This notice explains what personal data FinNexus Terminal (the "Service") collects, why, who it is shared with, how long it is kept and the rights you have. It is written to meet the UK GDPR and Data Protection Act 2018, the EU GDPR, India's Digital Personal Data Protection Act, 2023, and comparable laws where they apply. The short version: we collect what is needed to run your account and your research, we do not sell it, we do not advertise, and we do not track you.
1. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Account: email address, a one-way hash of your password (never the password itself), verification status, sign-up and sign-in times, acceptance of these documents (version and time) | To create and secure your account and prove what you agreed to | Contract; legal obligation |
| Sessions and security: session records, a short summary of your browser type, and a keyed, truncated digest of your IP address — the raw IP address is not stored; a security log of sign-ins, password changes and administrative actions | To keep you signed in, detect abuse and investigate incidents | Legitimate interests (security) |
| Your Content: watchlists, portfolio positions, fund accounts and transactions, imported statements, notes and screen runs you save | To provide the features you use | Contract |
| Usage needed to operate: which analyses were requested and AI usage totals, for cost limits | To run the Service within its limits | Legitimate interests |
We do not ask for, and you should not enter, government identifiers, bank or card numbers, or passwords for other services. Imported account statements are read for holdings and transactions; enter only statements that are yours.
2. Cookies and browser storage
The Service uses only strictly necessary storage: a session cookie that keeps you signed in, an anti-forgery (CSRF) cookie, and one browser setting that remembers your light or dark theme. There are no analytics, advertising or third-party tracking cookies, so no consent banner is shown. Blocking the session cookie prevents sign-in.
3. Who we share it with
We do not sell or rent personal data, or share it for advertising. We use service providers (processors) only to run the Service, under contracts that limit their use of it:
- Hosting and databases — the application host and the managed database provider that store the Service's data.
- Email delivery — the transactional email provider that sends verification and password-reset codes (it receives your email address and the message).
- AI providers (only when AI features are enabled) — requests contain market and company data from the evidence pack. They do not contain your email, your portfolio or other personal data.
- Market data and news sources — the Service requests public data about securities from these sources; it does not send them your personal data.
We may disclose data where required by law or to protect the rights, safety or security of users or the Service.
4. International transfers
Providers may process data outside your country. Where that happens we rely on adequacy decisions or standard contractual clauses (or the equivalent safeguards required by your local law).
5. How long we keep it
- Account data and Your Content: while your account exists. Deleting your account removes your account record, sessions and every private record of yours (watchlists, positions, fund accounts and transactions).
- Sessions expire after 12 hours of inactivity and at most 7 days after sign-in.
- Security log entries: about 90 days, then deleted, unless needed to investigate an incident.
- Shared market data (prices, fundamentals, fund information, headlines) is not personal data and is kept to serve all users.
6. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, to withdraw consent where processing relies on it, and to nominate someone to exercise your rights. You can see and edit Your Content in the Service, and delete your account at any time from Account & security. For anything else, including a copy of your data, write to [email protected]. We will respond within the time the law requires (normally one month). You may also complain to your data-protection authority — in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India; in the EU, your local supervisory authority.
7. Security
Passwords are stored as salted, slow hashes; sessions use secure, HTTP-only cookies; sign-in and code entry are rate-limited; and access to shared-data administration is restricted. No system is perfectly secure: if a breach affecting you occurs, we will notify you and the regulator as the law requires.
8. Children
The Service is for adults (18+). We do not knowingly collect data from children; if you believe a child has created an account, contact us and it will be deleted.
9. Changes
If this notice changes materially, the version above changes and you will be asked to accept it before continuing to use your account.