Privacy Policy

In short: Valuein (as identified in the Terms) decides how your personal information is used. This policy covers every Valuein website, API, MCP server, SDK and the Workspace. It also covers people who never signed up: visitors, people named in SEC filings, and business contacts we may email. This summary is not a substitute for the section below.

Valuein — DOMO SECURE LLC, a New Jersey limited liability company doing business as Valuein, as identified in the Terms of Service (the "Terms") — is the controller of the personal information described here ("Valuein", "we", "us"). If Valuein's business is moved to a company formed to carry it on, that company will become the controller; we will tell you, and this policy will continue to apply.

This policy applies to information collected through:

• the website at valuein.biz and its subdomains;
• the Bulk API at data.valuein.biz;
• the MCP Server at mcp.valuein.biz;
• the Python SDK valuein-sdk;
• the Workspace (chat, Agents, theses, claims, watchlists, reports, signals, public profiles and shared research);
• our support, sales and intake mailboxes.

Together these are the "Service". Capitalised terms not defined here (for example Account, Agent, Plan, User Content, Valuein Data, Seat) have the meanings given in the Terms.

Where a business customer signs a Data Processing Addendum with us, Valuein processes the personal information that customer puts into the Service on the customer's behalf, under that addendum. For everything else, this policy governs.

Questions: legal@valuein.biz.

In short: we collect account details, the research you create, chat history, uploaded documents, model keys you connect (sealed, never the plaintext), billing records, usage and log data, a few first-party cookies, and messages you send us. Some datasets name people from public filings, and we keep business contact details of investment-adviser staff we may contact. This summary is not a substitute for the subsections below.

3.1 Account and sign-in

• What: email address; display name; public handle; optional biography; avatar and cover images you upload; the sign-in method you used (Google, LinkedIn or emailed code); the date your Account was created; your Plan and subscription status; the name, job title and company you give at checkout, if any; your notification preferences; and the marketing channel and referring site that first brought you to us (from the vi_ft cookie, Section 3.10).
• Sign-in: we do not use or store passwords. You sign in with Google or LinkedIn (OAuth) or with a one-time code we email to you. For a code we store only a hash bound to your address and peppered with a server secret, valid for 10 minutes and single-use. Your signed-in session is a signed, encrypted cookie in your browser; it is not stored in our databases.
• From Google or LinkedIn: your name, email address and, if your provider sends one, a profile-photo link. We do not store the provider's photo; while you are signed in, we may show it as your avatar until you upload your own.
• Records of your agreement. When you accept the Terms, this Privacy Policy, automatic-renewal terms or another legal document, we record: your email address (for a checkout, the address you gave at checkout), your Stripe customer identifier if known, which document and version you accepted, a fingerprint (SHA-256 hash) of the exact text shown, where and how you accepted (for example the sign-in notice, the checkout box or a re-acceptance click), the time, your IP address and your browser user-agent (up to 256 characters). Our database does not allow these records to be edited, or to be deleted until 7 years after acceptance (Section 9).
• Newsletter choice. If you tick the optional box for the weekly Valuein tear-down (when you choose your handle after sign-up, or in Account settings), we record your email address, the time you opted in, the wording version shown, where you opted in and, if you later opt out, the time you did. The box is never ticked for you.
• Profiles are private by default. Your handle, display name, biography and images become publicly visible only if you choose to make your profile public.

3.2 Professional verification (not collected today)

Our systems reserve fields for an optional professional verification: a FINRA CRD number and an identity-proof document. No verification flow is live and we do not collect this information today. If we launch it, we will update this policy before collecting anything, ask only people who choose to be verified, and state how long the identity document is kept.

3.3 Workspace content

The research you create or that Agents create for you: theses, claims, reports (every version and rendered file), watchlists (including any weights you assign), signals and alert inbox items, scheduled tasks, Agent definitions, Agent runs and their outputs, actions an Agent staged for your approval and your approve/reject decision, saved citations and figure reviews, delivery records for your signals (the destination in shortened form, the payload sent and a short preview of the response), and Agent memory — short notes an Agent saves to remember your preferences between runs (up to 200 entries of up to 8,000 characters each). This is User Content under the Terms; you own it. An item you delete in the Workspace is kept in a recoverable state, so that you can restore it, until you delete your Account.

3.4 Watchlist weights and position snapshots

A watchlist holds the tickers you follow, any weights you assign and your notes. A feature that let you record current position values, including dollar amounts (current value per position, the price used, and where that price came from), was removed in October 2026: a snapshot you saved before then stays retrievable by you until you delete that watchlist or your Account, and no feature records new position values today. These figures are what you typed or imported; they are not linked to any brokerage, bank or other financial account, and we never ask for account numbers or account credentials.

3.5 AI chat history and Cross-Device Sync (always on)

Your Workspace chat conversations are stored in your own browser (up to 200 conversations; a conversation you have not touched for 30 days is removed from the browser unless you pin it). So that a conversation you start on one device is available on another, we also keep a copy of each conversation's title and message text in our database, associated with your Account. Cross-Device Sync is always on. The Chats page in the Workspace shows how many conversations your Account is holding; the number your Account can hold depends on your Plan, and conversations beyond it stay on your device only.

• A conversation that has not been updated for 30 days, and is not pinned, is removed from our copy the next time any of your devices syncs.
• Deleting a conversation deletes it from your account as well as from the device you deleted it on. We keep a deletion marker (no message text) so your other devices learn of the deletion; once it is 90 days old, it is removed the next time one of your devices syncs.
• These copies are deleted when you delete your account.
• We do not use them to train, fine-tune or improve any model.

3.6 Uploaded documents

You can attach a .txt, .md, .pdf or .docx file (up to 8 MB; up to 20 active uploads) to a conversation. We store the file and the text we extract from it so the AI can read it. An upload stops being readable 24 hours after you add it, and you can delete it sooner. Deleting an upload makes it unreadable; the stored file and the extracted text may be kept until you delete your Account.

3.7 Model keys you connect (bring your own key)

You can connect your own API key for Anthropic, OpenAI or OpenRouter. We seal the key with AES-GCM encryption inside an httpOnly cookie that expires within 24 hours; the plaintext key is never written to our databases, logs or backups.

Key vault. When you connect a key in the Workspace, we also store the same sealed copy — never the plaintext — in an encrypted key vault, so your scheduled Agents can run on your own key while you are away. The vault holds one record per Account (the provider name and the sealed ciphertext). It can be decrypted only with a secret held separately in our compute environment. Disconnecting your key deletes both the cookie and the vault record immediately, and the vault record is deleted when you delete your Account. Without a vaulted key, scheduled Agents run on Valuein's managed model (Section 7) and are billed to your balance. You can switch the vault off in chat settings to keep the key in the cookie only.

3.8 Payments, balance and pay-per-call

• Stripe processes all payments. Stripe collects your card details, billing address and email. We receive and store your Stripe customer identifier, Plan, subscription status, billing-period dates, and records of purchases and entitlements. We never receive your full card number, CVV or bank account number.
• Balance: if you fund a prepaid balance, which pays only for Valuein-managed AI compute, we keep the balance and a ledger of top-ups and debits (amount, time, and the chat or run each debit paid for). Until October 28, 2026 the balance could also buy pay-as-you-go data, so a ledger can still hold those earlier data debits and the purchase each one paid for.
• Agent payments without an Account (pay per call): when an AI agent pays per call without an Account, we keep the payment hold record (payment reference, tool and amount) for 9 days and the receipt (status, tool, amount and charge reference) for 30 days. We do not keep the caller's IP address; the payment itself is handled by Stripe.
• Restricted-party screening: before a paid purchase we check the display name on your Account and the country of your request, and daily while a paid subscription is live we check the name and billing country on your Stripe record, against the U.S. Consolidated Screening List (Section 5, item 8). The search goes to the U.S. International Trade Administration's screening service. We keep the result (the name screened, the country, the outcome and the public list entries that resembled it; never an address or IP address) and any decision a reviewer records, for 10 years, as U.S. sanctions record-keeping rules require (Section 9).

3.9 Usage, log and device data

• API, MCP and SDK usage: for each request: the endpoint or table, time, response status, response time, bytes served, which surface made the call (for example SDK or MCP), and the first characters of your access token as its identifier. We keep per-Account daily totals (calls, bytes, compute spend by channel) to enforce quotas, bill you and show you your usage. We do not log request bodies.
• Infrastructure logs: our services run on Cloudflare, whose platform logs record requests (including IP address, user agent and approximate location) for a short period (Section 9). Downloads from the free Sample endpoint additionally log the full IP address, user agent, country and referring page, to detect abuse of an endpoint that requires no Account. To count distinct anonymous visitors to the free Sample endpoint and to our MCP server, we also keep a salted, irreversible hash of the caller's IP address (for IPv6, of its network prefix); it is never linked to an Account and the address itself is not stored with it.
• Product events: first-party events such as Account created, verification email sent, first API call, checkout started, subscription activated, Agent run, and time actively spent in the Workspace (a per-tab heartbeat). Events carry your user identifier and, for some events, your email address, plus a short browser description (up to 120 characters of the user-agent) and the site host. We do not record IP addresses in these events.
• Experiments: when we test two versions of a page, we record that a random visitor identifier (the vi_vid cookie) saw a version, and whether that visitor later signed up or purchased.
• Rate limiting: IP addresses (for unauthenticated traffic) or token identifiers are used to count requests in short windows; the counters expire with the window.
• Website analytics: Cloudflare Web Analytics, which sets no cookies and gives us aggregate page-view and performance data only.

3.10 Cookies and similar technologies

We use first-party cookies for sign-in, your connected model key and chat lane (24 hours), your cookie choice (six months) and region (for the browser session), your Workspace preferences, and three first-party measurement cookies — vi_ft (first-touch channel and referring site, 1 year; when the link that brought you was tagged for a marketing campaign it also holds that campaign's name and the identifier of the post that carried the link, never your name or email), vi_persona (the solutions page you last read, 30 days) and vi_vid (random experiment identifier, 1 year). We also store your light/dark theme choice, Workspace preferences and chats in your browser's local storage. Outside the United States, and wherever we cannot tell where you are, we set the three measurement cookies only after you press Accept on our cookie banner; anywhere, Cookie settings in the footer lets you reject them. The short version, including what Global Privacy Control changes, is in the Cookies section.

3.11 Messages you send us

• Support and intake email. Our mailboxes, including legal@valuein.biz and support@valuein.biz, are hosted by Google (Gmail). Mail to our support and intake mailboxes is also received by an automated intake service, which stores the full message, its attachments and your sender address so we can reply. Up to 8,000 characters of the cleaned message body are sent to Anthropic's model to classify the message (for example bug report, data request, billing). We file a routing record — subject line, classification, a one-line summary, a redacted excerpt of up to 300 characters, and a hash of your email domain — in our internal issue tracker (GitHub) and notify our internal Slack. Your name and address are not placed in the issue.
• Contact form. Your name, email, topic, message and IP address are emailed to our team inbox through our email provider (Resend). We also keep the form fields (not your IP address) in our database so our support inbox can show the message; that copy is deleted with the Account that uses the same email address.
• "Report a data issue" form. The issue, the page and figure concerned, your suggested correction and your IP address are posted to our internal Slack. A copy of the report without your IP address or any identifier is kept in our database for our support inbox.
• Product feedback and surveys. Feedback you submit in the product, and answers to our product-market-fit survey (with your email address).
• Conversations with our founder. If you speak with us by call, email or message, we may keep a short note of who we spoke with and what we learned.

3.12 Public shares and who views them

When you publish a profile, report, thesis or claim, or create a share link, it is public: anyone with the link can see it, and search engines and AI systems may index it. When someone opens a share link we record the time, a 16-character SHA-256 hash of the viewer's IP address combined with a secret value unique to that share, and the first 80 characters of the viewer's browser user-agent, so the owner can see view counts. We cannot reverse the hash to an IP address.

3.13 Leak-detection identifiers in data you download

Responses and files you obtain with your Credentials may carry a per-Account identifier (an "envelope ID") in a response header and, for files downloaded through our gateway, in the file's metadata. It lets us trace a copy of Valuein Data found outside the Service back to the Account it was issued to. It is never placed in, and never alters, a financial value or the order of rows. We do not keep a table of envelope IDs: when we need to trace a copy, we recompute the IDs from Account identifiers, the dataset, the data snapshot and the month.

3.14 People who are not our users

(a) People named in public filings. Some datasets reproduce records from public regulatory filings that name individuals who are not our users — officers, directors and other insiders named in Forms 3, 4, 5 and 144; beneficial owners named in Schedules 13D and 13G; managers named in Form 13F; and, where an issuer's own SEC registration data names one, its chief executive. Form ADV records describe advisory firms (names, registration numbers, addresses, telephone numbers and websites), not their personnel. These are public documents filed with the U.S. Securities and Exchange Commission (Form ADV is published by the SEC through its Investment Adviser Public Disclosure system) under mandatory disclosure rules. We reproduce them as filed, attributed to the filing, for financial research and market-transparency purposes. We do not enrich these records with information from non-public sources, we do not use them to make decisions about the individuals concerned, and every record links to the filing it was taken from.

Your rights if you are named in a filing: you may ask us to correct any reproduction that does not match the filing, and you may object to our processing of records that name you, by writing to legal@valuein.biz with the filing reference. We cannot amend the underlying public filing — only the filer or the SEC can — and we may decline to remove an accurate reproduction of a public filing where the public interest in market transparency or a legal obligation prevails; we will explain our decision in writing.

(b) Business contacts at investment advisers. To find firms that may want Valuein, we keep a list of investment-advisory firms built from their public Form ADV and Form 13F filings (firm name, registration numbers, address, phone, website, assets and client mix). For some firms we add named people: name, role, a business email address researched by hand from public sources such as the firm's website, a business phone, a LinkedIn profile link, and the history of our emails to them (dates sent, replies, notes). We do not buy contact lists or use email-finding services. We send at most one introductory email and two follow-ups per person; every email says how to opt out ("reply 'unsubscribe'"), and once you opt out or reply, we stop. If you ask us to delete your details, we delete them and keep only your email address on a do-not-contact list so we never contact you again.

In short: to run the Service you asked for, bill you, keep it secure, improve it, talk to you, sell to businesses that may want it, and meet the law. This summary is not a substitute for the list below.

1. Provide the Service: create and secure your Account; issue and rotate access tokens; deliver Valuein Data through the API, SDK, MCP Server and Workspace; run Agents and AI features; sync chats; enforce Plan limits and quotas.
2. Billing: subscriptions, balance top-ups and debits, pay-per-call charges, refunds, tax and accounting records.
3. Transactional messages: sign-in codes, token delivery, receipts, billing problems, security notices, deliverables from your Agents, and replies to your requests. You cannot opt out of these while your Account is active.
4. Product updates: news about features and datasets, with an unsubscribe link in every message. When you first sign up or buy a Plan and give a name at checkout, we may add your email address and name to our product-updates list, held by our email provider (Section 8).
5. Security and abuse prevention: rate limits, bot protection (Cloudflare Turnstile), usage-threshold alerts, preventing repeat free-credit or sign-in-code abuse, investigating misuse of Valuein Data (including envelope IDs), enforcing the Terms.
6. Measurement and improvement: activation and retention metrics, page experiments, which channels and pages bring customers, error monitoring, performance. We use first-party data only; we do not build advertising profiles.
7. Business development: contacting investment-adviser staff about Valuein (Section 3.14(b)); keeping notes of sales conversations.
8. Legal: complying with law and lawful requests, keeping records the law requires, and establishing or defending legal claims. We screen customer names, organisations and countries against U.S. government restricted-party lists before and after purchase, to comply with legal obligations.
9. Weekly newsletter (only if you opt in): the weekly Valuein tear-down, sent from our newsletter hosted on Substack. You choose this separately from your Account; nothing else you give us is added to it. You can unsubscribe from any issue or switch it off in Account settings, and we stop adding your address.

We do not use personal information for any materially different purpose without telling you first and, where the change would apply to information we already hold, getting your consent (Section 22).

In short: for people in the EEA, UK and Switzerland, most processing is needed to perform our contract with you; security, measurement and public-filing data rest on our legitimate interests; marketing email to non-customers and some cookies rest on consent where the law requires it. This summary is not a substitute for the table below.

You may withdraw consent at any time without affecting processing before the withdrawal. You may object to processing based on legitimate interests (Section 14).

Automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Automated controls such as rate limits and bot checks may slow or refuse individual requests; they do not close Accounts.

In short: prompts go to the AI provider for the lane you choose — Anthropic on Valuein's own commercial account (managed lane), or your own provider account (bring your own key). Neither we nor, on the managed lane, Anthropic train on your content. This summary is not a substitute for this section.

The lanes.

What a provider receives: your message; the conversation so far; a standing instruction from Valuein; for an Agent run, the Agent's goal and the tickers or watchlist it covers; the text of any upload the model reads through a tool; and results of the Valuein tools the model calls. We do not send any provider-side setting that limits retention (such as a "do not store" flag or an OpenRouter data-collection preference); if you want one, configure it in your own provider account. We do not control, and are not responsible for, a provider's own processing of content you direct to it under your own account.

Your Valuein credential and Claude models. When the model is from Anthropic, the request includes a credential for your Valuein Account so the model can call Valuein's MCP tools for you. Only read-only tools, plus a tool that stages an action for your approval, are enabled in that connection. The credential is your Valuein access token; rotate it at any time in Account settings.

We never train on customer content. We do not use your prompts, uploads, saved research, Agent memory or AI Output to train, fine-tune or evaluate any machine-learning model. The same applies to your model keys, chats and other User Content, and to models of ours or anyone else's. This will not change for information we already hold (Section 22).

Morning brief. If you use it, a daily brief is generated from the tickers on your watchlists through the lane you use, and stored on your Account until you delete it or your Account.

Agents. Agents run on a schedule you set and may call the Service and AI providers for you without further interaction. Higher-impact actions are staged for your approval and recorded in an audit log. Agents do not place trades or move money.

Accuracy. AI output can be incomplete or wrong. It is informational only and not investment, legal, tax or other professional advice (see the Terms).

In short: only with service providers that run parts of the Service for us, AI providers you direct us to, people you choose to share with, and authorities where the law requires. We do not sell it. This summary is not a substitute for this section.

• Subprocessors (service providers). Cloudflare (hosting, databases, storage, network security, analytics, bot protection), Stripe (payments), Resend (email delivery and our product-updates mailing list), Anthropic (managed AI and intake classification), GitHub (internal issue tracker), Slack (internal alerts, which can include a customer's email address on billing events, and the IP address on data-issue reports), Google (hosting of our email mailboxes). We share data with service providers that process it on our behalf; a current list is available on request to legal@valuein.biz. They may use the information only to provide their service to us, except that Cloudflare (bot protection) and Stripe (fraud prevention) may also use limited device and transaction signals to secure and improve their own security services, as their own terms allow; see the Cookies section.
• Newsletter host (only if you opt in). If you opt in to the weekly Valuein tear-down, your email address is added to our newsletter hosted on Substack (Substack, Inc., United States), which sends it to you under its own terms and privacy policy. Anyone can unsubscribe from any issue or switch the newsletter off in Account settings. We share no other Account data with Substack.
• Sign-in providers. Google and LinkedIn authenticate you under their own privacy policies. We do not send them your Valuein usage.
• Destinations you choose. AI providers you connect with your own key (Section 7); Slack workspaces, webhooks and email addresses you configure for signals and Agents; and anyone who sees content you publish or share.
• Your organisation. If you use a Seat that an organisation provides under an Enterprise Agreement, that organisation may see membership and administration information about your Seat.
• Sanctions screening. To run the checks in Section 3.8 we send the name and country being screened to the U.S. International Trade Administration's Consolidated Screening List search service.
• Legal and safety. We may disclose information when required by a valid court order, subpoena, warrant or other legal process, or when we believe in good faith that disclosure is necessary to prevent fraud, protect anyone's safety, or protect our rights. Where the law permits, we will try to tell you first.
• Business transfers. If Valuein's business is transferred to a company formed to carry it on, or in a merger, reorganisation or sale of substantially all assets, personal information may transfer to the successor, which must honour this policy. We will notify you.

No sale; no sharing for advertising. We do not sell personal information, and we do not share or process it for cross-context behavioural advertising or targeted advertising, as those terms are defined in the California Consumer Privacy Act (CCPA) and other US state laws. We have not done so in the past 12 months.

In short: most information lives as long as your Account and goes when you delete it. A few things expire sooner (sign-in codes, key cookies, logs); a few outlast the Account for stated reasons (billing totals, de-identified metrics, anti-abuse records, published certificates). This summary is not a substitute for the table below.

Backups and recovery. We keep no separate backups of the databases that hold your personal information. Cloudflare's databases we use keep an always-on point-in-time recovery history of up to 30 days, which cannot be switched off; a deleted record therefore remains recoverable by us, but not visible to anyone, for up to 30 days and is then gone.

In short: deleting your Account in Account settings is immediate and removes your data from every store we run, except a short, explained list. This summary is not a substitute for this section.

When you delete your Account from Account settings, or we process your emailed request (within 30 days of receiving it), the following happens automatically:

• Access and billing: your access token is revoked and every subscription is cancelled; the token, the email-to-token index and the customer record are removed from our key-value store.
• Your identity and content: your profile, handle and handle history, notification preferences, organisation memberships, theses, claims, reports (every version and rendered file), watchlists and position snapshots, Agents and their runs and memory, signals and scheduled tasks, alert inbox, citation overrides, uploaded files and images, synced chat copies, the key-vault record, staged actions and their approval entries, the balance and ledger, sign-in codes, morning briefs and public shares are deleted from the Workspace database, the MCP database and object storage. Public pages you published stop resolving. Where a report you sold is still held by its buyer, the buyer's copy and the sale record survive, and only your authorship is removed.
• What we keep, and why: (1) product and funnel events with your email address and other direct identifiers removed; (2) per-Account daily usage totals and purchase and entitlement records, which are billing records (our payment processor likewise keeps invoices under its own obligations); (3) point-in-time certificates you published — they are public signed documents, so deleting your Account does not withdraw them; you may ask us to revoke one, and the revocation is recorded at its verification URL; (4) the anti-abuse records that stop a deleted Account being re-created to farm free credit or sign-in codes; (5) a deletion record holding only irreversible hashes of your customer identifier and email address, the time and the outcome; (6) survey answers and product feedback with your identifier removed or replaced by a one-way hash; (7) records of the legal documents you accepted, with the time, IP address and browser, as evidence of the contract (Section 9); (8) the email delivery log (recipient address, message type, time and delivery status), which we do not yet delete automatically; (9) restricted-party screening records (Section 3.8), which U.S. sanctions record-keeping rules require us to keep for 10 years; and (10) our own notes of sales conversations (Section 3.11), which are business records not linked to your Account.
• If any part of the erasure cannot be completed automatically, we are alerted and finish it by hand; we do not report a deletion as complete until it is. Copies third parties made of content you published (search-engine caches, downloads) are outside our control. Messages you sent to support or intake follow Section 9 and are not linked to the deleted Account.

Cancelling a subscription is not deleting your Account: your Account moves to the free Benchmark Plan and your data stays until you delete it.

In short: wherever you live, you can ask to access, correct, delete or export your data, object to some uses, and opt out of marketing; we answer verified requests within 30 days, free. This summary is not a substitute for this section.

We give every person the following rights regardless of where they live:

• Access — confirm whether we process your personal information and get a copy.
• Correction — fix inaccurate information; most Account details can be edited in Account settings.
• Deletion — delete your Account yourself (immediate) or ask us (within 30 days), with the exceptions in Section 10.
• Export (portability) — a machine-readable copy of the personal information you provided and your User Content, in JSON, within 30 days of a verified request.
• Objection and restriction — object to processing based on legitimate interests, or ask us to limit it while a question is resolved.
• Marketing opt-out — use the unsubscribe link in any product email, your notification settings, or the newsletter switch in Account settings.
• Non-discrimination — we will not deny service, charge different prices or give a lower quality of service because you exercised a right.

How to ask. Email legal@valuein.biz with the subject "Privacy Request". This works whether or not you have an Account (for example, if you are named in a filing or are an adviser contact).

Verification. If you write from the email address on your Account, that is normally enough. Otherwise we may ask you to confirm control of the address by replying to a message we send, and for requests for specific pieces of information or deletion we may ask for one more piece of information we already hold. We use what you give us for verification only.

Authorised agents. In every state and country, you may use an authorised agent. We may ask the agent for your signed permission and ask you to confirm your identity directly with us, unless the agent holds a power of attorney under applicable law.

Timing. We confirm receipt within 10 business days and respond within 30 days. Where a state law gives a longer period (45 days, extendable once by 45 days with notice), we still aim for 30 days; for GDPR requests, one month, extendable by two months for complex requests with notice. Requests are free unless manifestly unfounded or excessive.

Appeals. If we decline any part of your request, you may appeal by emailing legal@valuein.biz with the subject "Privacy Rights Appeal". A person who did not make the original decision will review it, and we will tell you the outcome and reasons in writing within 45 days. If we deny your appeal, you may contact your state Attorney General (or, in the EEA/UK/Switzerland, your data protection authority); we will include the contact details in our answer.

In short: we extend the rights in comprehensive US state privacy laws — including California, New Jersey, Indiana, Kentucky and Rhode Island — to residents of every state. This summary is not a substitute for this section.

12.1 California (CCPA, as amended by the CPRA)

California residents have the rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against. Notice at collection — in the past 12 months we collected:

Sensitive personal information. We do not collect sensitive personal information as defined by the CPRA: we hold no passwords or account log-in credentials (sign-in is OAuth or a one-time code) and no financial account numbers. If we launch identity verification (Section 3.2) we will update this notice first. We do not use any personal information to infer characteristics about you.

No sale or sharing. See Section 8. We do not knowingly sell or share the personal information of consumers under 16.

12.2 Other states

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have rights under their state laws to confirm processing, access, correct, delete and port their personal data, and to opt out of sale, targeted advertising and profiling in furtherance of decisions with legal or similarly significant effects. We do none of the last three. Oregon and Minnesota residents may ask for the list of specific third parties to which we disclosed personal data. We honour these rights for residents of every US state, through the process in Section 11, whether or not a state's law applies to us.

New Jersey. Under the New Jersey Data Privacy Act, "sensitive data" includes financial information such as an account or card number together with the code or password needed to access it. We do not collect financial account credentials. Holdings and positions you enter (Section 3.4) are not linked to any account credential. We recognise universal opt-out mechanisms as described in Section 13.

Rhode Island. We disclose the categories of personal information we collect in Section 3 and the third parties that receive it in Section 8. We do not sell personal information to anyone. Contact: legal@valuein.biz.

Indiana and Kentucky. Rights under the Indiana Consumer Data Protection Act and the Kentucky Consumer Data Protection Act are available through Section 11, including appeal.

In short: if your browser sends Global Privacy Control, we treat it as an opt-out and also stop setting our three measurement cookies. This summary is not a substitute for this section.

When your browser sends a Global Privacy Control (GPC) signal (the Sec-GPC: 1 header), or another universal opt-out mechanism recognised by your state's law, we:

1. treat it as your request to opt out of sale, sharing, and targeted advertising (none of which we do — the signal confirms that position for you);
2. stop setting, and stop reading, the first-party measurement cookies vi_ft, vi_persona and vi_vid for that browser, and record no experiment exposure for it; and
3. if you are signed in, record on your Account that you sent the signal. The signal itself controls each browser; to opt out on another browser or device, turn on Global Privacy Control there too, or email privacy requests to legal@valuein.biz and we will apply the opt-out to your Account.

Do Not Track. There is no common standard for responding to browser "Do Not Track" signals, so we do not change our behaviour when one is received. Because we use no third-party tracking or advertising technology, a DNT signal would have nothing further to stop; GPC is the signal we honour.

In short: you have the full GDPR rights; Valuein is the controller, and you can reach us directly at legal@valuein.biz. This summary is not a substitute for this section.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21 — for direct marketing we stop immediately and without exception), not to be subject to solely automated decisions with legal or similarly significant effects (Art. 22 — we make none), and to withdraw consent. The equivalent rights apply under the UK GDPR and the Swiss Federal Act on Data Protection.

Controller. Valuein (as identified in the Terms), contact legal@valuein.biz.

Representative. Valuein has no establishment in the EEA or the UK and has not appointed a representative under Article 27 GDPR or Article 27 UK GDPR. If we appoint one, we will publish their contact details here. Until then, contact us directly at legal@valuein.biz.

Complaints. You may complain to your local supervisory authority (list at edpb.europa.eu), the UK Information Commissioner's Office (ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner. We would welcome the chance to address your concern first.

In short: you have the same rights wherever you live; this section only names the laws that give them to you in other places. This summary is not a substitute for this section.

Valuein is operated from the United States, and the Service is open to visitors from anywhere. Section 11 gives everyone the same rights, whatever local law adds. Where a law below applies to you, the rights in Section 11 are the ones we will honour under it, and requests go to the same address (legal@valuein.biz, subject "Privacy Request"). You can also delete your Account yourself in Account settings, which takes effect immediately.

• EU and EEA, United Kingdom, Switzerland. The GDPR, the UK GDPR and the Swiss Federal Act on Data Protection (nFADP) give you rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority (see Section 14).
• Brazil. Under the Lei Geral de Proteção de Dados (LGPD) you may confirm that we process your data and access, correct, anonymise, delete or port it, and complain to the Autoridade Nacional de Proteção de Dados (ANPD).
• Canada. Under PIPEDA, and Quebec's Law 25 if you live in Quebec, you may access and correct your personal information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. Your information is processed in the United States, as described under International transfers.
• Japan. Under the Act on the Protection of Personal Information (APPI) you may ask us to disclose, correct, stop using or delete the personal information we hold about you. Your information is processed in the United States.
• South Korea. Under the Personal Information Protection Act (PIPA) you may ask to access, correct, delete or suspend the processing of your personal information. Your information is processed in the United States.
• India. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) you may ask for access to, correction and erasure of your personal data, withdraw consent, and have a grievance addressed; write to the address above and we will respond within the time in Section 11.
• Australia. Under the Privacy Act 1988 and the Australian Privacy Principles you may ask to access and correct your personal information and complain to the Office of the Australian Information Commissioner. Your information is processed in the United States.
• Türkiye. Under the Personal Data Protection Law No. 6698 (KVKK) you may ask whether we process your personal data, ask for information about and correction or deletion of it, object to results of processing that harm you, and complain to the Personal Data Protection Authority (KVKK).
• South Africa. Under the Protection of Personal Information Act (POPIA) you may ask us to confirm what we hold about you and to correct or delete it, object to processing, and complain to the Information Regulator.
• Mainland China. The Service is operated from the United States and is not specifically directed to mainland China. If you use it from there, the personal information you give us or that our systems record about your use is processed in the United States, not in mainland China. Under the Personal Information Protection Law (PIPL) you may ask to access, copy, correct, supplement or delete it, ask us to explain our rules, and withdraw consent; email the address above and we will respond within the time in Section 11. We have no office or representative in mainland China.
• Everywhere else. If your country's law gives you rights over your personal information, you may exercise them the same way. If it gives you fewer, you still have the rights in Section 11.

We do not charge for these requests, and we answer within the time stated in Section 11. Outside the United States we also ask before setting our three measurement cookies; see the Cookies section.

In short: Valuein and most of its service providers are in the United States; data is processed there and on Cloudflare's global network, with contractual safeguards. This summary is not a substitute for this section.

Valuein operates from the United States, and your information is processed in the United States and in the other countries where Cloudflare operates its network. A current list of our service providers, with their locations, is available on request to legal@valuein.biz.

For personal data of people in the EEA, the UK and Switzerland, where we transfer it to a service provider outside those regions we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the Swiss amendments. You may ask for a copy of the relevant safeguards at legal@valuein.biz.

In short: encryption in transit and at rest on Cloudflare, sealed model keys, hashed codes, least data; no system is perfectly secure. This summary is not a substitute for this section.

• In transit: connections to the Service use TLS, and the website tells browsers to use HTTPS only (HTTP Strict Transport Security).
• At rest: personal information on our Cloudflare databases, key-value stores, object storage and Durable Objects is encrypted at rest by Cloudflare with AES-256, using keys Cloudflare manages.
• Credentials: access tokens are 256-bit random values; you can rotate yours at any time and the old one stops working immediately. Model keys are sealed with AES-GCM and never stored in plaintext. Sign-in codes are stored only as hashes bound to your address and peppered with a server secret. We store no passwords.
• Research database: the database we use to build Valuein Data from public filings runs on hardware Valuein controls. It holds public-filing data, not customer Account data.
• Access: production access is limited to the founder.
• Protections: Cloudflare network protections, Turnstile bot checks on public forms, rate limits, and alerts when usage crosses thresholds. Our rate limits are designed to let traffic through if the limiter itself fails, so they are a control, not a guarantee.
• Reporting a vulnerability: email security@valuein.biz.

No method of transmission or storage is completely secure, and we cannot promise that your information will never be accessed without authorisation.

If a security breach affects your personal information, we will notify you and the authorities as the law requires. For people covered by the GDPR or UK GDPR, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to your rights and freedoms, and affected individuals without undue delay where the risk is high. For US residents, we will follow California Civil Code §1798.82 and the breach-notification laws of the other states where affected individuals live. Business customers receive notice under their Data Processing Addendum.

The Service is a professional financial-data platform for people 18 or older and is not directed to children. We do not knowingly collect personal information from children under 13 (as defined by the Children's Online Privacy Protection Act) or allow anyone under 18 to create an Account. If we learn that we have collected information from a child under 13, we will delete it and close the Account within 30 days; if we learn that an Account holder is under 18, we will close the Account and delete its information. Parents or guardians can contact legal@valuein.biz.

The Service provides data about publicly traded companies taken from their SEC filings — for example, a company's revenue or balance sheet. That data describes public companies and their public disclosures, not you, and is governed by the Terms and the Data & API License Schedule, not by this policy. This policy covers information about individuals: you, visitors, people named in filings (Section 3.14(a)) and business contacts (Section 3.14(b)).

In short: we use a few first-party cookies. We use no advertising cookies and no third-party analytics cookies.

• Strictly necessary. The sign-in session, the sign-in security (CSRF) token, and your cookie choice and region (vi_consent, six months; vi_region, for the browser session). We set these without asking.
• Functional. When you connect your own model key or choose a chat lane in the Workspace, vi_llm_key (your sealed key) and vi_llm_lane are set for 24 hours.
• Measurement. Three first-party cookies show us which posts and pages bring people here: vi_ft (first-touch channel and referrer, 1 year), vi_persona (the solutions page you last read, 30 days) and vi_vid (a random experiment identifier, 1 year). They never hold your name or email. In the United States we set them unless you opt out. Everywhere else, and where we cannot tell where you are, we set them only after you press Accept. We honour Global Privacy Control (Sec-GPC: 1) by setting and reading none of them. Cookie settings in the footer changes your choice at any time.
• No cookies. Cloudflare Web Analytics sets no cookies. Cloudflare Turnstile checks sign-in, sign-up and contact forms for bots.

In short: 30 days' notice and your re-acceptance for material changes; we never expand how we use data we already hold without your consent. This summary is not a substitute for this section.

• Material changes — changes that expand the information we collect, add a new purpose or a new kind of recipient, or reduce your rights — take effect only after 30 days' notice by email and in the Service, and you will be asked to accept the updated policy before you continue using your Account. If you do not accept, you may delete your Account or ask for an export before the change takes effect.
• Never retroactive. We will not use personal information we collected under an earlier version of this policy for a materially new purpose — for example, training AI models — by changing this policy. Any such use of information we already hold requires your express, opt-in consent. The US Federal Trade Commission has warned (February 2024) that quietly changing terms to expand the use of data already collected may be unfair or deceptive; we will not do it.
• Other changes — clarifications, corrections, new legally required disclosures that do not reduce your rights — take effect when posted, with the date and version above updated. Earlier versions are available on request.

Valuein (as identified in the Terms)
Privacy and legal requests: legal@valuein.biz
Support: support@valuein.biz
Security: security@valuein.biz

We aim to reply to every privacy question within 10 business days, and always within the deadlines in Section 11.