Privacy Policy

1. Introduction and Controller

This Privacy Policy describes how Acubic, Inc. ("we", "our", "us") collects, uses, and discloses personal data when you use the Acubic website and algorithmic portfolio builder (the "Platform"). Acubic, Inc. is a Delaware corporation, file number 10686560, with registered office at 16192 Coastal Highway, Lewes, DE 19958, United States, and is the controller of the personal data described here. For privacy questions, contact privacy@acubic.ai.

2. Information We Collect

We collect information you give us, information created when you use the Platform, and information from services you choose to connect.

• Account data: username, email address, a hash of your password (never the password itself), email-verification status, and, if you sign in with Google, your Google account identifier and the email address Google shares with us.
• Portfolio and quiz data: your answers to the portfolio questions, your experience level, and the strategies and portfolios you build or save, with their settings.
• Broker connection data: if you connect eToro or Trading 212, the access tokens or API keys you provide (encrypted at rest), your broker account identifier and username, snapshots of your positions and balances, the orders placed and their results, and your rebalance history.
• AI assistant content: the text you type into the AI assistant, which is sent to Anthropic to generate a response. We do not store these messages in your account.
• Marketing attribution: how you reached us, such as campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), ad click identifiers (Google's gclid and Reddit's rdt_cid), the referring website, your first landing page, and any partner or event link you arrived through.
• Referral and creator program data: if you arrive through a creator's referral link, a referral code and a random visitor identifier. If you join as a creator, your name, handle, email address, referral earnings, and the Stripe Connect account used to pay you (Stripe collects the identity and bank details for payouts directly).
• Support and research: the support tickets you send us and our replies. If you take part in a research interview, your replies, our interview notes, and quotes you agree we can keep.
• Email activity: which emails we sent you and whether they were delivered, bounced, opened, or clicked, plus your marketing email preferences.
• Security data: IP address, browser user agent, the IP address of your last login, login attempts, and an audit log of security-relevant account events.
• Billing data: your Stripe customer and subscription identifiers, plan, and payment status. Stripe processes your card; we never receive or store full card numbers.
• Cookie and consent data: your consent choices, policy versions, timestamp, region mode, and Global Privacy Control status. See our Cookie Policy.

3. Purposes and Legal Bases

We use personal data to:

• Operate, maintain, and provide the features of the Platform.
• Generate, save, monitor, and rebalance portfolios at your request, including sending orders to a broker you have connected.
• Communicate with you about your account, security, support, billing, and service updates, and, unless you opt out, about product news.
• Protect the Platform by monitoring for unauthorised access, abuse, and fraud.
• Administer subscriptions, quotas, referral rewards, and payments.
• Understand how the Platform is used and improve it, and measure which campaigns bring people to us, within your cookie choices.
• Invite some users to optional research interviews, based on how they use the Platform.
• Comply with legal obligations and enforce our Terms.

For GDPR and UK GDPR purposes, we rely on contract necessity to provide the Platform and administer your account, legitimate interests for security monitoring, service administration, product improvement, and research invitations, legal obligation where a law requires the processing, and your consent for non-essential cookies, analytics, and advertising measurement where consent is required. You can withdraw consent at any time through Cookie Settings without affecting processing already carried out.

4. Analytics, Advertising, and Your Choices

Analytics. We use PostHog (product analytics, including session replay with form inputs masked) and Google Analytics to understand how the Platform is used. In the EU/EEA, the UK, and where we cannot determine your region, they run only after you opt in. In the United States they run by default, and you can turn them off at any time in Cookie Settings.

Advertising measurement. We use advertising pixels from Reddit, OpenAI, and Google Ads, and our servers report certain conversions (for example, that an account was created or a subscription started) to Reddit, OpenAI, and Google. These run only when your choices allow advertising: in the EU/EEA, the UK, and where we cannot determine your region, only after you opt in; in the United States, unless you opt out of sale and sharing in Cookie Settings or your browser sends a Global Privacy Control signal. Server-side reports can include your email address and account ID in hashed form, the ad click identifier, your IP address, and your browser user agent.

We do not sell personal data for money. Under some US state privacy laws, however, sharing data with advertising platforms in this way may count as "selling" or "sharing" personal information for targeted advertising. You can opt out at any time through Cookie Settings in the footer, or by turning on Global Privacy Control in your browser.

5. Sharing and Processors

We share personal data with the service providers below, only as needed for the purpose shown. A broker receives data only after you connect it, and an analytics or advertising provider only within your cookie choices.

We may also disclose information when required by law, to protect rights and security, or in connection with a corporate transaction. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable, or on another lawful transfer mechanism. To ask about our processors, contact privacy@acubic.ai.

6. Retention and Security

• Account, portfolio, and attribution data is kept for as long as your account exists and is deleted when you delete your account (Profile → Delete account). This includes your strategies, broker connections, support tickets, and research interviews.
• Broker credentials are deleted when you disconnect the last portfolio that uses that broker account, or when you delete your account; for eToro we also ask eToro to revoke the authorisation. Disconnecting a portfolio deletes that connection's position snapshots and order history.
• Security logs: IP addresses and user agents in our security (audit) logs are kept with no fixed deletion date, to protect accounts and investigate misuse; when you delete your account they are unlinked from it but not erased. Our application logs can also contain IP addresses and email addresses (for example on sign-in) and have no fixed deletion date. Expired or used login, verification, and password-reset tokens are deleted 30 days after they expire or are used, and guest sessions 30 days after their last activity.
• Server access logs are kept for 30 days, with IP addresses shortened when they are written so they do not identify a single device.
• Records kept after account deletion: to evidence what happened, our audit log keeps a record of the deletion (including the account's username, and a one-way hash of its email address rather than the address itself), and our email log keeps the emails we sent (recipient address, subject, and delivery events). Usage statistics and research findings are kept with the link to your account removed. These records have no fixed deletion date; you can ask us to erase them where the law allows.
• Billing records are kept by us and by Stripe for as long as tax and accounting law requires.
• Optional deletion feedback: if you tell us why you are leaving when you delete your account, we keep your answer separately from your account, without your name, email address or account ID, remove personal details we can detect from your free-text comment, and delete the comment 24 months later.
• Analytics and advertising providers keep the data they receive under their own retention policies.

We use technical and organisational safeguards designed to protect personal data, including encryption of broker credentials at rest, HttpOnly refresh-token cookies, access controls, rate limiting, audit logs, and secure transport in production. No service can guarantee absolute security.

7. Your Rights

Depending on your region, you may have rights to access, delete, correct, port, restrict, object to, or withdraw consent for personal data processing. You may also have rights to opt out of sale, sharing, targeted advertising, certain profiling, and certain sensitive-data processing, plus a right not to be discriminated against for exercising privacy rights.

You can manage cookies and opt-outs through Cookie Settings in the footer. We honor Global Privacy Control as an opt-out of sale/sharing and targeted advertising for applicable US jurisdictions. You can delete your account yourself from your Profile. To submit any other privacy request, contact privacy@acubic.ai. If we decline your request, you may appeal by replying to our decision at the same address, and we will respond with the outcome and our reasons. Residents of the EEA and the UK may also lodge a complaint with their local supervisory authority.

8. Children, Automated Decisions, and Updates

The Platform is not intended for children under 18. The Platform provides algorithmic portfolio modeling outputs for informational and computational purposes, but does not make legally binding or similarly significant automated decisions about you. We will update this Policy when our practices materially change.

9. Contact Information

For questions concerning this privacy policy, please contact us at: