Privacy

Who is responsible

Subsidiary legal operator: Financial Markets Lab. Contact: Privacy contact not yet provided.

IndexGlobal.ai operates in Canada as a subsidiary of IP Factory Holding Corp.. The parent relationship does not identify the parent as the legal operator or the organization responsible for personal information. Operating province: British Columbia. Corporation number: Subsidiary corporation number not yet provided. Address: Postal address not yet provided.

What we collect directly

If you create an account, we store the email address and password you register with (the password is held by the sign-in service, not readable by us), plus what you choose to save in the app: watchlists, research notes, saved scenario assumptions and preferences such as display name, default company and chart style. These are private to your account. Signed-in privacy review requests store the request type, details, server time, retry binding and append-only review responses. Founder reviewers can read these requests, not download all customer records. The site has no payments or newsletter.

If you save a portfolio snapshot, we store — private to your account — the portfolio name you chose, the snapshot's as-of date, and each row's holding or cash details: the selected listing (symbol and market venue), quantity, cash amount or value you entered, currency, account nickname, and the original CSV cells and column mapping the row came from. The CSV file itself is read in your browser and never uploaded. Saved snapshots are kept as immutable versions; a retention or deletion policy has not been confirmed yet, so nothing is deleted automatically.

Listing directory searches are sent to our server and require sign-in. Filters of already loaded saved reports run in your browser. The ATORA panel currently shows connection status and a link to stock research. It does not collect a question or submit company context to ATORA. Opening stock research carries only the selected listing; optional AI generation there requires your consent.

Explicitly saved investor profiles retain structured questionnaire answers, including entered capital, withdrawals and contributions in USD or CAD, broad financial-context bands, goals, residency context, preferences, derived clarification issues and a rules version. These are private immutable versions linked to your account, not sent to ATORA or used for personalized recommendations. No bank identifiers, exact income, broker credentials or tax IDs are requested. Unsaved drafts stay in memory only; retention and deletion policy for saved versions remain undetermined, with no automatic deletion.

Explicitly saved stock-research reports retain your named thesis, supporting interpretation, counterarguments, invalidation conditions, assumptions and selected assessment status, with dated directory identity, public citation links and permitted SEC numerical facts and their filing/cache provenance. Optional saved AI analysis retains the exact generated output, evidence snapshot, model and calculation/schema versions. Versions are private and immutable; exports contain the exact saved version, not refreshed licensed prices or private evidence. Unsaved manual drafts remain in memory. Retention/deletion policy for saved versions is pending; no automatic deletion.

With your consent, AI research sends your question and permitted public SEC company facts to Lovable AI Gateway. Profiles, portfolios and private reports are excluded. The feature does not store question text; hosting and provider log retention remains unverified. Generated output and evidence are temporarily retained on our server with 30-minute save eligibility and at most five active drafts per account. Discard and successful save remove temporary drafts; expired drafts are removed when new drafts are created, so expiry alone does not guarantee immediate physical deletion. Explicit saves retain immutable output. Quota records retain identifiers, token counts and status, not question or evidence bodies.

What happens when you visit

• Hosting: the site is hosted on Lovable's platform. Like any web host, it receives your IP address, browser details and the pages you request in order to serve them, and may keep request logs. Log retention hasn't been confirmed yet.
• Web fonts: your browser loads fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google receives your IP address and browser details.
• Error reporting: if a page fails, the error message, technical details and the page address may be passed to an error-reporting tool from the hosting platform, if it's present. Server errors are written to server logs.
• ATORA: our server requests reports from ATORA AI. These requests contain no information about you.
• SEC, Marketstack and Alpha Vantage: when configured, our server requests company filings from the US SEC and end-of-day prices from Marketstack. Requests to the SEC carry the company's CIK number and our configured operator identity and contact email (the User-Agent the SEC requires). Requests to Marketstack carry the company ticker, the requested date range and our server-side access credential. We don't intentionally forward any information that identifies you to these providers. Alpha Vantage receives the company ticker, requested data function and our server-side credential for optional overview data or a price fallback.

Cookies and storage

The site's own code sets no advertising or tracking cookies. If you sign in, the sign-in service keeps your session in your browser's local storage so you stay signed in. See Cookies & Storage for what we haven't yet verified.

Canadian privacy law

The operating province is British Columbia. British Columbia's Personal Information Protection Act (PIPA) may apply to provincial private-sector activities. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) may additionally apply to commercial interprovincial or international flows of personal information and to federally regulated businesses. Alberta and Quebec also have substantially similar provincial private-sector laws; applicability depends on the activities and jurisdictions involved. We have not yet determined all applicable obligations and do not claim compliance certification.

See the Office of the Privacy Commissioner of Canada's guidance on provincial laws and PIPEDA.

Your rights

Depending on where you live, you may have rights to access or correct personal information, or to complain to a regulator. If PIPEDA applies, the Office of the Privacy Commissioner of Canada (OPC) may be the appropriate complaint channel. If provincial law applies, the applicable provincial commissioner may handle complaints, including the British Columbia OIPC, Alberta OIPC or Quebec's Commission d'accès à l'information. The appropriate regulator depends on the province, activity and law involved.

Signed-in people can use Account privacy to download allowlisted saved records as private JSON parts and submit access, correction or deletion review requests. Each part includes collection times, continuation and exclusions; mutable records may change between parts, so this is not a single database-wide instant. Downloads include your saved CSV cells and saved generated research evidence, but exclude credentials, sessions, provider caches, shared private evidence, operational leases, unsaved/temporary drafts, role/billing administration and hosting logs/backups. Requests are limited to three per UTC day and 100 lifetime for this pilot. No data is deleted by a request, and original immutable records remain unchanged. Request/review retention and approved deletion policy are still pending. Public contact details remain unpublished. This does not remove applicable rights or regulator complaint channels.

Still to be confirmed

Retention periods, a full list of service providers, cross-border data transfers and applicable privacy obligations. Target customer countries remain unconfirmed; a Canadian operating base does not establish worldwide privacy compliance.