Privacy Policy

1. Company Information

This Privacy Policy governs the collection, use, and disclosure of personal information by Perspectec Inc. ("Perspectec," "we," "us," or "our"), a corporation incorporated under the laws of Canada.

Data Controller: Perspectec Inc. is the data controller for personal information processed through our services.

2. Information We Collect

Personal Information

We collect the following personal information when you use our services:

• Account Information: First name, last name, email address
• Contact Information: Phone number (for SMS verification)
• Authentication Data: Encrypted passwords and authentication tokens
• Payment Information: Credit card details (processed securely through Stripe)

Usage Information

• Service Usage: Credit consumption, API requests, document processing activities
• Technical Data: IP address, browser type, device information
• Application Logs: System performance data, error logs, security events
• Content Data: Documents you upload for processing and analysis

Information We Do NOT Collect

• We do not use Google Analytics or similar tracking services
• We do not use advertising cookies or tracking pixels
• We do not collect data from social media platforms
• We do not use third-party marketing or advertising networks

3. Legal Basis for Processing (UK GDPR Article 6)

We process your personal data under the following legal bases:

4. How We Use Your Information

We use your personal information for the following purposes:

• Service Provision: To provide AI-powered equity research and financial analysis services
• Account Management: To create and maintain your user account
• Payment Processing: To process credit purchases and manage billing
• Communication: To send service-related notifications and support communications
• Security: To protect against fraud, unauthorized access, and security threats
• Legal Compliance: To comply with applicable laws and regulations
• Service Improvement: To analyze usage patterns and improve our services

5. Information Sharing and Disclosure

Third-Party Service Providers

We share information with the following trusted service providers:

• Supabase: Database hosting and user authentication (data stored in secure facilities)
• Stripe: Payment processing (they handle credit card information directly under their own privacy policy)
• Anthropic: AI model services for financial analysis (document content may be processed)
• Twilio: SMS verification services (phone numbers for verification only)

Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal process or government requests
• Protect the rights, property, or safety of Perspectec, our users, or others
• Investigate and prevent fraud or security issues
• Enforce our Terms of Service

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Data is encrypted at rest and in transit using industry-standard protocols (TLS 1.3)
• Access Controls: Strict role-based access controls limit who can view your information
• Secure Infrastructure: Our systems are hosted on secure, monitored infrastructure with SOC 2 controls
• Regular Audits: We conduct regular security audits and penetration testing
• Audit Logging: Comprehensive audit trails track access to sensitive data

7. Your Rights (UK GDPR Data Subject Rights)

Under the UK GDPR and other applicable privacy laws, you have the following rights:

8. Data Retention

We retain your personal information based on the following schedule:

• User Account Data: Retained while your account is active; deleted within 30 days of account closure
• Financial Records: 7 years (legal requirement for financial records)
• Audit Logs: 2 years (SOC 2 Type II compliance requirement)
• API Usage Logs: 90 days
• Chat Conversations: 1 year, or until you delete them

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

9. International Data Transfers

Your data is primarily stored and processed in Canada. When we transfer personal data internationally, we ensure appropriate safeguards:

• Canada Adequacy Decision: The European Commission and UK have recognized Canada as providing adequate protection for personal data transferred from the EEA/UK to Canadian organizations subject to PIPEDA.
• Standard Contractual Clauses (SCCs): Where required, we use EU/UK-approved Standard Contractual Clauses with our service providers.
• Additional Safeguards: We implement supplementary technical and organizational measures where necessary.

10. Cookies and Similar Technologies

We use essential cookies only. These are strictly necessary for our website to function and cannot be switched off.

We do NOT use: Analytics cookies, advertising cookies, tracking pixels, or third-party marketing cookies.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will promptly delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on our website, updating the "Last Updated" date, and, where appropriate, notifying you by email. Your continued use of our services after any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

14. Supervisory Authorities

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with a supervisory authority:

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Canada and the Province of Ontario, as well as applicable UK and EU data protection laws where relevant. Any disputes relating to this Privacy Policy will be subject to the exclusive jurisdiction of the courts of Ontario, Canada, except where UK GDPR provides for local jurisdiction.