Privacy Policy
The short version
Introduction. This Privacy Policy explains how [LEGAL ENTITY NAME] ("Investeam," "we," "us") collects, uses, and shares personal data when you use investeam.io (the "Service"). We are the data controller. Investeam is a global, English-first service with Hebrew support; this policy meets the EU/EEA GDPR, the Israeli Protection of Privacy Law (as amended, incl. Amendment 13), and the CCPA as amended by the CPRA. If any translation conflicts with the English version, the English version governs, except where local law requires the local-language version to prevail.
What we collect
| Category | What it is | Source |
|---|---|---|
| Mandate / query text | The free-form investment question and any answers you type. May reveal your financial situation, holdings, interests, goals. | You, directly |
| Session state | The structured brief, clarifying Q&A, committee plan, findings, status, timestamps. | Generated by the Service |
| Account / identity data | Email; if you sign in with Google, the identity info Google returns (name, email, Google account ID, profile image). Auth via Firebase Authentication. | You / Google |
| Technical data | IP, device/browser type, log data; local-storage/sessionStorage values to keep your place in a flow. |
Automatic |
We do not intentionally collect special-category data. Please do not enter payment-card numbers, government IDs, passwords, or other people's personal data into the mandate field.
Why we process it
| Purpose | Lawful basis |
|---|---|
| Turn your question into a mandate and run the AI analysis/committee | Performance of a contract (Art. 6(1)(b)) |
| Maintain your account and authenticate you | Performance of a contract (Art. 6(1)(b)) |
| Keep the Service secure, prevent abuse, debug, comply with law | Legitimate interests (Art. 6(1)(f)) / legal obligation (Art. 6(1)(c)) |
| Improve the Service (aggregate/analytics) | Legitimate interests (Art. 6(1)(f)); neither we nor our AI provider use your input or output to train models — see Who we share it with |
Under the Israeli PPL, processing is on the basis of your consent, given when you submit input after notice at collection. Under CCPA/CPRA we do not sell or share (cross-context behavioral advertising) your personal data.
AI and automated processing
Your input is processed by an AI system, orchestrated through our pipeline, that generates the mandate, questions, and findings. This output is informational only, is not a decision producing legal or similarly significant effects about you, and is not personalized investment advice (see Terms §"Not investment advice"). Output can contain errors. We do not use it for automated decisions about eligibility, credit, employment, or legal status.
Who we share it with
- Google Cloud Platform — hosting and data storage (app on Cloud Run; session data in Firestore; async jobs use Cloud Tasks / Pub/Sub; secrets in Secret Manager). Processed under the Google Cloud DPA.
- Firebase Authentication (Google) — account sign-in incl. Google OAuth.
- A third-party AI model provider (Google — Gemini API) — the AI model generating your analysis. Your input and the generated output are sent to it. We call the provider on our paid-tier account, under the provider's paid-services API terms and a Data Processing Addendum, so the provider does not use prompts or responses to train or improve its models. This protection comes from our account status with the provider, so it applies to every Investeam user regardless of your Investeam plan — free and paying alike. The provider may log prompts and responses for a limited period (currently up to about 55 days) solely to detect and prevent abuse and maintain safety and security — content flagged by its safety systems may be reviewed by authorized provider personnel — and for any legally required disclosures. [CONFIRM provider naming vs. GDPR Art. 13 recipient-disclosure with legal — §5.]
We do not sell your data. We disclose only to these processors, to authorities where legally required, and to a successor in a merger/acquisition (with notice).
Granularity recommendation: name Google Cloud Platform, Firebase Authentication, and the AI model provider + the categories (hosting, storage, auth, AI generation) in the public policy. Enumerating specific GCP products (Firestore, Cloud Tasks, Cloud Run, Secret Manager) is good practice but not strictly required in the user-facing policy. Recommended: name the three providers + categories in the public policy, keep the product-level sub-processor enumeration in a separate versioned /subprocessors page (or DPA annex) linked from the policy — updatable without re-issuing the whole policy; ARCHITECTURE.md stays the source of truth for product-level detail. [Legal to confirm whether the AI provider can remain unnamed in the public policy under GDPR Art. 13 / CCPA.]
Where your data goes
Providers (Google) may process data outside your country, including in the US. For EU/EEA or Israeli individuals, transfers are protected by Standard Contractual Clauses and the Google Cloud DPA safeguards, plus any adequacy mechanism (e.g. EU–US Data Privacy Framework where certified). Request a copy of safeguards via the contact below.
How long we keep it
We keep account data while you have an account. We keep mandate text, session state, and output as long as needed to provide the Service and for a reasonable period afterward, then delete or anonymise. [DEFINE a concrete period — §5.] You can ask us to delete sooner (§7).
Your rights
Access; rectification/correction; erasure/deletion; portability (GDPR); restriction/objection; withdraw consent; CCPA/CPRA rights (know, delete, correct, opt out of sale/sharing — we do neither — limit use of sensitive PI; no discrimination for exercising). First request in a reasonable period is free; we may verify identity.
Contact us
Email [PRIVACY CONTACT EMAIL — §5]. EU/EEA: complain to your supervisory authority; Israel: the Privacy Protection Authority; California: the CPPA. [Name EU rep / DPO if appointed — §5.]
Cookies and local storage
We use sessionStorage/local storage to keep your place in a flow; Firebase Auth uses cookies/tokens to keep you signed in. Strictly necessary to operate the Service. No advertising/cross-site tracking cookies. [Analytics cookies later → EU cookie-consent required.]
Children
Not directed to and not for anyone under 18 (recommended for an investment product). We don't knowingly collect minors' data; if we learn we have, we delete it.
Changes to this policy
We may update; new "Last updated" date, prominent notice for material changes. Continued use after the effective date = acceptance.