Privacy Policy

1. Introduction

StockExpertAI LLC ("StockExpertAI," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration information (name, email address)
• Profile information and investment preferences
• Portfolio data you upload or enter
• Chat conversations with Moon AI
• Community predictions and comments
• Support requests and feedback

2.2 Information Collected Automatically

• Device information (browser type, operating system)
• IP address and approximate location
• Usage patterns (pages visited, features used, time spent)
• Cookies and similar tracking technologies
• Referral sources and search terms

2.3 Information from Third Parties

• Authentication providers (when using social login)
• Analytics services (aggregated usage data)

3. How We Collect Information

We collect information through direct user input, automated technologies (cookies, web beacons, analytics tools), and from third-party authentication providers when you choose to sign in with social accounts.

4. Purposes and Legal Bases

Why we use your data:

• To provide and maintain the Service
• To personalize your experience and AI-generated insights
• To improve our platform and develop new features
• To communicate with you about updates and changes
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations

GDPR Legal Bases: Contract performance, legitimate interests, consent, and legal obligations.

CCPA Business Purposes: Performing services, security, debugging, internal research, and quality improvement.

5. Data Sharing and Disclosure

Named, not categorised. "AI model providers" and "cloud infrastructure" tell a reader nothing they can check, so below is the actual list of companies that process data on our behalf, and what each one gets. It is kept current with the code; if a provider is added or dropped, this list changes with it.

Infrastructure

• Replit (US) — hosting, file storage, and the sign-in service behind your account.
• Neon (US) — the PostgreSQL database holding your account, watchlists and saved analyses.
• Cloudflare (US) — CDN, DNS and the firewall in front of the site. Sees the IP address and request headers of every visit.

AI providers — they receive what you submit to an AI feature

• OpenAI (US) — reads uploaded portfolio screenshots, and some written analysis.
• Google (US) — Gemini models: written analysis, translation, and portfolio screenshots when OpenAI fails.
• Anthropic (US) — Moon AI chat, where enabled.

Market data — these receive the ticker you looked at, not who you are

• Financial Modeling Prep, Yahoo Finance, Alpaca, Finnhub, Alpha Vantage, Benzinga — prices, filings, estimates and news. We query them from our servers; your browser is not identified to them.

Measurement, messaging and payments

• Google Analytics 4 (US) — page views and events, with the IP address truncated by Google.
• Sentry (US) — application errors, which can include the URL you were on when one occurred.
• Resend (US) — sends sign-in links and account email. Receives your email address.
• Twilio (US) — WhatsApp notifications, only if you opt in and give a number.
• Stripe (US) — integrated but idle. Nothing is sold, no card is taken, and Stripe receives nothing until that changes.

Beyond these, we disclose information to legal authorities when required by law or to protect our rights.

6. Your Privacy Rights

7. AI and Data Processing

Portfolio screenshots, specifically

If you upload a screenshot of a brokerage account, the image is sent to two readers at the same time — OpenAI (GPT-4o) and Google (Gemini 2.5 Pro) — and the two readings are reconciled; both are US companies. We do not keep the image: it is held in memory for the length of the request, never written to storage, and it is not used to train any model. Only the holdings you confirm on the next screen are saved, and only to your account. Verified against production on 31 August 2026 — of the 34 portfolio analyses ever run, none has a stored image and none has stored holdings.

A brokerage screenshot usually shows position sizes and can show an account balance. Crop or blur anything you would rather not send to a third party before uploading; nothing in the reading step needs those numbers to be legible.

8. Data Retention

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Usage Logs: Retained for up to 90 days for security and debugging purposes.
• Financial/Legal Records: Retained for up to 7 years as required by applicable laws.

9. Security Measures

We implement industry-standard security measures including SSL/TLS encryption, secure authentication, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) headers, and regular security reviews. For full details, see our Security page.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Data Processing Agreements (DPAs) with all service providers

11. Children's Privacy

StockExpertAI is not intended for users under the age of 18 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

12. Notice for California Residents

Under the CCPA, California residents have specific rights regarding their personal information. Categories of personal information we may collect include:

• Identifiers (name, email, IP address)
• Internet activity (browsing history, search history on our platform)
• Geolocation data (approximate location from IP)
• Professional information (investment preferences)

We do not sell personal information. To exercise your CCPA rights, contact us at sedat@stockexpertai.com.

13. Cookies and Tracking Technologies

We use essential cookies to keep the Service secure and working. Optional analytics and marketing cookies are off unless you choose to accept them.

Your cookie choice is stored for 180 days, then we ask again. We also ask again if the cookie purpose or consent version changes.

You can change your choice from the Privacy Policy page by selecting Manage cookie preferences, or by clearing site data in your browser.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on the platform at least 30 days before taking effect. Your continued use of the Service after changes take effect constitutes acceptance.

15. Contact Us