Privacy Policy

1. Data Controller

The FinAI platform is operated by Talivio Technology OÜ (Estonian Commercial Register no. 16991406; address: Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia; the "Company", "we"). The Company processes the personal data described below as a data controller under the EU General Data Protection Regulation (GDPR).

2. Personal Data We Process

• Identity and contact data: full name and email address.
• Account data: your password (stored only as an irreversible hash), risk profile answers and subscription plan.
• Portfolio and transaction data: the assets, quantities, prices and cash movements that you enter manually. We never ask for or process your bank or broker password.
• Usage data: the questions you enter in the FinAI Robot (chat) and Report features, backtest parameters, and a hashed form of your IP address (used to enforce the daily usage limit for guest users).
• Payment data: when you move to a paid plan, payment is taken through our payment service provider, Stripe. Your card number is not stored in the Company's systems; we keep only your subscription plan, payment status and Stripe customer reference.
• Technical data: session cookies and browser/access logs (for security and abuse detection).

3. Purposes of Processing and Legal Basis

We process your data to create and manage your account, to provide the platform's features (backtesting, signal feed, portfolio analysis, AI chat and reports), to collect subscription fees, to keep the service secure and prevent abuse, and to comply with legal obligations. Under Article 6(1) GDPR we rely on the following legal bases: performance of a contract (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)) and our legitimate interest in running the service securely and reliably (Article 6(1)(f)).

This text is an information notice: its purpose is to tell you how your personal data is processed. If any processing activity requires your explicit consent, we will ask for it through a clear, optional opt-in step, and you may withdraw any consent you have given at any time.

4. Sharing with Third Parties and Transfers Abroad

We do not sell your data and we do not share it with third parties for advertising or marketing. To deliver the service, data is shared with recipients in two groups: processors, who act on our behalf and on our instructions, and independent controllers, who act on their own account.

Processors (acting on our behalf)

• Talivio AI gateway and model providers (purpose: generating AI answers and reports): when you use the FinAI Robot (chat) or Report features, the text of your question — together with the related product or asset context where there is one, but without your portfolio data — is sent to Talivio's own AI gateway (ai-gateway.talivio.com, hosted in the EU) to generate an AI answer. The gateway forwards the request to a model provider that it selects according to the quality tier; today these providers are DeepInfra (US), Scaleway (France, EU), OpenRouter (US) and the Google Gemini API (Google LLC, US), and they act as processors. The gateway does not store prompt or response content; it keeps only metadata such as tokens, cost and latency. No information that identifies you (name, email, IP address) is sent; for usage metering only an irreversible pseudonymous identifier is sent. Transfers to providers in the US rely on the provider's certification under the EU-US Data Privacy Framework (DPF) and/or the EU Standard Contractual Clauses (SCC). If the AI gateway is not configured or is unreachable, these features run entirely locally and deterministically, and no data leaves our systems.
• Hosting and email infrastructure (within the EU): service providers that store and transmit data on our behalf and on our instructions (as processors). We host our own infrastructure within the European Union and we do not transfer your personal data outside the EEA (European Economic Area) ourselves; only the non-EU processors described above (for example, the model providers in the US) may process data in the US, under the safeguards stated.

Independent controllers (acting on their own account)

• Stripe (Stripe, Inc. / Stripe Payments Europe; US/Ireland; purpose: payment processing): processes payments for paid subscriptions. For the data needed to process a payment, Stripe is an independent controller subject to its own privacy policy (it is not our processor). No controller-to-processor agreement is signed with Stripe for this payment flow.
• Competent authorities: only to the extent required to comply with a legal obligation.

Of the recipients above, the model providers in the US and Stripe may process data outside the European Economic Area (in the US); these transfers take place under the safeguards described in Section 3 (the EU-US Data Privacy Framework and/or Standard Contractual Clauses).

5. Retention

We keep your account and profile data for as long as your account is active. When you ask us to delete your account, your data is deleted or anonymised within 90 days, with these exceptions: invoice and payment records are kept for the statutory retention period under accounting and tax law; access logs kept for security purposes are kept for up to 12 months; and records that may serve as evidence in a legal dispute are kept for the applicable limitation period.

6. Your Rights

Under the GDPR you have the following rights as a data subject:

• To find out whether your personal data is being processed,
• To request information about the processing, and to access your data,
• To learn the purpose of the processing and whether it is used in line with that purpose,
• To know the third parties to whom your data is transferred,
• To ask for correction if your data is incomplete or inaccurate,
• To ask for your data to be erased or destroyed,
• To ask for restriction of processing and for data portability,
• To object to the processing.

To exercise these rights, you can contact us at [email protected]. You also have the right to lodge a complaint with a supervisory authority — for us this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); your right to apply to the competent authority in your own country is also reserved.

7. Cookies

The platform uses only first-party cookies that are strictly necessary for the service to work: the session cookie (session ID), the CSRF protection cookie and — if you choose "Remember me" at sign-in — a persistent remember-me cookie. We currently use no third-party cookies or pixels for advertising, tracking or analytics; if that changes, we will add a cookie notice that asks for your explicit consent.

8. Data Security

Passwords are stored using a one-way hashing algorithm; database access and application traffic are restricted to authorised personnel and to encrypted connections (HTTPS). Signal records are protected by a hash chain that detects tampering.