Privacy Policy
Last Updated: September 28, 2026
VestWealthy, Inc. (“VestWealthy,” “Company,” “we,” “us,” or “our”) publishes this policy to describe what personal data we collect, the purpose and legal basis for each processing activity, the categories of processor that receive it, and the rights you hold over it. It applies to the website, the APIs, and every other service we operate (collectively, the “Services”).
This policy, together with the Terms and Conditions, the Legal Statement & Financial Disclaimer and the Cookie Policy, is the complete set of documents governing our handling of your personal data. Where a summary elsewhere on this site — including any notice inside the Ask AI panel — differs from these pages, these pages are the ones that apply.
1. Information we do not collect
The categories below are absent by design. We state them explicitly so that their absence is verifiable rather than assumed.
- No analytics, session recording, or behavioral tracking. We operate no first-party analytics vendor, no tag manager, no session-recording tool, and no cross-site tracking pixel. We do not construct a behavioral profile of your browsing activity.
- No sale or rental of personal data. We do not sell your personal information and we do not disclose it for the benefit of another party. Section 5.2 describes the limited sense in which advertising partners may constitute a “sharing” under California law.
- No sensitive-category data. We do not request or process Social Security numbers, government identifiers, tax records, bank account numbers, brokerage account credentials, payment card details, or records of your investment holdings. Please do not enter any of these into any form, profile field, or AI prompt on the Services.
- No special-category data under GDPR Article 9. We do not seek, infer, or derive racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, or data concerning health, sex life, or sexual orientation.
2. Information we collect
2.1 Account and registration data
- Credentials. When you register with an email address and a password we store the email address and a cryptographically salted, one-way hash of the password produced by the bcrypt algorithm. We never store your password in a readable form and cannot recover it for you.
- Record of acceptance. When you accept these Terms we record the version of the document you accepted, the date and time of acceptance, and the IP address from which the acceptance was made. Marketing consent is recorded separately, because a bundled consent is not valid consent.
- Profile information. Details you choose to supply on your profile, which may include a display name, a contact phone number, and an avatar. The phone number is optional and is used for account and service communication.
- Account status records. Where an account is warned, suspended, or closed, we retain the reason for that action and the date on which it was taken.
Sign-in method. Email address and password is the method by which an account is created on the Services. The platform also supports federated sign-in through Google and Apple; where those providers are configured for this deployment, a button for each appears on the sign-up and sign-in screens, and a button is present only where the provider is actually available. If you chose a federated method, the account is created from the profile assertion that provider returns, and we store the email address it asserts. Your acceptance of these Terms is recorded in that flow as well.
2.2 Content you create
- Server-stored content. Your watchlist, saved articles, and internal messages are stored on our servers, are tied to your account, and are visible only to you.
- Community posts are not transmitted to us. A post you write in the Community Hub is written to your browser’s local storage on your own device. It is never uploaded to a VestWealthy server, is not backed up by us, and is not visible to anyone else unless they use the same device and browser profile. Clearing your browser data deletes these posts. This is why we cannot moderate them: we never receive them.
2.3 Generative AI submissions (“Ask VestWealthy AI”)
If you use the Ask AI panel, the following is transmitted to OpenRouter, our third-party model routing provider, which routes it to whichever third-party large language model (“LLM”) is available at the time of your request:
- the text of your prompt;
- up to six preceding turns of the same conversation;
- a snapshot of market data retrieved at the moment you asked.
OpenRouter and the downstream LLM provider may retain these prompts and may use them to improve or train their own models and products. Which provider serves a given question can change from one question to the next, and we cannot specify the model in advance. The panel states this beneath every conversation.
We do not store the content of your questions or of the answers returned to you on our own servers, and we do not use your prompts to train any model of ours.
Do not submit confidential or personal identifying information into an AI prompt, including account numbers, credentials, government identifiers, or your own portfolio positions.
2.4 Technical and log data
- IP address processing. We process the IP address of each request in order to operate the account, to enforce rate limits, to detect abuse, and to prevent fraudulent sign-in attempts. Two features depend on it directly.
- Daily AI usage counters. The Ask AI daily quota is enforced using a salted one-way SHA-256 hash of your IP address combined with the UTC calendar day. The raw address is not retained against that counter, the hash is not stored against your account, and the value cannot be reversed to recover an IP address.
- Infrastructure and CDN logs. Our hosting, database, and content delivery providers necessarily process the IP address and browser user-agent string of each request in order to deliver a page and to mitigate denial-of-service attacks.
3. Purpose and legal bases for processing
Where you reside in the European Economic Area, the United Kingdom, or Switzerland, we process personal data under the legal bases set out in Article 6(1) of the GDPR and Article 6(1) of the UK GDPR. The same processing is carried out for every user of the Services, so the basis column below applies to all of them.
| Category of data | Purpose of processing | Legal basis |
|---|---|---|
| Credentials and profile data | Creating and authenticating your account, operating your watchlist and saved content, and sending account and security notices. | Performance of a contract — Art. 6(1)(b) |
| Record of acceptance of these Terms | Maintaining an evidential record of the agreement you entered into, and demonstrating compliance with our regulatory obligations. | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Watchlist, saved content, messages | Delivering the personalized features you have registered for. | Performance of a contract — Art. 6(1)(b) |
| IP address and rate-limit counters | Preventing abuse of the Services, rate-limiting API endpoints, and securing the sign-in flow. | Legitimate interests — Art. 6(1)(f) |
| AI prompt inputs and conversation context | Generating a response to a question you have asked through the Ask AI panel. | Performance of a contract — Art. 6(1)(b) |
| Marketing communications | Sending optional product updates and market commentary, where you have opted in. | Consent — Art. 6(1)(a), withdrawable at any time |
Consent and your other rights. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you have the right to object to that processing; see section 9.
4. How we share your information
We disclose personal data only to the categories of processor listed below, each of which receives only what its function requires. We do not sell personal data to third parties for their own commercial use.
- OpenRouter and its downstream LLM providers — answer generation for the Ask AI panel, as described in section 2.3. OpenRouter selects the provider that serves a given question.
- Our hosting, database, and content delivery providers — account records, watchlists, saved content, and request logs, in order to operate and deliver the Services.
- Our email delivery provider — your email address and, where you have opted in, your name, in order to send transactional messages such as password resets and, separately, marketing communications.
- Google AdSense, where advertising is configured on this deployment — as described in section 5.
Market data providers receive no personal information from you. When a page requests a quote or an options chain, we transmit a ticker
5. Advertising and United States state privacy law
5.1 Advertising
Where advertising is configured on this deployment, advertisements are supplied programmatically by Google AdSense. Google and its advertising partners use cookies, device identifiers, and web beacons to serve and measure advertisements, and may personalise them based on your prior activity on this and other websites. That processing is governed by Google’s advertising policies, not by this policy, and we do not receive the resulting data.
Advertising placement has no effect on the market data, analysis, or model output published on this site. We do not accept compensation to feature a specific security or financial product, and no advertiser is given any input into what the site reports.
You may opt out of personalized advertising at Google Ads Settings or at AboutAds.info. Our own use of advertising cookies is described in the Cookie Policy.
5.2 California and other United States state law
We do not sell personal information for monetary or other valuable consideration. In the vocabulary of the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), allowing an advertising partner to collect identifiers for cross-context behavioral advertising may nonetheless constitute a “sharing” or “targeted advertising”. We therefore make the following disclosures.
- Categories collected. The categories of personal information described in section 2 are collected, and the purposes of collection are the purposes described in section 3.
- Retention. The periods described in section 7 apply.
- Right to opt out. You may opt out of the sharing of personal information for cross-context behavioral advertising in your browser, through the mechanism offered under Google Ads Settings , or by writing to legal@vestwealthy.com. We do not knowingly sell the personal information of anyone under 16 years of age.
- Non-discrimination. We do not deny you a Service, or provide it on different terms, on the basis of an exercise of a privacy right.
6. Data security
We maintain administrative, technical, and physical safeguards appropriate to the nature of the data. In summary:
- Passwords are stored only as salted, one-way bcrypt hashes and are never stored or transmitted in a readable form.
- Traffic between your browser and the Services is encrypted in transit using TLS.
- Session cookies are marked
HttpOnlyand are issued only over a secure origin in production, so page scripts cannot read them. - Access to personal data is limited to the administrators who require it for a stated operational purpose.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any competent authority to the extent required by applicable law.
7. Data retention and deletion
You can delete your account yourself. Sign in, open My Account, and choose Withdraw Membership. This takes effect immediately, is irreversible, and requires no request to us.
It removes:
- your account record and all active sign-in sessions;
- your watchlist, saved articles, and messages;
- community posts held in your browser on your device, which are deleted when you clear your browser data or withdraw membership;
- marketing consent, and the optional email it authorised, in the same action.
Two narrow categories of record survive deletion. They are named here rather than left for you to assume otherwise:
- Anonymised usage counters. The Ask AI daily usage counters described in section 2.4 are keyed to a salted one-way hash of an IP address and the UTC day, are not linked to your account, and cannot be reversed to identify an address. They expire by ageing out on a defined schedule rather than by being deleted.
- Administrative authorship records. An email address retained as the author of an announcement or a broadcast message, so that a published notice remains attributable after the account behind it is closed.
If you would like either category addressed as well, write to legal@vestwealthy.com.
Other correspondence. Messages you send to our support or legal addresses are retained only for as long as is needed to deal with the request and any resulting follow-up.
8. International transfers of personal data
Our hosting, database, and content delivery providers process personal data in the United States and in other countries. Where personal data is transferred outside the EEA or the United Kingdom, the transfer is made subject to the safeguards those providers publish, which include the European Commission’s Standard Contractual Clauses where applicable, and to any supplementary measures we put in place. The processors described in section 4 are located outside the EEA and the United Kingdom.
9. Your rights and choices
Subject to the law that applies to you, you may hold the following rights in relation to your personal data. Several of them you can exercise yourself, without contacting us.
- Access and rectification. To obtain a copy of the personal data we hold about you, or to correct it, edit your details on your profile, or write to us.
- Erasure. To have your personal data deleted, choose Withdraw Membership on your account screen, as described in section 7, or write to us.
- Portability. To receive a copy of the personal data you provided us in a structured, commonly used, machine-readable format, write to us.
- Restriction and objection. To restrict or object to a processing activity carried out on grounds of legitimate interests, write to us. We will respond substantively and, where the objection is valid, stop the processing.
- Withdraw consent. To withdraw consent for marketing communications at any time, without affecting the availability of the Services, write to us. Marketing was sent only because you ticked the optional box at sign-up, and that choice is separate from the acceptance of these Terms.
- Opt out of targeted advertising. As described in section 5.2.
- Complain. To lodge a complaint with your local data protection authority. We would prefer to hear from you first: write to us at the address below.
Account and moderation email cannot be switched off while the account exists. Those messages exist to tell you about changes to your own access, including a warning, a suspension, or a closure. The honest control for stopping all email is to remove the account, because email is sent on the basis of the account itself.
Local storage. Your theme choice, starred tickers, followed news sources, dismissed announcements, and community posts are held in your own browser. You can clear them at any time without contacting us, by clearing site data in your browser.
10. Children
The Services are intended only for users who are at least eighteen (18) years of age and are not directed to anyone under 18. We do not knowingly collect personal information from children, and the age confirmation at sign-up is a declaration you make rather than an age verification. If you believe a child has provided us with personal information, write to legal@vestwealthy.com and we will delete it.
11. Changes to this policy
We will update this policy when our data practices change, our legal obligations change, or a processor changes, and will revise the date at the top of this page. A change that materially affects how we use personal information you have already provided will be announced in the app before it takes effect. Continued use of the Services after that date means the updated policy applies to you from that date.
Contact us
Privacy questions, access requests, rectification requests, deletion requests, objections, and complaints all go to legal@vestwealthy.com. Please include the email address on your account so that we can locate you, and state which right you are exercising. We will respond within the period required by the law that applies to you, and we will tell you if we need to verify your identity before we can act.
Legal & Privacy Notices: legal@vestwealthy.com
General Support: support@vestwealthy.com