How Investfly handles personal data
Effective Date: August 4, 2026
This Privacy Policy explains how Finverse LLC d/b/a Investfly ("Investfly," "we," "us," or "our") collects, uses, discloses, retains, and deletes personal data when you visit our websites or use our applications, APIs, strategy-development tools, backtesting and simulation tools, automation services, broker connections, community features, and related support (collectively, the "Services"). Finverse LLC is the controller of personal data covered by this Policy unless a feature notice says otherwise.
This Policy does not govern a broker, exchange, market-data vendor, payment processor, AI model provider, or other independent third party's own processing. Review that party's privacy notice before connecting or using its service.
| Category | Examples | Sources |
|---|---|---|
| Account and contact data | Name, username, email, phone number, mailing address, password hash, authentication data, account role, plan, preferences, and account dates. | You, account administrators, and authentication systems. |
| Subscription and transaction data | Plan, billing cycle, trial status, payment-customer and subscription identifiers, charge status, promotion codes, invoices, refunds, and limited payment-method details. Investfly does not receive full card numbers entered in Stripe checkout. | You and our payment processor. |
| Connected-account and financial data | Broker or provider name, account identifiers and type, connection status, authorization codes, access or refresh tokens, balances, buying power, positions, orders, executions, trade history, and provider responses. | You, your connected broker or provider, and activity generated through the Services. |
| Strategy and customer content | Strategy names and descriptions, rules, symbols and universes, allocations, sizing, risk settings, code, scripts, prompts, uploaded data, templates, clones, versions, backtest inputs and results, virtual portfolios, deployments, execution logs, errors, and generated outputs. | You, collaborators or community contributors, the Services, and providers you choose to use. |
| Communications and program data | Support requests, feedback, survey responses, marketing preferences, referral codes and links, referrer and referred-user identifiers, qualification status, commissions, and payout records. | You, other users, communications providers, and referral or affiliate activity. |
| Device, usage, and cookie data | IP address, browser and device type, operating system, identifiers, approximate location derived from IP, referring URLs, pages and features used, timestamps, session activity, diagnostics, and cookie or local-storage values. | Your device, our logs, and analytics or security providers. |
| Derived and security data | Fraud or abuse indicators, authentication and audit events, service-health measurements, feature analytics, and inferences needed to protect or operate the Services. | Data described above, our systems, and security providers. |
Please do not submit government identification, health information, Social Security numbers, or other sensitive data unless a specific feature requests it and explains why it is needed.
We use personal data to:
Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests in operating and securing the Services, compliance with legal obligations, and consent for processing that requires it. You may withdraw consent, but withdrawal does not affect earlier lawful processing.
When you authorize a live strategy, Investfly processes the adopted rules, market or account data, and execution state to determine whether user-defined conditions are satisfied. The Services may then transmit order instructions to the connected provider without contemporaneous human confirmation. We store related configuration, provider responses, and execution logs to operate the feature, show status, troubleshoot incidents, secure the Services, and address disputes. The connected provider independently processes the instruction and account data under its own privacy notice.
If you choose an AI-assisted feature, the feature notice will identify or link to current provider information and describe the data sent. Depending on the feature, this may include your prompt, selected strategy code or configuration, relevant market or account context, attachments, technical identifiers, and the generated response. Do not include broker credentials or unnecessary personal or confidential information in a prompt.
Any integrated AI feature will use a business or API model service rather than a consumer chat account. We configure provider data-sharing or model-training options to be off unless we disclose a different setting and obtain any consent required by law. A provider may temporarily retain inputs, outputs, and technical metadata for abuse monitoring, security, legal compliance, or feature state under its then-current enterprise or API terms. The applicable feature notice and provider terms control the provider-specific retention period. Investfly may retain prompts and outputs as Customer Content and operational logs under Section 8 below. We do not use broker credentials to train general-purpose AI models.
We disclose only the data reasonably necessary for the purpose to the following categories of recipients:
Service providers are permitted to process personal data only for contracted services and related legal obligations. Independent providers may determine their own purposes and are governed by their own notices.
Our Cookie Policy describes cookies, browser storage, Google Analytics, purposes, typical durations, and available controls. Google Analytics receives device, usage, and approximate-location data from the public website. Depending on configuration and applicable law, disclosure of online identifiers to analytics or advertising technology providers may be considered a "sale," "sharing," or processing for targeted advertising even when no money is exchanged.
Investfly does not sell personal data for money. You may opt out of a disclosure treated as sale, sharing, or targeted advertising by enabling a legally recognized browser-based opt-out signal, such as Global Privacy Control, or emailing privacy@investfly.com with the subject "Opt-Out Request." Where required, we treat a recognized signal as applying to the browser or device that sends it. Clearing cookies or using another device may require renewing the choice. We do not knowingly sell or share personal data of people under 18.
We use the periods below as general limits, subject to shorter feature settings and longer retention reasonably necessary for security, fraud prevention, legal holds, disputes, tax or accounting obligations, or another legal requirement:
| Data | Typical retention |
|---|---|
| Account, profile, preferences, and active Customer Content | While the account is active. After a verified deletion request or account closure, deletion or de-identification from active systems generally begins within 30 days and completes within 90 days, subject to the exceptions below. |
| Broker connections, tokens, and connected-account snapshots | While the connection or account is active. Disconnecting revokes Investfly's intended use of the connection; tokens are deleted or disabled from active use when reasonably practicable. Historical orders, trades, and logs may remain under the next row. |
| Orders, executions, trade history, deployments, and execution or security logs | For the account term and generally up to seven years afterward when reasonably needed for accounting, security, dispute resolution, provider reconciliation, or legal obligations. |
| Subscription, payment, refund, affiliate, and commission records | Generally seven years after the transaction or end of the commercial relationship for tax, accounting, fraud, and dispute purposes. Payment processors retain data under their own policies. |
| Support communications and routine diagnostics | Generally up to three years after the request closes; security incident records may be retained longer when necessary. |
| Website analytics and cookies | According to the settings and cookie lifetimes described in the Cookie Policy; Google Analytics user- and event-level retention is controlled in Google Analytics and may be shorter than the cookie lifetime. |
| Backups | Deleted data may remain in encrypted, access-restricted backups until those backups are overwritten in the ordinary cycle, generally within 180 days, and will not be restored to active use except for disaster recovery, security, or legal requirements. |
Deletion is not instantaneous and does not cancel an order already transmitted, delete records held independently by a broker or other provider, remove content another user already cloned, or require deletion of de-identified data that cannot reasonably be linked back to you. Public content may remain in another user's independent copy, while Investfly removes or de-identifies your attribution where legally required and technically practicable.
We use administrative, technical, and physical safeguards designed for the nature of the data and Services, including access controls and protections for data in transit and storage where appropriate. No system or transmission is completely secure. Protect your password, multi-factor authentication, API keys, broker credentials, and devices; do not share them; and contact us promptly if you suspect unauthorized access.
Investfly is based in the United States. We and our providers may process data in the United States and other countries where privacy laws may differ from those in your location. Where required, we use an approved transfer mechanism or another lawful basis for cross-border processing. Using the Services does not waive rights that applicable privacy law makes non-waivable.
Depending on your location and subject to legal exceptions, you may have the right to:
Submit a request by emailing privacy@investfly.com with the subject "Privacy Request" or by writing to the address below. Describe the right and the account or browser involved. We will verify a request by matching information we already maintain, asking you to authenticate to your account, or requesting additional information proportionate to the request. We use verification information only to process the request. An authorized agent may submit a request where law permits, but we may require proof of authority and direct identity confirmation.
If we deny a request, our response will explain the reason and, where applicable, how to appeal. Submit an appeal to privacy@investfly.com with the subject "Privacy Appeal" within 60 days of the decision. We will respond within the period required by applicable law and explain any further right to contact a regulator or state attorney general.
The categories collected in the preceding 12 months are listed in Section 2. We use them for the purposes in Sections 3 through 5 and disclose them to the recipient categories in Section 6. Retention criteria and typical periods appear in Section 8. Connected-account identifiers and credentials may qualify as sensitive personal information; we use them to provide, secure, and troubleshoot the requested service and do not use them to infer characteristics about you.
California and residents of other states with applicable privacy laws may exercise the rights listed in Section 11, including opt-out rights described in Section 7. We do not offer a financial incentive for personal data through the referral program; referral payments compensate qualifying customer acquisition under separate program terms. We will not discriminate against you for exercising an applicable privacy right.
You may unsubscribe from marketing email through the link in the message. We may still send non-marketing communications about your account, billing, security, providers, strategies, orders, or changes to the Services or legal terms. Browser and device notification controls govern push notifications where available.
The Services are not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child provided personal data, contact us so we can investigate and delete it where required.
We may update this Policy as the Services, providers, or law change. We will post the updated Policy and effective date and provide additional notice when required or when a change materially affects your privacy rights. We will request consent for a materially new use where applicable law requires it.
For privacy questions, requests, or appeals, contact:
Finverse LLC d/b/a Investfly
6129 Watch Chain Way
Columbia, MD 21044
Email: privacy@investfly.com