Privacy Policy

This Privacy Policy describes how Pemabu (“we,” “us”) collects, uses, and shares information when you use our website, applications, and related services (the “Service”). It applies to visitors, beta users, and paying subscribers. By using the Service, you agree to this Policy and our Terms of Service.

Account information: email address, authentication identifiers, and profile settings stored via Supabase Auth.

Portfolio data: holdings, quantities, tickers, assumptions, signals, briefs, and related metadata you enter or import.

Payment information: processed by Stripe; we receive subscription status, customer IDs, and transaction metadata—not full card numbers.

Usage and technical data: IP address, browser type, device information, logs, and cookies or similar technologies needed for sessions and security.

Optional execution data: if you use sovereign/vault features, exchange API credentials may be encrypted and stored in your chosen deployment; cloud mode does not require exchange keys for core workbook features.

AI interactions: prompts and outputs sent to Anthropic for briefs, explanations, and Strategy Council memos may include portfolio context you trigger.

We use information to:

• Provide, maintain, and improve the Service;
• Authenticate users and enforce tier entitlements;
• Calculate allocations, scores, signals, and drift alerts;
• Process payments and marketplace unlocks;
• Send operational emails (e.g., briefs, alerts) when enabled;
• Monitor abuse, fraud, and security incidents; and
• Comply with legal obligations.

Pemabu does not sell your personal information. We do not use portfolio data to provide investment advice.

We share data with processors that help operate the Service, including:

• Supabase — authentication and database hosting;
• Stripe — payment processing;
• Anthropic — AI-generated summaries when you request them;
• Resend (or similar) — transactional email delivery;
• Market data providers — ticker symbols you request for quotes; and
• Hosting providers — application delivery (e.g., Vercel) and optional self-hosted vault infrastructure you control.

These providers process data under their own terms and our instructions where applicable.

Published marketplace strategies may display pseudonymous publisher labels and performance metrics derived from platform data—not your legal name unless you choose to display it. Family-sharing tokens let you grant read-only access to selected portfolio views; you control token creation and revocation.

We retain account and portfolio data while your account is active and for a reasonable period afterward for backup, legal, and audit purposes. You may request deletion subject to legal retention requirements and technical constraints (e.g., immutable audit logs in sovereign deployments).

We use industry-standard measures including encryption in transit, row-level security in our database, and restricted access to production systems. No method of transmission or storage is 100% secure; you use the Service at your own risk.

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Contact contact@pemabu.com to exercise these rights. California residents may have additional rights under the CCPA/CPRA; we do not sell personal information as defined by those laws.

If you access the Service from outside the United States, you understand that data may be processed in the U.S. and other countries where our providers operate, which may have different data protection laws than your jurisdiction.

The Service is not directed to children under 18. We do not knowingly collect data from children.

We may update this Policy by posting a revised version with a new “Last updated” date. Material changes may be communicated via email or in-product notice where appropriate.

Privacy inquiries: contact@pemabu.com. See also our Investment Disclaimer.