Privacy Policy

This Privacy Policy explains how Hezzian (“we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our Service. We operate in line with the UK GDPR and Data Protection Act 2018 (UK), applicable US state privacy laws including the CCPA/CPRA, and the Personal Data Protection Act (Singapore). We do not sell your personal data.

Waitlist information: if you register interest before having an account, we collect your email address, your name (optional), and whether you are a retail or institutional investor, so we can send you an invitation and your access code.

Account information: when you sign up, our identity provider (Clerk) collects your email address and authentication details, and (if you use social sign-in) your name and basic profile from Google or Microsoft.

Profile and onboarding information: the answers you provide during onboarding, such as investor type, experience level, risk tolerance, objectives, time horizon, sectors and assets of interest, and your chosen news sources and digest preferences.

Financial information you provide: portfolio holdings, watchlists, and investment theses you enter or upload into the Service. This information is provided by you, not collected from any brokerage or financial account, and is used solely to power your dashboards and the AI advisor.

App activity: your interactions with the Service (pages viewed, features used, and in-app navigation), which we use to operate, secure, and improve the Service. See “Product-usage information” below for what this store does and does not contain.

Pilot feedback: the answers you submit on the pilot feedback form (features you found valuable, what is and isn't working) together with a record of the usage-monitoring consent you gave there.

Product-usage information: when you are signed in, we record which pages and features of the Service you use and when — on the web app and in the Hezzian mobile app. This product analytics is first-party and stores only your user identifier, the page/feature, and a timestamp — it does not store your IP address, device fingerprint, or the content of what you type. Separately, our hosting providers process IP addresses transiently in standard server logs for security and delivery of the Service.

Payment information: if you subscribe to a paid plan, payments are processed by Stripe. We do not store your full card details; we store your subscription status and Stripe customer reference.

We use your information to provide and operate the Service; to personalize your experience (including dashboards and the AI advisor); to send the news digest if you opt in; to maintain security and prevent abuse; to analyze and improve the Service; and to comply with legal obligations.

Where the UK/EU GDPR applies, we process personal data on the bases of: performance of our contract with you (to provide the Service, including the pilot-program conditions described in our Terms); your consent (for example, the news digest and the onboarding data you choose to share); our legitimate interests (such as securing and improving the Service); and compliance with legal obligations. You may withdraw consent at any time.

Product-usage analytics: we record which pages and features you use (as described under “Product-usage information” above) on the basis of our legitimate interest in operating, securing, and improving the Service. This analytics is first-party and minimal by design. You may object to this processing at any time by contacting us, and it ends permanently when you delete your account (the associated records are deleted with it).

We share personal data with service providers who process it on our behalf, including: Clerk (authentication and identity), our hosting and database providers (such as Vercel, Render, and Neon), Stripe (payment processing), our transactional email providers (Zoho / ZeptoMail, for invitation and service emails), our error-monitoring provider (Sentry — technical crash and error reports, configured without personal content), and our AI model providers (which process the prompts and context needed to generate outputs; some of these providers are located outside the UK, EU, and US). We may also disclose information where required by law or to protect our rights, users, or the security of the Service. We do not sell personal data or share it for cross-context behavioral advertising.

We retain personal data for as long as your account is active or as needed to provide the Service, and thereafter only as required for legitimate business or legal purposes. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is required by law.

You can request deletion of your account and all associated data in three ways: in the Hezzian mobile app, under Settings (once the app's account features ship); on the web, under Settings → Danger zone; or at hezzian.com/delete-account, which works whether or not you're signed in.

Deletion is immediate: your account and all associated data — including your profile, portfolio positions, theses, watchlists, uploaded documents, and preferences — are deleted upon request and cannot be recovered. Encrypted backups containing your data age out and are fully purged within 30 days.

Your data is stored in our database and is encrypted in transit and at rest. Access is restricted to you and authorized operators. No method of transmission or storage is completely secure, but we take reasonable technical and organizational measures to protect your information.

Depending on your location, you have rights to access, correct, export (portability), and delete your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right to opt out of sale/sharing (note: we do not sell or share for advertising). You can exercise these rights from within the Service or by contacting us; we will not discriminate against you for doing so.

We and our service providers may process your data in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.

We use cookies and similar technologies that are necessary to operate the Service (for example, to keep you signed in). Our product analytics is first-party and minimal as described above — we do not use third-party advertising trackers. You can control cookies through your browser settings, though disabling some may affect functionality.

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Policy or wish to exercise your rights, contact us at privacy@hezzian.com.