Privacy Policy

Introduction

Tensorvest ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use our AI-driven stock investment evaluation platform, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

Please read this policy so you understand our practices. By creating an account or using the service, you agree to the collection and use of your information as described here.

1. Who We Are

Tensorvest is an AI-driven stock investment evaluation platform that analyses listed equities from public market data and explains the reasoning behind each evaluation. Tensorvest is the controller of, and is responsible for, the personal data described in this policy.

Contact Details: If you have any questions or concerns about this policy or our privacy practices, contact us at privacy@tensorvest.com. You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at any time. We would, however, appreciate the chance to address your concerns first, so please contact us in the first instance.

2. Personal Data We Collect

Personal data means any information about an identifiable individual. Depending on how you use the service, we collect the following:

• Account and Identity Data: Your full name, email address, and a password that is stored only as a bcrypt hash. We never store or receive your plain-text password.
• Location and Currency Data: Your country and the currency we detect for pricing and payment routing, so we can show you the correct plans and process payments correctly.
• Technical Data: Your IP address, device and browser type, and request metadata. We use this for rate limiting, abuse prevention, and diagnosing errors.
• Usage Data: The tickers you analyse, how many analyses you have run in total and in the current month, and your plan tier and subscription status. This is how we enforce free-tier limits.
• Anonymous Usage Data: If you analyse a stock without signing in, we store a counter in a first-party cookie so we can still apply the free-tier limit.
• Payment Data: Your payment is processed by our payment partner, Bachs.io, on their PCI-compliant checkout. We receive only a customer reference, transaction references, the amount, currency, plan, and payment status — never your full card or bank details.
• Communication Data: Any correspondence you send us, such as support requests, and the fact that you requested a password reset.
• Market Data (not personal): Quotes, fundamentals, ratios, and price history for listed companies. This is company information, not information about you, and it is covered by section 7.

3. Where Your Data Comes From

• Directly from you: When you register, log in, subscribe, upgrade your plan, or contact support.
• Automatically from your device: Your IP address, browser, and request metadata are provided by your browser on every request.
• From our payment partner: Transaction confirmations and status updates are sent to us by Bachs.io through signed webhooks.
• Generated by our system: Evaluations and written analyses that we generate and cache. These are derived from public market data and contain no information that identifies you.

We do not buy personal data, and we do not scrape or enrich personal data about individuals from third parties. We only collect public market data about companies.

4. How We Use Your Personal Data

We use your personal data only for the purposes described below:

• To Provide the Service: To create and operate your account, evaluate the tickers you request, and answer your follow-up questions.
• To Authenticate and Secure You: To log you in, protect your session, prevent fraud and abuse, and apply rate limits.
• To Process Payments: To charge for subscriptions, issue receipts, manage upgrades, and restore your plan.
• To Enforce Plan Limits: To count analyses against your free or paid allowance and reset monthly counters.
• To Maintain Data Freshness: To refresh market data on a schedule so evaluations are based on current information.
• To Improve the Product: To understand which features are used, debug failures, and refine our analysis prompts. We do not use your data to build advertising profiles.
• To Comply with Legal Obligations: To meet tax, accounting, regulatory, and court-order requirements.
• To Send Service Communications: To notify you of security events, billing issues, and material changes to this policy. We do not send marketing email.

5. Artificial Intelligence and Automated Processing

Our evaluations are produced by AI models. It is important to be clear about what that means for your data:

• Two-stage analysis: We first run a rule and metric based evaluation over the company's financial data, then a second stage that explains the reasoning behind those results. Follow-up questions are answered live, in the context of the company's data and the analysis already produced.
• What is sent to the model: Public market data for the ticker you requested, your follow-up question, and a short window of your recent conversation. We do not send your name, email address, password, payment details, or IP address to the model provider.
• Model providers: Analysis may be processed by one of OpenAI, Anthropic, Groq, or Z.AI, depending on configuration, or by a model hosted on our own infrastructure. Every request is made over an encrypted connection using credentials held in our environment, never in your browser.
• Safety filtering: Questions are screened before they reach a model, and the models are instructed not to provide personalised financial, legal, or tax advice.
• No automated decisions about you: We do not use automated processing to make decisions about you that produce legal or similarly significant effects. Pricing and plan limits follow fixed, published rules.
• Research, not advice: Every evaluation is informational research output. It is not investment advice, and it is not a recommendation to buy or sell any security. Conduct your own due diligence.

If you want a human to review an output, contact us at privacy@tensorvest.com.

6. Caching and Reuse of Analyses

To keep costs down and response times fast, we cache generated analyses:

• What is cached: The evaluation, conviction score, and written analysis for a given ticker and exchange. Market price data is cached as well.
• How long: Cached analyses are valid for approximately one hour, and are refreshed automatically once the underlying data is considered stale.
• Who it is shared with: Anyone who requests the same ticker within that window may receive the same cached evaluation. This is why a second request for the same stock can return an identical analysis — and it is also why it is fast.
• What is never cached: Your follow-up questions and conversation are never placed in the shared cache, and cached entries never contain your name, email address, or account identifier.

7. Market Data Collection and Proxy Infrastructure

To evaluate companies we collect public financial data from market data providers such as Yahoo Finance and stockanalysis.com. TradingView was previously used but was retired because coverage of Nigerian Exchange listings was incomplete.

• Server-side collection: All market data requests originate from our own servers, never from your browser. Your IP address is never sent to a market data provider.
• Rotating proxies: We fetch through a pool of network proxies to distribute request volume and keep the service reliable. If a paid residential proxy is configured we use it; otherwise we validate a large pool of free proxies, discard the ones that do not work, and rotate a proxy out as soon as it is flagged.
• What proxies see: Only our outbound requests for public market data. Our proxy suppliers never receive your account details, and they are not sub-processors for your personal data.
• Scheduled refresh: Background jobs refresh market data on a schedule and perform routine housekeeping, so the data behind an evaluation is current.
• Ownership: The underlying market data belongs to its respective providers. We store derived metrics and price history to serve the analysis, and attribute information to its source.

8. Sharing and Sub-processors

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with the parties below, and only to the extent needed to operate the service:

• Payment provider: Bachs.io, which processes payments, verifies transactions, and returns confirmations to us through signed webhooks.
• AI model providers: The provider selected for your request, which processes company data and your question as described in section 5.
• Infrastructure providers: Our application hosting, database, and caching infrastructure, under contract and limited to authorised personnel with a business need to know.
• Professional advisers and authorities: Auditors, accountants, or regulators and law enforcement, only where disclosure is required by law or necessary to protect rights and safety.
• Corporate transactions: A merger, acquisition, or sale of assets, in which case we will give notice and any successor will be bound by this policy.

We do not embed advertising networks, third-party analytics beacons, or social media tracking pixels on this site.

9. Cookies and Similar Technologies

We use a deliberately small number of first-party cookies, all of which are required for the service to work:

• Session cookie: A signed session token set as an HttpOnly, SameSite cookie so it cannot be read or tampered with by client-side scripts. It is removed when you log out.
• Free-tier usage cookie: A HttpOnly cookie that counts analyses for visitors who are not signed in, expiring after 30 days.

We do not use advertising cookies, cross-site tracking cookies, or fingerprinting. You can clear or block cookies in your browser settings; doing so will sign you out and reset your anonymous free-tier counter.

10. Data Security

We apply technical and organisational measures designed to protect your data:

• Passwords: Hashed with bcrypt and salted. Plain-text passwords are never stored.
• Sessions: Signed, time-limited tokens delivered in HttpOnly, SameSite cookies, and deleted server-side on logout.
• Credentials at rest: Internal secrets and stored proxy credentials are encrypted before being written to our database.
• In transit: Traffic is encrypted with TLS, including requests to payment providers and AI model providers.
• Payment integrity: Incoming payment webhooks are verified against a shared secret signature before any subscription is changed.
• Abuse controls: Per-IP rate limiting on authentication and analysis endpoints, with short-lived counters.
• Logging: Application logs are kept for 30 days and then swept, and access to production data is restricted to authorised team members.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant supervisory authority as required by law.

11. Data Retention

We keep data only as long as it serves a stated purpose:

• Account data: For as long as your account is active, and until deletion is requested and completed.
• Payment records: Retained for the period required by tax and accounting law, even after account deletion.
• Usage counters: While your account is active; monthly counters reset at the start of each period.
• Cached analyses and market data: Replaced automatically as fresh data is fetched; superseded entries are discarded.
• Application logs: 30 days.
• Rate-limit counters: Short-lived sliding windows that expire on their own.
• Deletion requests: Completed within 30 days, except for records we are legally required to retain.

12. International Transfers

Tensorvest is based in Nigeria, and some of our sub-processors operate elsewhere. For example, an AI model provider may process a request in the United States or the European Union, and proxy infrastructure may route outbound market-data requests through other countries.

Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, and we limit transfers to what is necessary to deliver the service.

13. Children's Privacy

Our services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately at privacy@tensorvest.com and we will delete it.

14. Your Rights and Choices

Depending on where you live, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Ask us to delete your account and associated personal data.
• Restriction and objection: Ask us to pause or stop certain processing, including processing based on legitimate interests.
• Portability: Receive your data in a structured, machine-readable format.
• Withdraw consent: Where we rely on consent, withdraw it at any time, though some features may stop working.
• Complain: Lodge a complaint with the Nigeria Data Protection Commission, or with the supervisory authority where you live.

If you are in the EEA or the United Kingdom, you also have the rights provided under the UK GDPR and the EU GDPR, including rights relating to automated decision-making and to object to processing based on legitimate interests.

If you are in California, you have the right to know what personal information is collected, to request deletion, to request correction, and to opt out of the sale or sharing of personal information. Tensorvest does not sell personal information and does not share it for cross-context behavioural advertising, so there is nothing to opt out of — but you may still exercise your other rights.

To exercise any of these rights, email privacy@tensorvest.com. We will verify your identity, respond within the timeframe required by applicable law, and we will not discriminate against you for exercising a right.

15. Third-Party Sites and Links

Our pages may link to, or embed content from, third-party providers such as market data sites or our payment partner. Those providers have their own privacy policies and are responsible for their own practices. Once you leave Tensorvest, this policy no longer applies.

16. Changes to This Policy

We may update this policy from time to time as the service or the law changes. The "Last Updated" date at the top always reflects the current version. If we make a material change that affects your rights, we will notify you by email or a prominent notice on the platform before it takes effect. Continued use of the service after that notice means you accept the updated policy.

17. Contact Us

For any questions about this Privacy Policy, our data practices, or to exercise your rights:

• Email: privacy@tensorvest.com
• Address: Tensorvest, Lagos, Nigeria