Privacy Policy

1. INTRODUCTION

This Privacy Policy explains how KlirInvest collects, uses, stores, and protects personal data. It is designed to address UK GDPR, EU GDPR, UAE Personal Data Protection Law (PDPL), and applicable US privacy rights where those laws apply to a user or processing activity.

2. DATA CONTROLLER

KlirInvest acts as the data controller for personal data processed through the platform.

Contact: hello@klirinvest.com

Privacy and security requests: hello@klirinvest.com.

KlirInvest has not appointed a statutory Data Protection Officer or EU representative at this stage. We will update this notice if our processing, establishment, or user footprint makes either appointment legally required.

3. DATA WE COLLECT

We may collect:

• Account information (email, authentication credentials)
• Email addresses submitted through free tools and guides before creating an account (lead capture) — retained for up to 12 months
• Prospect analyzer submissions made through an advisor's shared link (your email, the tickers you entered, and the analysis shown to you) — shared with that advisor as disclosed on the form, retained for up to 12 months unless you become that advisor's client
• Portfolio data entered by the user
• Usage data (pages viewed, features used)
• Technical data (IP address, device type)

We do not collect:

• Bank credentials
• Trade execution permissions

Sources of data:

• Directly from you when you create an account, enter portfolio data, use free tools, or contact us
• From read-only broker connections you authorize through SnapTrade
• From Google if you choose Google sign-in
• From advisors or team administrators when they invite or manage client workspaces
• From technical logs, cookies, and analytics tools subject to your consent choices

4. LEGAL BASIS & PRIVACY FRAMEWORKS

Data is processed under:

• User consent
• Contractual necessity
• Legitimate interest (platform security and analytics)
• Legal obligation, where required by applicable UK, EU, UAE, or US law

Depending on your location and the context of processing, privacy rights may arise under the UK GDPR and Data Protection Act 2018, EU GDPR, UAE PDPL, and applicable US state privacy laws such as CCPA/CPRA-style rights. KlirInvest applies the same practical access, correction, deletion, objection, and portability request process wherever feasible.

Purpose-specific bases include:

• Account creation, authentication, subscription access, portfolio analytics, and support — contract necessity
• Security logging, abuse prevention, fraud prevention, rate limiting, audit trails, and service improvement — legitimate interests
• Optional analytics, advertising pixels, conversion measurement, and non-essential cookies — consent
• Billing records, tax records, sanctions/fraud checks, and legally required disclosures — legal obligation where applicable

Our legitimate interests are keeping the service secure, preventing fraud and abuse, measuring reliability, improving product quality, and maintaining evidence needed to protect users and the platform. You may object to processing based on legitimate interests where applicable.

5. PURPOSE OF PROCESSING

Data is used to:

• Provide analytics and simulations
• Improve platform functionality
• Ensure system security
• Meet legal obligations

You are not under a statutory obligation to provide account or portfolio data. Some data is contractually necessary to create an account, provide portfolio analytics, process payments, secure the service, or respond to support requests. Optional analytics and advertising pixels are not required to use KlirInvest.

6. DATA STORAGE & SECURITY

• Data is encrypted in transit (TLS) and at rest by our hosting provider
• Access is restricted via role-based controls and row-level security
• User identifiers in admin and audit views are pseudonymized using a keyed HMAC so they cannot be reversed without an internal secret

7. DATA RETENTION

Personal data is retained while your account is active. When you request account deletion, your data is scheduled for removal after a 7-day cooling-off period and then deleted from every user-owned table the system can identify. A limited set of operational logs (e.g. authentication attempts, rate-limit counters, AI/audit trails) is auto-pruned on rolling windows of 7–180 days; billing and security records may be retained longer where required by law.

8. USER RIGHTS

Users have the right to:

• Access their data
• Correct inaccurate data
• Request deletion
• Object to processing
• Request data portability
• Withdraw consent for optional analytics or marketing technologies
• Contact a relevant data-protection authority where applicable

US residents in states with applicable privacy laws may also request to know categories of personal information collected, sources, purposes, recipients, and whether personal information is sold or shared for targeted advertising. KlirInvest does not sell personal information. Optional advertising or conversion pixels are disabled unless you accept the marketing category, and Global Privacy Control signals are treated as an opt-out from optional analytics, telemetry, and advertising pixels.

9. RECIPIENTS OF PERSONAL DATA

We name processors below where contractually required or where doing so is necessary for users to exercise their rights. Other recipients are described by category and transfer location, consistent with UK GDPR Art. 13(1)(e). International transfers to the USA / Canada rely on Standard Contractual Clauses (UK IDTA where applicable).

Account data and portfolio data are stored with Supabase Inc., our hosting provider. Payment details flow to Stripe Inc. Brokerage holdings and transactions are fetched read-only via SnapTrade. Outbound transactional and notification emails are delivered through the managed email infrastructure of our cloud platform (Supabase / Lovable Cloud) from our verified sender domain. Sign-in with Google is offered by Google LLC, which also provides Gemini AI access via the Lovable AI Gateway. Additional AI, market-data, and news providers are described by category below; their identities are available under NDA or on individual request.

Named sub-processors

Other recipient categories

Specific provider identities are available to enterprise customers under NDA via hello@klirinvest.com. Individual users can request the specific recipients of their personal data at any time at hello@klirinvest.com.

10. INTERNATIONAL TRANSFERS

KlirInvest is a UK company and uses processors in the UK, USA, Canada, and other locations listed above. Where UK GDPR, EU GDPR, or UAE PDPL transfer rules apply, cross-border transfers rely on adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum or IDTA, processor data-processing terms, or another lawful transfer mechanism available for the relevant transfer.

We review vendor privacy and security terms before use and keep a vendor register so users can understand where their data may be processed.

11. AUTOMATED ANALYTICS & PROFILING

KlirInvest generates automated portfolio analytics, risk scores, behavioral indicators, simulations, and AI-assisted explanations from user-provided and connected portfolio data. These outputs are educational decision-support information only.

KlirInvest does not make solely automated decisions that produce legal or similarly significant effects for users. We do not approve credit, execute trades, manage portfolios, or determine eligibility for regulated financial products.

12. COOKIES

Cookies and similar technologies are used for:

• Authentication
• Session management
• Security and bot protection
• Optional analytics, telemetry, and conversion measurement after category-specific consent

Optional tools, loaded only after you accept the matching category: KlirInvest first-party analytics, Google Analytics and PostHog (Analytics); the Meta (Facebook) Pixel, LinkedIn Insight Tag and X Pixel (Marketing); Sentry (Telemetry). Stripe sets payment-security cookies when you open checkout. Our hosting provider (Lovable) sets a deployment cookie (__dpl) and adds its own page-view analytics, which the consent banner does not control. The full list, with identifiers and retention, is in the Cookie Policy.

You can manage optional cookies through Cookie Settings, the cookie banner, browser controls, or a Global Privacy Control signal where supported. For signed-in users, KlirInvest keeps an append-only server-side consent evidence record showing the consent level, selected categories, policy version, source, and timestamp.

13. CHANGES

Updates to this policy will be communicated to users where required.

14. CONTACT

For privacy inquiries:

hello@klirinvest.com

For general support: hello@klirinvest.com