Privacy Policy

We collect the minimum information needed to operate the service:

• Account data: your email address, name (if you choose to provide it), profile image (if you sign in with Google), and authentication tokens. Created and stored by our authentication provider (Clerk).
• Predictions you make: the symbol, timeframe, and engine output for each prediction. Stored under your account so we can show you your track record and so the engine can calibrate itself.
• Usage data: request timestamps, IP address, browser user-agent. Used only for security, abuse detection, and rate-limiting.
• Billing data (only if you subscribe or buy credits): we never store your credit card number. Stripe handles all payment data. We retain only your Stripe customer ID, billing country, and the ledger of credit purchases for tax and audit purposes.
• Cookies: a single session cookie set by Clerk so you stay signed in. We do not use marketing or analytics cookies.

• We do not sell your data, ever.
• We do not track you across other websites.
• We do not store your payment card details. Stripe is our PCI compliance boundary.
• We do not collect biometric data, government IDs, or social security numbers.
• We do not knowingly collect data from anyone under 18. If you believe a minor has registered, email us and we will delete the account.

We use your data only for:

• Authenticating you and securing your account.
• Computing and showing you AI predictions you request.
• Showing you your prediction track record on /performance.
• Aggregating across all users (anonymously, in aggregate) to calibrate the engine's confidence ratings.
• Charging you for credits or subscriptions you purchased.
• Sending you transactional emails (welcome, receipt, password reset, account suspension). We do not send marketing email without your explicit opt-in.
• Detecting and preventing abuse, fraud, and security incidents.

We use a small number of trusted third-party processors. Each accesses only the data necessary for its function:

Predixova's primary database (Firestore) is hosted on Google Cloud Platform in the us-central1 region (Iowa, United States). Backups are encrypted at rest and replicated across multiple availability zones within that region. We do not transfer your data to any region outside the United States, except via the processors listed above when they operate regionally (e.g. BetterStack logs are stored in the EU).

• Account data: kept as long as your account exists. Deleted within 30 days of you closing the account (see Section 9).
• Predictions: kept indefinitely under your account so you can build a long track record. Deleted with your account.
• Billing records: retained for 7 years after the last transaction to comply with tax laws.
• Server logs: retained for 30 days for security and operational debugging, then automatically purged.

• All data in transit is encrypted with TLS 1.2 or higher.
• Data at rest in Firestore is encrypted with AES-256.
• Production credentials live in Google Secret Manager. No credentials are stored in code or transmitted to clients.
• Access to production data is restricted to a small list of administrators via Google Cloud IAM and audited via Cloud Audit Logs.
• We monitor for anomalous activity via Sentry, BetterStack alerts, and Cloud Run revision-level logging.

Regardless of where you live, you have the right to:

• Access — see what data we hold about you. The dashboard and track record pages already show most of it. For anything else, email us.
• Correct — update or correct inaccurate data.
• Delete — request deletion of your account and associated data. We will delete within 30 days. Billing records may be retained as required by tax law (Section 7).
• Export — request a machine-readable copy of your data. Email us; we will send a JSON export within 30 days.
• Object — to specific uses of your data.
• Withdraw consent — for any optional processing you previously agreed to.

For California residents (CCPA), Europeans (GDPR), or anyone else with extra protections — those rights apply too. Email contact@anascanada.ca with your request.

Predixova is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has registered, please notify us at contact@anascanada.ca and we will promptly delete the account and any data we hold about them.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify signed-in users via in-app message or email. Continued use of Predixova after the effective date of the new policy constitutes acceptance.

For any privacy question, complaint, or rights request, email contact@anascanada.ca.