AlphaSight AI ("we", "us", "our") operates https://chat.alphasightai.online and https://chat.alphasightai.online/info(the "Service"). This page explains what personal information we collect, how we use it, how we protect it, and the rights you have under applicable law including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), India's Digital Personal Data Protection Act (DPDP), and the UK Data Protection Act.

1. Information we collect

1.1 Information you provide

• Account data: name, email address, hashed password, profile photo.
• Portfolio & watchlist data: tickers, holdings, target prices, custom notes.
• Chat history: prompts you send to the AI assistant and the responses returned.
• Billing data (when applicable): processed by our payment provider; we never store full card numbers.
• Support correspondence: emails, chat transcripts, attachments you share.

1.2 Information collected automatically

• Device and browser metadata (user agent, screen size, language, timezone).
• IP address, approximate geolocation, and ISP — used for security, fraud prevention, and regional content.
• Usage analytics: pages visited, features used, performance metrics (Vercel Speed Insights).
• Cookies and similar technologies (see Section 6).

1.3 Information from third parties

• Market data from Yahoo Finance and other providers (no personal data of yours is sent there — your tickers are queried server-side).
• OAuth identifiers if you sign in with Google, GitHub, or Apple.

2. How we use your information

• To provide, maintain, and improve the Service.
• To personalize your dashboard, daily brief, and AI responses.
• To process transactions and send transactional emails (password reset, receipts, security alerts).
• To detect, prevent, and respond to fraud, abuse, security incidents, and illegal activity.
• To comply with legal obligations (KYC, tax reporting, court orders).
• To send marketing communications, where you have opted in and can unsubscribe at any time.

3. Legal bases (GDPR Art. 6)

We process your data on the following grounds: (a) performance of a contract — to deliver the Service you signed up for; (b) legitimate interests — security, fraud prevention, product improvement; (c) consent — for marketing, optional analytics, and personalized advertising; (d) legal obligation — when required by law.

4. AI processing

Chat messages are processed by large language model providers (Mistral AI, Groq, and similar) under contractual data-processing agreements that prohibit them from training models on your data. Conversations are stored in your Supabase-hosted database; you can delete them at any time. We do not sell your chat content to anyone, ever.

5. How we share your information

• Service providers: Supabase (database, auth), Vercel (hosting), Mistral & Groq (LLM inference), Yahoo Finance (market data — outbound only), email delivery, payment processors.
• Advertising partners: if you see ads on the marketing site, Google AdSense and other ad networks may set cookies. You can opt out of personalized advertising at google.com/settings/ads and optout.aboutads.info.
• Legal compliance: when required by subpoena, court order, or applicable law.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice to you.
• With your consent: for any other purpose disclosed at the time of collection.

We do not sell your personal information for monetary consideration. Under CCPA, the "sharing" of identifiers for cross-context behavioral advertising may apply — you may opt out via our cookie banner or the "Do Not Sell or Share My Personal Information" link.

6. Cookies and tracking

We use cookies for: (a) essential authentication and security; (b) preferences (theme, language); (c) analytics (Vercel Speed Insights, Google Analytics if enabled); (d) advertising (Google AdSense if enabled on marketing pages). You can manage cookies through your browser, and we honor the Global Privacy Control (GPC) signal.

7. Data retention

• Account data: kept while your account is active and for 30 days after deletion request, then permanently erased.
• Chat history: kept until you delete it, or up to 24 months for inactive accounts.
• Logs and analytics: aggregated and anonymized after 90 days.
• Backup tapes: rotated every 30 days; deleted data persists in backups for up to 35 days.

8. Security

We protect your data with: TLS 1.3 encryption in transit, AES-256 at rest, row-level security in Postgres, hashed passwords (Argon2id via Supabase), HTTP-only secure cookies, a strict Content-Security-Policy, and regular security audits. No system is perfectly secure — please use a strong unique password and enable two-factor authentication.

9. International data transfers

Your data may be processed in countries outside your own, including the United States and the European Union. We rely on Standard Contractual Clauses, the EU-US Data Privacy Framework, and equivalent safeguards.

10. Your rights

Depending on your jurisdiction you have the right to: access your data; correct it; delete it; restrict or object to processing; receive a portable copy; withdraw consent; lodge a complaint with a supervisory authority. To exercise these rights, email support@alphasightai.online. We respond within 30 days.

11. Children

AlphaSight AI is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We will post material changes to this Privacy Policy on this page with an updated effective date and, where required, notify you by email.

13. Contact

AlphaSight AI · support@alphasightai.online