Privacy Policy

1. Data we collect

Account and profile data: first name, last name, email address, country, password (stored encrypted) or Google OAuth authentication, investment experience level, risk tolerance, preferred financial instruments, preferred broker.

Financial data you provide: trades entered manually or via text description, images/screenshots uploaded from broker accounts (automatically processed to extract trade data), resulting portfolio positions, declared budget and investment goals entered in the portfolio-building questionnaire.

AI conversations and interactions: messages sent to the AI Analyst and the history of these conversations, so we can respond in context and enforce usage limits (e.g. 5 queries/day).

Payment data: processed directly by our payment processor (Stripe). Zoras does not store your full card number; we only keep technical identifiers required to manage the subscription (e.g. Stripe customer ID).

Technical and usage data: IP address, device type, browser, pages visited, session cookies required for authentication, feature usage data (e.g. number of daily AI Analyst queries).

Optional communications: if you enable email alerts (e.g. monthly contribution reminders), we process your email address to send these notifications via a third-party email provider.

We never request or store the credentials of your broker account — Zoras does not and cannot access your external trading accounts.

2. How we use your data

We use the data we collect to:

• create and manage your account and associated subscription;
• generate the analyses, scores and educational recommendations displayed in the application, including through processing with artificial intelligence models;
• calculate and display your portfolio positions and performance;
• send notifications and alerts that you have explicitly enabled;
• process subscription payments through the third-party processor;
• improve the product, including through aggregated and anonymized usage analysis;
• comply with legal obligations (e.g. keeping tax records of payments);
• prevent fraud, abuse and unauthorized use of the Service.

3. Legal basis for processing (for EU/EEA users)

We process your data based on: (a) the performance of the contract between you and Zoras (providing the Service), (b) your explicit consent (e.g. for email alerts or optional cookies), (c) our legitimate interest (e.g. fraud prevention, product improvement) and (d) applicable legal obligations (e.g. tax records).

4. Who we share data with

We do not sell your personal data. We share it only with third-party providers necessary to operate the Service, acting as processors:

• Infrastructure and database providers — for hosting the application and storing data.
• Payment processor (Stripe) — for processing the subscription.
• Transactional email provider — for sending alerts you have enabled.
• Market data providers — for prices, fundamental/technical indicators and financial news (they only receive the requested tickers, not your personal data).
• Artificial intelligence model providers — messages sent to the AI Analyst and the financial context data required to generate analyses may be transmitted to third-party AI model providers for processing. These providers process the data according to their own privacy policies and the contractual agreements entered into with us; we do not use this data to train third-party models, to the extent permitted by the agreements with those providers.

We may also share data when required by law, to respond to legal proceedings, or to protect the rights, safety and property of Zoras or its users.

5. International data transfers

Some of our third-party providers (including infrastructure and artificial intelligence providers) may process data outside Romania / the European Union, including in the United States. In such cases, we rely on legally recognized transfer mechanisms (e.g. Standard Contractual Clauses approved by the European Commission) to ensure an adequate level of protection for your data.

6. How long we keep data

We keep your data for as long as your account remains active. If you delete your account from Settings, the associated data is deleted or anonymized within a reasonable timeframe, except for information we are legally required to retain (e.g. tax records of payments, for the period required by applicable accounting/tax legislation).

7. Your rights

Depending on the jurisdiction in which you are located, you may have the right to:

• access the personal data we hold about you;
• request rectification of incorrect or incomplete data;
• request deletion of the account and associated data (possible directly from Settings);
• request data portability in a structured format;
• object to certain processing based on legitimate interest;
• withdraw at any time consent for processing based on consent (e.g. email alerts), without affecting the lawfulness of previous processing.

To exercise these rights, you can contact us at [DATA PROTECTION EMAIL]. Users in the EU/EEA also have the right to lodge a complaint with the national data protection supervisory authority (in Romania, ANSPDCP).

8. Security

We apply reasonable technical and organizational measures (encryption in transit, access control, secure authentication) to protect your data. No system can guarantee absolute security, and use of the Service involves an inherent level of technical risk.

9. Cookies

We use cookies strictly necessary for authentication and session functionality, and, where applicable, optional usage-analytics cookies — enabled only with your consent, where the law requires. [TO BE COMPLETED WITH LEGAL COUNSEL: if third-party analytics/marketing cookies are used, a consent banner compliant with ePrivacy/GDPR is required.]

10. Children

The Service is not intended for persons under 18 years of age and we do not knowingly collect data from minors. If we learn that we have inadvertently collected data from a minor, we will delete it.

11. Changes to this policy

We may update this Policy periodically. Significant changes will be communicated by email or via an in-app notification, with the updated effective date shown at the top of the document.

12. Contact

For questions about this Policy or about your personal data: [DATA PROTECTION EMAIL] or contact@zoras.ai.