Privacy Policy

This Privacy Policy ("Policy") describes how Finapolis Inc. ("Finapolis," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with finapolis.com, the Finapolis apps, the Napoli AI assistant, and related content, tools, data, and services (the "Services"). It applies to all users, including account holders, free trial and beta users, and visitors who have not created an account. 

This Policy forms part of our Terms of Service (Online User Agreement) (Part A). The Services are directed to users in the United States who are 18 or older. 

California residents: see Section 11 for your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and our notice at collection.

We collect personal information in the following categories:

2.1 Information You Provide

(a) Account and identity data: name, email address, username, password, state of residence, and, for business users, company name and role. 

(b) Financial preferences and inputs: investment interests and goals, risk preferences, portfolio parameters, target allocations, watchlists, screeners, DCF assumptions, and notes. You choose whether to provide this information. 

(c) Napoli and AI inputs: questions, prompts, conversation history, and files you upload. 

(d) Communications: support requests, feedback, survey responses, and other messages you send us. 

(e) Beta participation: testing activity, bug reports, and feedback, subject to the confidentiality terms in Section 27 of the Terms. 

(f) Billing information: when you subscribe, Stripe collects your payment card details directly. We receive your plan, billing status, card brand, last four digits, expiration date, billing name and address, and transaction history. We do not receive or store full card numbers, CVV codes, or full bank credentials. Stripe's use of your information is governed by the Stripe Privacy Policy. 

(g) Subscription consent records: the terms you agreed to at sign-up or checkout, including your consent to automatic renewal, with the date, time, and offer shown. 

2.2 Information from connected accounts

If you link a brokerage account through our connectivity provider (SnapTrade), we receive holdings, transactions, cash balances, cost basis, and performance data for the accounts you authorize. We do not receive your brokerage login credentials. We do not receive brokerage data unless you separately authorize a connection. 

2.3 Information collected automatically

(a) Usage and behavioral data: pages and features used, searches, content viewed, tools used, clicks, navigation paths, session duration, and interactions with Outputs.

(b) Device and Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution, language, time zone, and referring URLs. We may infer approximate location from IP address.

(c) Cookies and Tracking Technologies: see Section 7 and the Cookie Policy (Section 28 of the Terms).

(d) Log Data: access times, session duration, error logs, and API calls.

2.4 Information from Third Parties

(a) Sign-in providers: If you use Google Sign-In or Apple Sign-In, we receive the information you authorize, typically your name, email address, and a unique identifier.

(b) Payment processor: Stripe provides billing status and fraud-risk signals.

(c) Analytics providers: Such as Google Analytics.

(d) Market data and content providers: These providers may collect certain technical information when delivering their data to the Services. We do not control their practices.

2.5 Information we do not intentionally collect 

We do not intentionally collect Social Security numbers or other government ID numbers; full payment card or bank account numbers; precise geolocation; biometric data; health or medical information; or personal information from anyone we know to be under 18. If you believe we have received any of this information, contact support@finapolis.com. 

We use personal information to: 

(a) Provide and operate the Services: create and manage your account, deliver features (including analytics on your portfolio and Napoli responses), authenticate you, and provide support; 

(b) Configure the Services to your inputs: tailor content, tools, alerts, and analysis to your stated interests, inputs, and usage, and remember your preferences, watchlists, and screeners; 

(c) Process subscriptions: handle free trials, the promotional price, renewals, refunds, and taxes, and send free trial reminders and billing, renewal, promotional-price-ending, and price-change notices; 

(d) Keep consent records: retain records of your consent to subscription terms as required by law; 

(e) Communicate with you: send transactional messages (account confirmations, password resets, billing notices, security alerts) and service announcements, and, where you have opted in or the law permits, marketing about the Services, including offers (such as switching to annual billing) based on your plan and use. You can opt out of marketing at any time (Section 10.2); 

(f) Improve the Services: analyze usage and performance, test features, diagnose issues, and improve quality, accuracy, and usability, including with de-identified or aggregated data; 

(g) Run beta programs: administer beta and early-access programs and act on feedback; 

(h) Protect the Services: detect and prevent unauthorized access, fraud, repeat free trials, and abuse, and enforce our Terms; 

(i) Comply with law: meet legal obligations, respond to lawful requests, enforce our rights, and resolve disputes; and 

(j) Run our business: conduct audits and reporting, and evaluate or complete mergers, acquisitions, financings, or other transactions. 

We do not use your portfolio data, prompts, or files to train third-party foundation models. We do not make automated decisions that produce legal or similarly significant effects about you without human review.

For U.S. users, we rely on your consent (where required), contractual necessity (to provide the Services you request), legitimate business interests (such as improving the Services, preventing fraud, and security), and legal compliance, consistent with applicable U.S. state privacy laws. If we expand the Services to the European Economic Area, the United Kingdom, or other jurisdictions with comprehensive privacy laws, we will update this Policy with the applicable legal bases and jurisdiction-specific notices. 

We do not sell your personal information to third parties. We do not share your personal information with third parties for their own independent marketing purposes without your consent. We share personal information only in the following circumstances:

5.1 Service Providers

Stripe, Inc.:  Payment processing, subscription billing, fraud prevention, tax calculation 

OpenAI and Anthropic:  Generating Napoli and AI Reporter responses (Section 5.7) 

SnapTrade: Brokerage account connectivity you authorize 

Twilio; Telegram:  SMS, WhatsApp, and Telegram messaging on the channels you connect 

Cloud hosting providers [AWS]: Hosting and storage 

Email service providers [Outlook]: Transactional and marketing email 

Google and Apple:  Optional sign-in 

Google Analytics and similar providers:  Usage analytics

Support, security, identity-verification, and bot-detection vendors: Customer support and protection of the Services

Professional advisers: Legal, accounting, and audit services 

Service providers may use personal information only as needed to perform services for us and must protect it consistent with this Policy. 

5.2 Market data and content providers 

When delivering Third-Party Content, our data providers may receive certain technical information (such as IP address and usage logs) as part of normal data delivery, governed by our agreements with them. 

5.3 Legal and compliance disclosures 

We may disclose personal information if we believe in good faith that it is necessary to (a) comply with law, regulation, legal process, or an enforceable government request; (b) enforce our Terms or other legal rights; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Finapolis, our users, or the public. 

5.4 Business transfers 

If Finapolis is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you by email or a prominent notice before your information becomes subject to a materially different privacy policy.

5.5 Your organization 

If you use an Enterprise seat, your organization's account administrator may access your account data.

5.6 With your consent; de-identified data

We may share personal information in other ways with your affirmative consent. We may share aggregated or de-identified information that cannot reasonably identify you for research, analytics, marketing, or other purposes, and we do not attempt to re-identify it. 

5.7 AI Service Providers

Napoli and other AI features, including AI Reporter, use third-party AI model providers, currently OpenAI (ChatGPT models) and Anthropic (Claude models), to generate responses. When you use them, we share the information needed to answer your request with one or both providers. This may include your questions, relevant conversation history, portfolio information (such as holdings, transactions, cash balances, and performance), files you attach, and web search content. We do not include your password, brokerage login credentials, or email address in these requests. 

These providers process this information on our behalf, are not permitted to use it to train their models, and may retain it for a limited period (generally up to 30 days) for security and abuse monitoring before deleting it. 

In the Finapolis app, we ask for your permission before Napoli first shares information with these providers. You can turn this off at any time under Account → Napoli AI data sharing; Napoli will then stop sending new requests from the app. See our AI Disclosure for more information.

6.1 How you opt in 

You opt in from within your authenticated Finapolis account (Settings → Napoli → Connect SMS) by checking a consent box that is unchecked by default and sending a pre-filled message to our number from your own device. Sending that message links your mobile number to your account. Opt-in is voluntary and is not a condition of using the Services. 

6.2 What we collect and how we use it 

We collect your mobile number, the messages you send and receive, and related delivery metadata, and we use them only to operate the messaging program: to deliver the conversational and account-related messages you request, send confirmations, and provide support. Message frequency varies with your activity. Message and data rates may apply. Reply HELP for help or STOP to cancel at any time. 

6.3 Sharing of SMS opt-in data 

We may share the categories of personal information described in this Policy with the service providers and other parties described in Section 5. However: All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties. SMS consent is used solely to operate the Finapolis messaging program and is never sold or shared for others' marketing purposes. 

We use Cookies for essential functions (sign-in, security, checkout), preferences, analytics, and [marketing/advertising measurement]. Stripe sets Cookies on checkout pages for fraud prevention. You can manage non-essential Cookies through Cookie Settings in the footer and through your browser. We treat Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing for that browser. The Services do not respond to Do Not Track signals. Full details are in the Cookie Policy (Section 28 of the Terms). 

We keep personal information for as long as your account is active and as reasonably needed to provide the Services, meet legal obligations, resolve disputes, and enforce our agreements. In general: 

• Account data: for the life of the account and up to three (3) years after account closure, for dispute resolution and legal compliance, unless you delete your account, in which case it is deleted as described in Section 10.4. 
• Accounts cancelled during the free trial: the account closes when the free trial ends; data is kept for 30 days so you can reopen it by subscribing, then deleted. We keep a limited record (such as your email address and free trial dates) to prevent repeat free trials. 
• Financial inputs and preferences: while your account is active. You can delete saved watchlists, screeners, and similar inputs at any time in Account Settings. 
• Napoli conversation history: until you delete it or delete your account.
• Usage and behavioral data: generally up to two (2) years in identifiable form, then aggregated or de-identified. 
• Payment and billing records: at least seven (7) years for tax and accounting compliance. 
• Subscription consent records: at least three (3) years, or one (1) year after your subscription ends, whichever is longer. 
• Communications: support communications and feedback for up to two (2) years after resolution. 
• Account deletion records: when you delete your account, we keep a minimal record of the request (an internal identifier, a one-way cryptographic hash of your email address, timestamps, and the status of each deletion step) for twenty-four (24) months to demonstrate compliance. It does not contain your name, email address, phone number, or portfolio data. 
• Legal hold: information subject to a legal hold, litigation, or regulatory investigation is kept for the duration of that matter. 

When personal information is no longer needed, we delete or de-identify it. 

We use technical, administrative, and physical safeguards, including encryption in transit (TLS) and at rest, access controls and authentication for internal systems, regular security assessments, and vendor security requirements. No system is completely secure. If you believe your credentials have been compromised, change your password and contact support@finapolis.com immediately. If a security incident is reasonably likely to put affected individuals at risk of harm, we will notify them and relevant authorities as required by law. 

10.1 Account Information

Review and update your profile in Account Settings, or ask us to correct inaccurate information at support@finapolis.com

10.2 Marketing communications

Use the "unsubscribe" link in any marketing email or contact support@finapolis.com. Transactional and billing messages (such as account confirmations, free trial reminders, renewal and billing notices, and security alerts) continue while you have an account. 

10.3 Cookies

• Cookies: Cookie Settings in the footer, your browser, or the opt-out tools in the Cookie Policy. 
• SMS: reply STOP. 
• Napoli AI data sharing: Account → Napoli AI data sharing (Section 5.7). 
• Connected brokerage accounts: disconnect in Account Settings at any time. 
• Napoli history: delete in Settings.

10.4 Account Deletion

You can delete your account at any time in the Finapolis app (Account → Delete account) or on the web (Settings → Delete account). Deleting your account permanently deletes your account and the personal information associated with it, including your portfolios, positions and transactions, Napoli conversations, watchlists, alerts and settings, linked SMS, WhatsApp, and Telegram connections, and your sign-in. We also cancel any active subscription (including a free trial), delete your billing profile with our payment processor, and remove your brokerage connections with our brokerage-connectivity provider. Most deletion steps complete immediately; any remaining steps are completed within 30 days, and we will email you when deletion is complete. Our payment processor retains records of past transactions as required by law, and we keep the records described in Section 8. Information already sent to AI service providers is deleted under their retention periods (Section 5.7). Residual copies in backups are removed on our regular backup schedule. If you cannot access the app, request deletion at support@finapolis.com. 

11.1 Your rights 

Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws), you may have the right to: 

• Know and access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients; 
• Correct inaccurate personal information; 
• Delete personal information, subject to legal exceptions; 
• Portability: receive a copy in a portable, readily usable format; 
• Opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information. To the extent our use of analytics or advertising Cookies is "sharing" under California law, you can opt out through "Your Privacy Choices," Cookie Settings, or a GPC signal; 
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling); 
• Limit use of sensitive personal information. We use sensitive personal information (account login credentials) only to provide the Services; and 
• Non-discrimination. We will not deny you service, charge you a different price, or provide a different level of quality because you exercised your rights. 

11.2 How to submit a request 

Email support@finapolis.com with the subject "Privacy Rights Request" (California residents may use "California Privacy Rights Request") [or use the webform at LINK]. We will verify your identity, generally by confirming control of your account email. You may use an authorized agent with your signed written permission; we may also ask you to verify your identity directly with us. 

We will acknowledge your request within ten (10) business days and respond within forty-five (45) calendar days. If we need more time (up to an additional 45 days), we will tell you why. We are not required to fulfill more than two Right to Know requests in a 12-month period. If we deny your request, you may appeal by replying to our decision with "Appeal" in the subject line. 

11.3 California notice at collection 

In the past 12 months, we collected the following categories of personal information as defined under the CCPA: 

• Identifiers (name, email address, IP address, username, device identifiers); 
• Customer records (billing name, address, and limited card information); 
• Commercial information (subscription plan, billing and transaction history); 
• Financial information you provide or connect (portfolio inputs and connected brokerage data); 
• Internet or other electronic network activity (activity within the Services, search queries, usage data); 
• Geolocation data (approximate location derived from IP address); 
• Inferences (investment preferences and usage profiles used to configure the Services); 
• Professional or employment-related information (if provided, for business users); and 
• Sensitive personal information (account login credentials only). 

We collect these from you, your devices, and the third parties listed in Section 2, for the purposes in Section 3, and disclose them to the categories of recipients in Section 5. We [do not sell personal information / may "share" identifiers and internet activity with analytics or advertising partners for cross-context behavioral advertising]. Retention is described in Section 8. 

11.4 Shine the Light 

California residents may ask about our disclosure of personal information to third parties for their direct marketing purposes under California Civil Code § 1798.83. We do not make such disclosures. Contact support@finapolis.com.

11.5 Minors under 16 

We do not knowingly sell or share the personal information of consumers under 16. If we learn we have collected such information without appropriate consent, we will delete it promptly.

The Services are for adults 18 and older and are not directed to children. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA), or from anyone under 18. If you believe a child has provided us personal information, contact support@finapolis.com and we will delete it. 

The Services may link to or embed third-party websites, tools, or content we do not control. This Policy does not apply to them. Please review their privacy policies. 

The Services are operated in and directed to the United States. If you access them from outside the U.S., your information will be transferred to, stored, and processed in the U.S., where data protection laws may differ from those in your country. 

We will post updates here and change the "Last updated" date. For material changes, we will notify you by email or in-app notice before they take effect. If you do not agree to the revised Policy, you must stop using the Services. 

Finapolis Inc., Attn: Privacy 
4343 Von Karman Ave., 3rd Floor, Newport Beach, CA 92660 
support@finapolis.com 

For California-specific requests, use the subject line "California Privacy Rights Request."