Legal Center

FiNode, Inc. ("FiNode," "we," "us," or "our") provides an AI-powered investment research and portfolio-monitoring platform available at finode.ai and through our iOS and Android mobile applications (collectively, the "Service").

This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to all users of the Service.

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2.1 Information you provide directly

• Account and identity information — email address, name, phone number, account credentials, and verification codes sent by email or text message.
• Portfolio holdings — ticker symbols and other security identifiers, asset type, quantity held, and cost basis.
• Uploaded documents — brokerage account screenshots and statements you choose to upload for automated import.
• Communications and content — messages you submit to our research features, support requests, and feedback you send us.
• Preferences — notification and email alert settings.
• Billing information — where paid features are offered, payment and billing details collected and processed by our payment processor. FiNode does not store full payment card numbers.

2.2 Information from linked financial accounts

If you choose to link a brokerage account, that connection is established through Plaid Inc. ("Plaid"), a financial data network. You enter your financial institution credentials directly with Plaid.

We request only investment holdings information. From what is returned to us, we retain only your security identifiers, asset types, quantities, and cost basis, together with the name of your financial institution and a reference that allows us to maintain the connection.

We do not retain account numbers, account masks, account nicknames, cash balances, or transaction history.

Plaid's own collection and use of your information is governed by the Plaid End User Privacy Policy, available at plaid.com/legal, which we encourage you to review.

2.3 Information generated by the Service

• Portfolio valuations — we compute the market value of your portfolio and retain a history of those values.
• Derived analytics — allocation percentages, sector exposures, factor tilts, fixed-income statistics, and similar measures computed from your holdings.
• Generated reports — portfolio commentary, due-diligence reports, alerts, and briefings produced for you and stored in your account.

2.4 Information collected automatically

• Device and usage information — IP address, device and operating system type, application version, browser type, features accessed, and timestamps.
• Diagnostic and log data — records of system activity used to operate, secure, and troubleshoot the Service. These records identify accounts by internal reference rather than by name or email address and do not capture the contents of your requests, except that when an error occurs during processing, a short excerpt of the content being processed may be recorded so that we can diagnose the failure.
• Cookies and similar technologies — see Section 9.

2.5 Information we do not collect

We do not request or require government-issued identification numbers, Social Security numbers, date of birth, precise geolocation, or biometric information. Please do not submit this information to us. Note that documents you choose to upload may contain information beyond what we need — see Section 5.

We use personal information to:

• Provide the Service — create and authenticate your account, build and maintain your portfolio, compute analytics, generate reports and commentary, and deliver alerts.
• Import and sync holdings — extract holdings from documents you upload and synchronize holdings from accounts you link.
• Communicate with you — send verification codes, service and security notices, alert and briefing emails you have enabled, and responses to your inquiries.
• Improve and secure the Service — monitor performance and reliability, resolve errors, and detect and prevent fraud, abuse, and unauthorized access.
• Process payments — where paid features are offered, to bill you and maintain billing records.
• Comply with law — meet legal, regulatory, and law-enforcement obligations and enforce our Terms of Use.

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Providing the Service and performing our agreement with you — performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention, and service improvement — legitimate interests (Art. 6(1)(f)).
• Marketing communications, where applicable — consent (Art. 6(1)(a)).
• Legal and regulatory compliance — legal obligation (Art. 6(1)(c)).

You may withdraw consent at any time without affecting processing carried out before withdrawal.

We use artificial intelligence models provided by Anthropic, PBC ("Anthropic") to generate written analysis, and related services from our cloud infrastructure provider. This section describes what is shared with those providers.

5.1 Document import

When you upload a brokerage screenshot or statement for automated holdings import, the complete, unmodified file is sent to our AI provider so that your holdings can be extracted from it. We do not crop, mask, or redact the file first. If the document contains information beyond your holdings — such as your account number, your name and address, account balances, or transaction detail — that information is transmitted along with it.

The uploaded file is processed and then discarded. FiNode does not store the file. Only the extracted holdings are saved to your account.

5.2 Portfolio commentary

For AI-generated portfolio commentary, we deliberately minimize what is shared. Our AI provider receives only ticker symbols and derived percentages — allocation weights, sector over- and underweights, factor tilts, and similar ratios. Dollar values, share quantities, cost basis, account values, your name, your email address, and other identifying information are calculated on our own systems and are not included.

5.3 Alerts and briefings

Alert headlines and calendar events relevant to your portfolio, labeled by ticker and sector, are shared with our AI provider to produce narrative summaries. This indicates which securities you hold. No amounts and no identifying information are included.

5.4 Research features

Messages you submit to our research features are shared with our AI provider together with publicly available source material, and are processed to enable relevant retrieval. These messages are stored in your account. Please do not enter sensitive personal information into these features.

5.5 Analysis that involves no user data

Much of the analysis in the Service — due-diligence reports, news analysis, earnings recaps, legislative and regulatory analysis, digital-asset analysis, and daily macroeconomic summaries — concerns publicly available information about securities and markets and is not tied to any individual user. No user identifiers, contact information, quantities, or dollar values are included in that work.

5.6 Provider handling

Our AI provider acts as our service provider and is contractually restricted from using data submitted through its commercial interface to train its models. AI providers may retain data briefly for abuse monitoring in accordance with their own terms. See the Anthropic Privacy Policy at anthropic.com/legal/privacy.

5.7 Accuracy

AI-generated output may be incomplete, out of date, or incorrect. It is informational only and is not investment advice or a recommendation. See our Terms of Use.

We disclose personal information only as follows.

6.1 Service providers

• Amazon Web Services — cloud hosting, storage, authentication, and email delivery (all categories of data).
• Anthropic, PBC — AI-generated analysis and document extraction, as described in Section 5.
• Plaid Inc. — brokerage account linking and holdings retrieval (financial account data).
• Payment processor — billing for paid features, where offered (billing and contact data).

Each service provider is bound by contract to process personal information only on our instructions and only for the purposes for which it was disclosed.

We also obtain market data, news, corporate filings, and public-record information from third-party providers and public sources. Those providers supply information to us. We do not transmit your personal information to them.

6.2 Legal and safety disclosures

We may disclose information where we believe in good faith it is necessary to comply with applicable law, subpoena, or legal process; to enforce our Terms of Use; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of FiNode, our users, or others.

6.3 Business transfers

If FiNode is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and of any material change to this Privacy Policy that results.

6.4 With your direction

We share information with third parties when you direct us to do so.

We retain personal information for as long as your account remains active and for the period necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

• Account information (email, name, phone) — until account deletion.
• Holdings and portfolio value history — until you delete the holding or delete your account.
• Research messages and notification history — until account deletion.
• Uploaded documents — not retained; processed and discarded.
• Temporary caches of generated content and market data — expire automatically, within one week at most.
• Diagnostic and log data — a limited period, not exceeding 90 days.

Deleting your account

You may request deletion of your account at any time by emailing privacy@finode.ai from the address associated with your account. We will delete your account record and the associated holdings, portfolio value history, research messages, notification history, and linked-account records within 30 days of verifying your request, except where retention is required by law or for the establishment or defense of legal claims. Backup copies are purged on our ordinary backup rotation.

Unlinking a brokerage account

When you unlink an account, we delete the associated holdings and connection information from our systems and stop retrieving data from that account. To revoke FiNode's authorization on Plaid's side, you may also use Plaid's portal at my.plaid.com or contact your financial institution directly.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• encryption of data in transit and at rest;
• network controls that keep production data stores inaccessible from the public internet;
• managed authentication with email and text-message verification;
• internal references rather than names or email addresses in operational records;
• access controls limiting employee access to production data to those with a business need.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk. If you believe your account has been compromised, contact us immediately at security@finode.ai.

We use cookies and similar technologies that are strictly necessary to operate the Service — principally to maintain your authenticated session and to remember your preferences. We do not use advertising cookies or third-party tracking for advertising purposes.

Because we do not sell personal information or share it for cross-context behavioral advertising, opt-out preference signals such as Global Privacy Control have no additional effect on our practices; there is no such sale or sharing to opt out of.

Most browsers allow you to refuse or delete cookies, though the Service may not function correctly without necessary cookies.

10.1 All users

Regardless of where you live, you may:

• access and update your account information and holdings within the Service;
• delete individual holdings or unlink a connected account;
• request deletion of your account and associated data;
• adjust or disable alert and briefing emails in your notification settings, or use the unsubscribe link in any such email;
• contact us with questions or concerns at privacy@finode.ai.

10.2 U.S. state privacy rights

Depending on your state of residence, you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
• Correct inaccurate personal information.
• Delete personal information we hold about you.
• Obtain a portable copy of personal information you provided to us.
• Opt out of sale, sharing for cross-context behavioral advertising, or profiling with legal or similarly significant effects — we do not engage in any of these activities.
• Limit use of sensitive personal information — we use sensitive personal information, including financial account information, only to provide the Service and for purposes permitted without a limitation right.
• Non-discrimination for exercising any of these rights.

To exercise these rights, email privacy@finode.ai or use the tools in your account settings. We will verify your identity using the email address associated with your account before acting on a request. You may use an authorized agent, subject to reasonable proof of authorization.

If we decline a request, you may appeal by replying to our response or writing to privacy@finode.ai with the subject line "Privacy Appeal." We will respond to appeals within the period required by applicable law.

We do not disclose personal information to third parties for their own direct-marketing purposes.

10.3 EEA, UK, and Swiss users

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing, as well as the right to lodge a complaint with your local supervisory authority. Contact us at privacy@finode.ai.

International transfers: we process and store personal information in the United States. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where appropriate. A copy of the relevant safeguards is available on request.

The Service is not directed to, and may not be used by, individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us information, contact us at privacy@finode.ai.

We do not disclose nonpublic personal financial information about you to nonaffiliated third parties except as permitted by law — specifically, to the service providers identified in Section 6.1, who perform services for us and who are contractually obligated to maintain confidentiality and to use the information only for the purposes for which it was disclosed.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice in the Service before the changes take effect. The "Last Updated" date above indicates when this policy was most recently revised. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

FiNode, Inc., a Delaware corporation. Email: privacy@finode.ai.