Privacy Policy

Last Updated: October 25, 2026 Effective Date: October 7, 2026

Autonomous Intelligent Agents LLC ("AIA", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with the website at https://financial-portfolios.ai, the REST API and WebSocket streams, the Model Context Protocol ("MCP") server and connector, any application we distribute, and all associated services (the "Service"), and describes the rights available to you under applicable privacy laws.

Subscriptions are offered only to residents of the United States who are 18 or older; the public parts of the Service can be viewed from elsewhere (see Section 1 of the Terms of Service). This Policy is written to U.S. federal and state privacy law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA/CPRA"), and the comprehensive privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Tennessee, Maryland, Indiana, Kentucky, and Rhode Island, as each is in effect. If you visit the Service from outside the United States, Section 9.4 describes the legal bases on which we process your personal information and the rights you may have under the data-protection law that applies to you (for example the EU or UK General Data Protection Regulation).

By using the Service you acknowledge this Privacy Policy. If you do not agree, do not use the Service.

1. Who We Are

The "business" (CCPA/CPRA) / controller for your personal information is Autonomous Intelligent Agents LLC, a Texas limited liability company operating from the United States.

• Privacy contact: privacy@financial-portfolios.ai
• Data-subject requests and appeals: dsr@financial-portfolios.ai

We operate entirely online and have a direct relationship with our users, so we accept privacy requests by email and in the portal under Settings → Your data & privacy. Our registered postal address is available on request from privacy@financial-portfolios.ai.

2. Categories of Personal Information We Collect

2.1 Information You Provide

• Identity and account data: name, email address, profile photo, and the identity-provider subject identifier returned by your sign-in provider (Google; Apple where that sign-in option is offered). Category: Identifiers.
• Authentication data: where multi-factor authentication is offered and you enable it, a phone number and/or authenticator-app secret, and one-time codes. Category: Identifiers.
• Eligibility confirmations: when you confirm that you are a resident of the United States and 18 or older, the time you confirmed, the version of the wording you confirmed, and the IP address from which you confirmed it. When you try to subscribe we also check the country of your billing address and the country your connection appears to come from (derived from your IP address; country only, not precise geolocation), so that we can refuse, or cancel and refund, a purchase the Terms of Service do not permit. Category: Identifiers.
• Billing and transaction data: billing address, the payment-method brand and last four digits, subscription plan, renewal date, and invoice history. Category: Commercial Information / Financial Information. Full card numbers and security codes are never stored on AIA systems; they are handled exclusively by our PCI-DSS-compliant payment processor.
• Communications: support messages, feedback, and survey responses. Category: Identifiers and Internet Activity.
• Preferences and settings: notification settings, dashboard layout, bookmarks, watchlists, theme, language, and cookie preferences.
• Push-notification subscriptions: if you turn on browser notifications, the push-service address and encryption keys your browser gives us so that we can deliver them. They are deleted when you turn notifications off, when the push service tells us they are no longer valid, or when your account is deleted.
• Files you upload: where you use a self-directed calculator, the holdings file you upload and the capital figure you enter. See Section 2.5.
• Holdings you submit through an AI assistant: where you or an AI assistant acting for you use the model-alignment calculator through the MCP connector, the holdings (tickers, quantities, and any prices or values) submitted to it. See Section 2.5.
• Personal Access Tokens (PATs) and API usage: we store a one-way hash of each PAT you generate together with its label, scopes, creation and last-used timestamps, and the requesting IP address; we log API and WebSocket calls — the time, the endpoint and method, the portfolio requested, the response status, how long the call took, and which token (identified by its prefix) or connected AI assistant made it — for security, rate-limiting, abuse detection, support, and billing. For calls made through the MCP connector we also record which tool was used, the portfolio involved, whether the call succeeded, and how long it took, so we can support the connector and see which tools are used. We never receive what you type to your AI assistant — only the requests it sends to our API — and we do not store the contents of those requests. The PAT's plaintext value is shown to you once, at creation, and is never retrievable thereafter — AIA cannot recover a lost PAT.

We do not ask for, and do not want, your investment objectives, risk tolerance, time horizon, income, net worth, or tax position. We do not profile you for investment purposes, and we do not vary the content we publish to you based on any characteristic of yours. This is deliberate: AIA is a publisher, not an adviser (see the Legal Disclaimer).

• AI-assistant connections (OAuth): when you connect an AI assistant (for example Claude, ChatGPT, or Gemini) to the Service through our MCP connector, our OAuth 2.1 authorisation server stores (a) the client record the assistant registers with us — a client identifier, the client name it supplies, its redirect addresses, and the scopes it requested; (b) a short-lived, single-use authorisation code, stored only as a one-way hash and linked to your account, the client, and the scopes you approved; and (c) refresh tokens, stored only as one-way hashes together with your account identifier, the client identifier, the granted scopes, an expiry time, and whether the token has been revoked. Access tokens issued to the assistant are short-lived and are not stored in our database. Calls the assistant makes are logged like other API calls (see the previous item). See Section 2.6.

2.2 Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, time zone, language, screen resolution. Category: Identifiers / Internet or Other Electronic Network Activity Information.
• Usage data: pages visited, time spent on each page, features used, clicks, scroll depth, search terms, referrer URL, session timestamps, error logs, and performance traces. Product analytics are collected first-party, by our own servers, and only if you allow Analytics in the cookie banner. If you are signed in, this usage — including the pages you visit and how long you spend on them — is linked to your account and can be viewed by our authorised staff so that they can support you and improve the Service. We never record what you type into forms, and we strip query strings and page fragments from the addresses we record. Analytics sessions also record the IP address and browser user agent from which they began. We do not embed third-party advertising or cross-site tracking technology (see the Cookie Policy).
• Cookie-consent records: your choice, the version of the Cookie Policy it was made under, where it was made (the banner, the preference centre, or a Global Privacy Control signal), the time, and the IP address and browser user agent from which it was made. Before you sign in the record is keyed to a random visitor identifier; when you sign in it is linked to your account. Category: Identifiers.
• Request logs: like any website, our hosting infrastructure records the IP address, browser user agent, requested address, and time of each request, for security and operations. Category: Identifiers / Internet or Other Electronic Network Activity Information.
• Cookies and similar technologies: see our separate Cookie Policy.

2.3 Information from Third Parties

• Identity providers: Google (and Apple, where that sign-in option is offered) returns your verified email address and, where you permit it, your name and profile picture.
• Payment processor: Stripe returns a tokenized reference to the payment method, the card brand and last four digits, the billing name and address you enter on Stripe's checkout page, and the transaction status, including for wallet methods such as Apple Pay and Google Pay.
• Market-data providers: we receive market and reference data that is not, by itself, personal information.
• Anti-fraud and anti-abuse signals: where used, IP-reputation and bot-detection signals.

2.4 Sensitive Personal Information

Other than the credentials that give access to your account (for example the one-way hash of a Personal Access Token, or an MFA secret), which we use only to authenticate you, we do not intentionally collect sensitive personal information as defined under the CPRA and analogous state laws (for example precise geolocation, racial or ethnic origin, religious beliefs, health data, biometric data, genetic data, union membership, or the contents of mail or messages). We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not sell or share it.

We do not knowingly collect information from individuals under 18, and the Service is not directed to children.

2.5 Files You Upload to a Calculator

If you use a self-directed calculator, the holdings file you upload and the capital figure you enter are processed solely to compute and return your result. Specifically:

• the file is processed to produce your output and is not used to train or fine-tune any model;
• it is not used to shape, personalize, or vary the content we publish to you or to anyone else;
• it is not reviewed by AIA staff except where you ask us to investigate a support issue, or where we must access it to investigate a security incident or comply with law; and
• upload contents are retained only as long as needed to return your result and to keep short-lived operational logs, after which they are deleted (see Section 7).

Holdings submitted through the MCP connector. The same applies when an AI assistant submits your holdings to the rebalance_portfolio tool. The MCP server passes the holdings to our API, which processes them in memory to compute the result and does not write them to our database. Our application logs record information about the request — for example its size, the column headers, the number of rows, and any error — but are not designed to record the holdings rows themselves. The result is returned to the AI assistant that called the tool, and from there is handled by that assistant's provider (see Section 2.6).

2.6 AI Assistants You Connect

You choose which AI assistant, if any, to connect to the Service, and you approve each connection on our consent screen. When the assistant retrieves data through the MCP connector — portfolio content, research, or the result of a calculation on holdings you supplied — that data is disclosed at your direction to the assistant provider you chose, and its further handling is governed by that provider's own terms and privacy policy, not by this Policy. AIA does not control what the provider does with it, and the provider does not act as AIA's service provider or processor for that data.

This is different from Section 5, which covers AIA's own use of a third-party language model to draft published commentary.

You can end a connection at any time by disconnecting the assistant in its settings. You can also ask us to revoke the connection on our side by emailing privacy@financial-portfolios.ai; revoked and expired refresh tokens can no longer be used to obtain access. Refresh tokens expire automatically (currently 30 days after issue, and each is replaced when used) and authorisation codes expire within minutes.

2.7 What You Must Provide

Your email address and sign-in identity are needed to create an account, and payment and billing-address details (entered on our payment processor's page) are needed to buy a subscription. Everything else is optional: if you do not provide it, only the related feature is unavailable.

2.8 Google Sign-In and Google User Data

If you sign in with Google, we request only the openid, email and profile scopes. From your Google Account we receive your email address and whether Google has verified it, your name and profile picture where you allow it, and a Google account identifier. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service, and we never receive your Google password.

We use this Google user data only to:

• create your account and sign you in, and recognise you on later visits;
• link your account to your subscription and billing record, so the portfolios you buy are unlocked for you;
• show your name and picture inside your account, and send you service and billing messages at that email address.

We do not sell Google user data, use it for advertising or to build advertising profiles, use it to train or improve artificial-intelligence or machine-learning models, or let people read it except where you ask us to (for example in a support request), where it is needed for security or abuse investigation, or where the law requires. We share it only with the service providers that host and operate the Service for us (Section 6) and only to run the Service.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is kept with your account and erased when you delete it (Section 7). You can delete your account at any time in Settings, or ask us to at dsr@financial-portfolios.ai. You can also remove our access in your Google Account at myaccount.google.com/permissions; you will then need to sign in again to use the Service.

3. Sources of Personal Information

We collect personal information (a) directly from you, (b) automatically as you interact with the Service, and (c) from the third parties listed in Section 2.3.

4. Purposes for Which We Use Personal Information

We use personal information to:

• create and authenticate your account and deliver the Service;
• process payments and manage subscriptions, including keeping records of your consent to automatic-renewal terms;
• send transactional and service-critical email, push notifications, and authentication messages;
• provide customer support;
• operate, monitor, secure, and improve the Service, enforce rate limits, and detect fraud and abuse;
• measure product usage and prioritize features (analytics, subject to your cookie choices);
• market our own products, subject to your right to opt out at any time;
• comply with tax, accounting, audit, and other legal obligations; and
• enforce our Terms and establish, exercise, or defend legal claims.

We do not use personal information to train or fine-tune AQA or any other machine-learning model that generates portfolios or signals. Those models are trained on market and macroeconomic data only.

5. Generative AI Features

This Section describes AIA's own use of generative AI. It does not cover AI assistants that you connect to the Service, which are described in Section 2.6.

Some published commentary and portfolio reports are drafted or summarized using a third-party large language model operated by Google (the Gemini API). The input to that model is our own portfolio and market data only. Your personal information, your account data, and any file you upload are never sent to that model.

AI-generated commentary can be inaccurate. See §8 of the Legal Disclaimer.

6. Disclosures of Personal Information

In the preceding twelve (12) months we have disclosed personal information to the following categories of recipients for a business purpose:

• Cloud infrastructure and storage providers (Google Cloud Platform, United States region) — hosting, database, storage, logging, backup, and network security;
• Identity providers (Google; Apple where that sign-in option is offered) — authentication;
• Payment processor (Stripe) — payments, invoicing, tax calculation, fraud prevention, and billing and payment emails (for example receipts, renewal reminders, and failed-payment notices);
• Push-notification delivery (the push service operated by your browser or operating-system vendor, using the Web Push protocol) — notification delivery, if you turn notifications on;
• Web-font delivery (Google Fonts) — our pages load their typefaces from Google's servers, so Google receives your IP address and browser details when a page loads; no cookies are set for this;
• Generative-AI provider (Google, for the Gemini API) — drafting published commentary, on our own market data only, as described in Section 5; no personal information is sent;
• Video platform (YouTube/Google) — where you play an embedded video, or open our channel page, whose video details and thumbnails your browser loads from Google;
• Professional advisers (auditors, lawyers, tax advisers) — under confidentiality;
• AI-assistant providers you choose (for example Anthropic, OpenAI, or Google, when you connect Claude, ChatGPT, or Gemini) — data your assistant retrieves through the MCP connector, disclosed at your direction as described in Section 2.6;
• Government authorities — where required by law, valid legal process, or to protect vital interests.

We do not currently use a separate email-delivery or SMS provider. If we start to (for example for service email or text-message sign-in codes), we will add it to this list before it receives any personal information.

We do not "sell" personal information for monetary or other valuable consideration within the meaning of the CCPA/CPRA and analogous state laws. In the preceding twelve months, we have not sold personal information of any consumer, including any consumer under 16, and we have not shared personal information for cross-context behavioral advertising. We do not conduct targeted advertising, and we do not profile you in furtherance of decisions producing legal or similarly significant effects.

We may disclose personal information in connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets. The acquirer shall be bound by privacy commitments no less protective than those in this Policy at the time of transfer.

6.1 Summary for California Residents

This table summarises, for the preceding twelve months, the categories of personal information (as the CCPA/CPRA defines them) that we collect, where they come from, and to whom we disclose them for a business purpose. We have not sold or shared any of them. Retention periods are in Section 7.

We do not collect precise geolocation, biometric, health, or protected-classification information, and we do not draw inferences about you to create a profile.

7. Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to satisfy legal, tax, accounting, and regulatory obligations. Indicative periods:

| Product analytics (only if you allow Analytics) | 13 months | | Files uploaded to a calculator | Deleted after your result is returned; residual copies purged with operational logs within 30 days | | Holdings submitted through the MCP connector | Not written to our database; processed in memory to return your result | | OAuth client records (AI-assistant connections) | Until no longer needed to support connections, or on request | | OAuth authorisation codes | Expire within minutes of issue; expired codes are deleted | | OAuth refresh tokens (stored as hashes) | Expire 30 days after issue; revoked and expired records are kept with your account for security and audit, and deleted with your account | | Support tickets | 24 months after closure | | Cookie-consent records | 24 months from the consent event | | Database backups | Daily backups kept for 14 days, plus 7 days of point-in-time recovery logs; deleted data leaves the backups as they roll off |

When retention expires, personal information is deleted or irreversibly anonymized.

8. Where Your Information Is Processed

AIA operates in the United States. Personal information is stored and processed in the United States (our hosting runs in Google Cloud's us-central1 region) by AIA and by the service providers listed in Section 6. Some of those providers may process limited data in other countries as part of their global infrastructure; where they do, they are bound by contractual data-protection obligations.

International transfers. If you visit the Service from outside the United States, the personal information we collect from that visit (for example the technical data in Section 2 and any account or contact details you give us) is transferred to, and processed in, the United States, which may not provide the same level of data protection as your country. Where the law that applies to you requires a transfer safeguard, we use an appropriate mechanism — such as the Standard Contractual Clauses approved by the European Commission (and the UK Addendum or equivalent instruments), or an adequacy decision or certification framework where available to the recipient — and we require our service providers to do the same. Some transfers are also necessary to provide what you ask for, for example to answer your enquiry or operate an account you create. You may request information about the safeguards we use by emailing privacy@financial-portfolios.ai.

9. Your Rights

Subject to applicable law and to your state of residence, you have the following rights. If you are outside the United States, see also Section 9.4. To exercise any of them, email dsr@financial-portfolios.ai, or use Settings → Your data & privacy in the portal, where you can download your profile, subscriptions, notification preferences, and cookie-consent history as a JSON file, deactivate your account, or request its permanent deletion. For anything the download does not include (for example analytics or API-usage records linked to your account), email us. Deactivating hides your account but does not delete it.

• Right to know / access — what personal information we hold, the categories of sources and recipients, and the purposes for which we use it. Under the CCPA/CPRA you may request information covering a period longer than the preceding 12 months where it is not disproportionately difficult for us to provide.
• Right to correct inaccurate personal information.
• Right to delete your personal information, subject to lawful exceptions.
• Right to portability — receive your data in a structured, commonly used, machine-readable format (for example JSON or CSV).
• Right to opt out of sale, sharing, and targeted advertising, and of profiling in furtherance of significant decisions. We do none of these.
• Right to limit use of sensitive personal information — we do not process sensitive personal information to infer characteristics.
• Right to opt out of marketing at any time, through the unsubscribe link in any marketing email or by emailing us.
• Right to non-discrimination for exercising your rights. Exercising a privacy right will never change the price you pay, the content you receive, or the features available to you.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Withdrawing is as easy as giving consent.
• Right to appeal a denied request — see Section 9.3.
• Right to complain to your state attorney general — we would, however, appreciate the opportunity to address your concern first.

We respond to verifiable requests within 45 days, extendable once by a further 45 days where reasonably necessary and permitted, in which case we will tell you before the first period expires. To verify you, we may require confirmation of account ownership or two pieces of matching information. Authorized agents may submit requests on your behalf with written authorization.

9.1 Opt-Out Preference Signals

We honor Global Privacy Control (GPC) browser signals as a valid opt-out of sale, sharing, and targeted advertising. Because we do not sell, share, or target advertising, a GPC signal does not change how we process your data, but it is recorded and respected.

9.2 "Do Not Sell or Share My Personal Information"

Because we do not sell or share personal information, no separate opt-out link is required. Should this ever change, we will update this Policy, provide the required link before the change takes effect, and obtain consent where the law requires it.

9.3 Appeals

If we decline your request in whole or in part, our response will explain why and will tell you how to appeal. To appeal, reply to our decision or email dsr@financial-portfolios.ai with the subject line "Privacy Appeal". We will respond to an appeal within 45 days with a written explanation of the decision. If your appeal is denied, we will provide a method to contact your state Attorney General to submit a complaint. This appeal right is offered to all users, and is required for residents of Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Delaware, and other states with equivalent provisions.

9.4 Visitors Outside the United States

Subscriptions are offered only to residents of the United States. If you visit the Service from outside the United States, the data-protection law of your country (for example the EU or UK General Data Protection Regulation) may nonetheless apply to our processing of your personal information, and this Section describes how.

Legal bases. Where such a law requires a legal basis for processing, we rely on:

• performance of a contract — to create and operate an account you register, provide the features you request (including calculator results), refuse or reverse a purchase that the Terms do not permit, and provide support;
• legitimate interests — to secure the Service, prevent fraud and abuse, enforce rate limits, understand and improve the Service, and establish or defend legal claims, where those interests are not overridden by your rights;
• consent — for non-essential cookies and analytics, marketing where the law requires consent, and connecting an AI assistant, which you may withdraw at any time; and
• legal obligation — to keep tax and accounting records and to respond to lawful requests from authorities.

Your rights. Subject to the conditions and exceptions in the applicable law, you may have the right to access your personal information; to rectification of inaccurate information; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests or used for direct marketing; to withdraw consent at any time; and to lodge a complaint with a supervisory authority in the country where you live or work, or where an alleged infringement took place. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

How to exercise them. Email dsr@financial-portfolios.ai, or use Settings → Your data & privacy in the portal. For general questions, contact privacy@financial-portfolios.ai. We will verify your request as described in Section 9 and respond within the period the applicable law requires; where that law sets a shorter period than 45 days, we will meet the shorter period. If we decline your request, you may appeal as described in Section 9.3 and, in any event, complain to your supervisory authority.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal information. Our programme includes:

• TLS encryption in transit and encryption of data at rest;
• application-level field encryption for sensitive stored attributes;
• least-privilege access control and support for multi-factor authentication, including on administrative accounts;
• secret-manager-backed credential storage, with no plaintext secrets in source control;
• one-way hashing of Personal Access Tokens, OAuth authorisation codes, and OAuth refresh tokens, so that token values cannot be recovered from our systems;
• dependency and vulnerability monitoring, with patching on a risk-prioritized basis; and
• vendor due diligence and contractual data-protection obligations.

No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you and the relevant regulator as required by applicable breach-notification law. To report a suspected vulnerability or account compromise, contact security@financial-portfolios.ai; we operate a coordinated-disclosure process.

11. Children's Privacy

The Service is intended for adults. We do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact privacy@financial-portfolios.ai and we will delete it.

12. Third-Party Links and Embedded Content

The Service may link to, or embed content from, third-party websites and services, including YouTube. Embedded content may allow the host platform to collect data about you as if you had visited it directly. AIA is not responsible for third-party privacy practices. Please review those third parties' policies before providing personal information.

13. California "Shine the Light"

California Civil Code §1798.83 permits California residents to request information about our disclosures of personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their direct marketing.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice at least 30 days before they take effect, and where a change requires your consent we will obtain it before applying it. The "Last Updated" date at the top of this Policy indicates the latest revision.

15. Contact

• Privacy questions: privacy@financial-portfolios.ai
• Data-subject rights and appeals: dsr@financial-portfolios.ai
• Security incidents: security@financial-portfolios.ai

Related Documents

• Terms of Service
• Cookie Policy
• Legal Disclaimer
• About Us
• Contact Us