Privacy Policy

InvestoAI Corp · Effective October 12, 2026

InvestoAI Corp ("InvestoAI", "we", "us") operates investoai.com and the InvestoAI service. This policy explains what we collect, why, and the choices you have. It is written to be read, not skimmed; if anything is unclear, write to investoai@investoai.com.

1. What we collect

• Account information. Name, email address, password (stored hashed), and the settings you choose: daily amount, the ETFs you select, the stocks you follow, notification preferences.
• Brokerage connection. When you connect a brokerage (Charles Schwab today; Interactive Brokers when available), the brokerage gives us an access token through its official API after you sign in on the brokerage's own site. We never see or store your brokerage password. We use the token only to read the account you authorised and to place the orders your rule calls for. Tokens are stored encrypted and expire on the brokerage's schedule; Schwab's expire every seven days unless you re-authorise.
• Order and account data. Orders placed through InvestoAI, their status, and the balances and positions needed to run and explain your rule.
• Payment information. Subscriptions are processed by Stripe. We receive the last four digits of your card, its expiry and the billing status; the full card number never reaches our servers.
• Usage data. Pages viewed, features used, device and browser type, approximate location from your IP address, and the timestamps of sign-ins. We use first-party analytics and standard server logs.
• Messages you send us. Support emails, feedback and survey answers.

2. How we use it

• To run the service you signed up for: evaluate the rule each trading day, place and confirm orders, send the daily email and Telegram messages you asked for, and build your Morning Brief and Stock Insights.
• To bill you and to prevent fraud and abuse.
• To improve the product. We look at aggregate usage; we do not sell or rent personal information, and we do not use your brokerage data for advertising.
• To comply with law and respond to lawful requests.

3. Who we share it with

• Your brokerage, to place the orders you authorised.
• Service providers that run parts of the service under contract: cloud hosting (Amazon Web Services), payments (Stripe), email delivery, Telegram for notifications, and market-data vendors who receive only ticker symbols, never your identity or balances.
• Authorities, when required by law or to protect the rights and safety of users and the public.
• A successor, if InvestoAI is acquired or merges; you will be told before your data is governed by a different policy.

We do not sell personal information and have not done so.

4. Security

Data is encrypted in transit (TLS) and at rest. Brokerage tokens and API keys are stored in a secrets manager, not in application code. Access inside the company is limited to the people who need it to operate the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

5. Retention

We keep account and order records for as long as your account is open and for the period financial record-keeping rules require afterwards. Brokerage tokens are deleted when you disconnect the brokerage or close your account. You can ask us to delete your account at any time; we will do so except where we must keep records by law.

6. Your choices and rights

• Disconnect a brokerage at any time from your account page; orders stop immediately.
• Turn notifications on or off in your settings.
• Ask for a copy of your data, a correction, or deletion by writing to investoai@investoai.com. California residents have these rights under the CCPA; residents of the EEA and UK have them under the GDPR. We respond within 30 days and do not discriminate against you for exercising them.

7. Cookies

We use cookies to keep you signed in and to measure how the site is used. We do not use third-party advertising cookies. You can block cookies in your browser; sign-in will not work without the session cookie.

8. Children

The service is for adults. We do not knowingly collect information from anyone under 18.

9. Changes

If we change this policy in a way that matters, we will email you and post the new effective date here.

10. Contact

InvestoAI Corp · investoai@investoai.com