-marketing purposes. We do not disclose Personal Data to third parties for their direct-marketing purposes, so this right is not currently engaged.

9.5 Notice of Financial Incentive

We do not currently offer any financial incentive in exchange for the collection, sale, or retention of Personal Data.

10. Children

The Services are intended for adults and business professionals and are not directed to children under 13. We do not knowingly collect personal information from children under 13. By using the Services, you represent that you are at least 18 years old or have reached the age of digital consent in your country. If you believe a child under 13 has provided personal information to DataPorium, contact info@dataporium.tech and we will investigate and delete it.

11. Third-Party Sites and Services

The Services may contain links to third-party sites, services, and content (for example, links to source websites or to a payment processor). We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes (such as expansions of the categories of Personal Data we collect, the purposes of processing, or the categories of recipients), we will provide reasonable advance notice — typically by updating the "Last updated" date and by in-app notification to registered users — at least 30 days before the change takes effect, unless a shorter period is required by law or by an emergency. For non-material changes (such as clarifications, formatting, or typo corrections), changes are effective upon posting. Your continued use of the Services after a change becomes effective constitutes your acceptance.

13. Data Controller and Contact

DataPorium, LLC, a California limited liability company, is the controller of Personal Data described in this Privacy Policy.

For privacy questions, requests, complaints, or to exercise any of your rights, contact us at:

• Email: info@dataporium.tech
• Subject line for rights requests: "Privacy Request"
• Entity: DataPorium, LLC

If you live in the European Economic Area, the United Kingdom, or Switzerland and have an unresolved concern, you may also contact your local data-protection authority.