1. Information we collect

• Account: Your email address, and your name if you sign in with Google or GitHub. You can also sign in with an email link or a password we issue to you.
• API keys and connector sign-ins: When you create an API key or connect RiskModels to an AI client such as Claude, ChatGPT, Gemini or Cursor, we store the key or token only in hashed form, with a short prefix, its name, scopes and when it was last used. For connector sign-ins we also store the client name and registration details the client sends.
• Usage records: For each billed API or connector call we record your account, the endpoint, the cost, the time, the response status and speed, the request URL, your IP address and user agent, and the tickers named in the request (up to 50), with any dates and item counts. We do not record position weights, share counts or dollar values.
• Portfolios you submit: Holdings you send to the portfolio, hedge and decomposition endpoints are used to compute the response and are not stored in our database. Some responses are cached for up to 24 hours so repeated requests return the same result. Exposure-history files are kept in private storage, reachable only through a link that expires after one hour, and deleted daily.
• Saved portfolios and brokerage connections: Portfolios you save in your account are stored encrypted. If you link a brokerage account through Plaid, we store an encrypted Plaid access token and fetch holdings when you ask for them; we do not store the holdings or your brokerage login.
• Payments: Card payments are handled by Stripe. We keep the Stripe customer and payment method references, top-up amounts and your credit balance history. We never receive or store card numbers.
• Email: We send service emails (welcome, key issued or expiring, receipts, low balance, usage reports, digests). We log each email sent and whether it was opened or a link was clicked.
• Feedback: If you send feedback through the site or API, we store your comment with your IP address and user agent.
• Event Ledger and feed list: When you join the feed list at riskmodels.app/security-master-feed we store your email address and, only if you give them, a second delivery address (such as a team inbox), your name, firm, role, firm type, firm size band, intended uses, who will read the feed, and how you heard about it. We also store when you accepted the free edition terms and which version, whether you asked for marketing email, when you confirmed your address, the referral code in your copy of each edition, which referral link you signed up through (if any), whether you were invited personally and by whom, and the browser user agent and referring page at signup.
• Website analytics and advertising: Our website uses PostHog, Google Analytics, Google Tag Manager and Google Ads, which set cookies and record pages viewed and clicks. When you sign up, the Google Ads tag may send your email address, hashed by the tag, to Google to measure ad conversions. If you arrive from an ad or campaign link, we keep the click and campaign identifiers in your browser and store them with your account at sign-up.
• Chat assistant: Messages you send to the RiskModels chat assistant, and the data its tools return, are sent to an AI model provider (Anthropic or Moonshot AI) to generate the reply.

2. How we use it

• Provide the service: Authenticate you, run your requests and return results.
• Billing: Charge each call against your credit balance and keep receipts.
• Security and reliability: Rate-limit requests, detect abuse and diagnose errors.
• Support and service emails: Answer your questions and tell you about your account.
• Feed email: Send the Event Ledger editions and feed notices to confirmed addresses only. Each address confirms by clicking a link before it receives anything.
• Marketing email: Only if the signup you confirm ticked the separate marketing box; the confirmation email says whether it did. Unsubscribing from the feed turns it off too.
• Improve the product: Understand which endpoints and tickers are used, mostly in aggregate.
• Marketing measurement: Measure which campaigns bring sign-ups.

We do not sell your personal data, and we do not use your portfolios or requests to train AI models.

3. Who we share it with

Service providers that process data for us:

• Vercel: website and API hosting.
• Supabase: sign-in, database and private file storage.
• Upstash: rate limiting and short-lived caches.
• Stripe: payments.
• Resend: email delivery, including the Event Ledger editions and feed list emails, as our email processor.
• Plaid: brokerage connections, only if you link an account.
• PostHog and Google: website analytics and ad measurement; Google and GitHub also for sign-in if you choose them.
• Anthropic and Moonshot AI: the chat assistant only.

When you use RiskModels through an AI client (Claude, ChatGPT, Gemini, Cursor or another), the results we return go to that client and are handled under its provider’s privacy policy.

We may also disclose information when required by law or to protect our rights and users.

4. How long we keep it

• Account data: while your account is open.
• Usage and billing records: as long as needed for billing, accounting and tax records.
• Cached responses: up to 24 hours.
• Exposure-history files: deleted daily.
• Feed list: while you are on the list. When you unsubscribe we keep the address and the date, so the list cannot re-add you silently; ask us to delete the record and we will. A signup that is never confirmed receives nothing after the confirmation emails, and is kept until you or we delete it.
• Connector sign-ins: authorization codes expire after 5 minutes, access tokens after 1 hour, refresh tokens after 30 days or when you revoke them.

5. Your choices and rights

• Access, correction and deletion: Email service@riskmodels.app to get a copy of your data, correct it, or delete your account. We complete deletion within 30 days, except records we must keep for billing, tax or legal reasons.
• Keys and connectors: Revoke API keys in your account at any time. Removing RiskModels from an AI client stops its access; ask us if you also want its sign-in revoked on our side.
• Brokerage connections: Disconnect through your account or the Plaid Portal.
• Feed and marketing email: Every feed email has an unsubscribe link, which stops all feed email to that address and turns off marketing email for it too. To stop marketing email only, or to delete your feed list record and profile entirely, email service@riskmodels.app; we complete deletion within 30 days.
• Cookies: Visitors in the EEA, UK and Switzerland choose whether to allow analytics and advertising cookies in a banner; until they accept, those tags run without cookies. Anyone can block or delete cookies in their browser settings; the API and connector do not need them.

6. Security

Data travels over TLS and is encrypted at rest by our hosting providers. API keys and connector tokens are stored only as hashes. Plaid access tokens are encrypted with AES-256-GCM. Access to production systems is limited to the people who run the service.

7. Other

RiskModels is a professional analytics service and is not directed to children under 18.

If we change this policy we will update the date at the top, and we will email account holders about material changes.