Privacy Policy

Neufin Inc. (“Neufin”, “we”, “us”) operates the Neufinweb application and mobile app (collectively, the “Service”). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the choices you have.

By using Neufin you agree to this policy. If you do not agree, please stop using the Service.

2.1 Portfolio CSV files

When you upload a CSV file, we read the symbol and shares columns to compute your Investor DNA Score. This file is processed in memory and is never stored on our servers in its raw form. We store only the aggregated result (score, investor type, recommendations) linked to a random share token.

2.2 Account data (optional)

If you create an account, we collect your email address via Supabase Auth. You may also optionally provide your name and firm name if you use the advisor features. Account creation is not required to use the core DNA analysis.

2.3 Analysis history

For authenticated users, we store your DNA score history in our Supabase database so you can access it across devices. Each record contains: DNA score, investor type, recommendation, portfolio total value, and a share token. Individual position data (symbols and share counts) is not retained after analysis.

2.4 Usage analytics

We collect anonymised, first-party usage events (e.g. “upload started”, “checkout clicked”) to understand how the product is used and improve it. These events do not contain personal information or portfolio data. We do not use Google Analytics or Meta Pixel.

2.5 Payment information

Payments are processed entirely by Stripe. Neufin never sees or stores your full card number, CVV, or bank details. Stripe may collect billing address and card metadata per their own Privacy Policy.

2.6 Referral tokens

If you arrive via a referral link, we store the referral token in your browser’s localStorage to apply a discount at checkout. This token is a random 8-character string tied to the referrer’s share record, not their identity.

• Providing the Service — to compute your Investor DNA Score and generate advisor PDF reports.
• AI Analysis — your anonymised portfolio metrics (total value, score, position weights) are sent to AI providers (Anthropic Claude, Google Gemini, OpenAI, Groq) to generate insights. Raw symbol lists are included in AI prompts but are not stored by us after the request.
• Market price data — we query Finnhub and Alpha Vantage with your stock symbols to fetch current prices. These queries are server-side; your symbols are not exposed to other users.
• Email communications — if you subscribe to the weekly digest, we send you a periodic email with your latest DNA score context. You can unsubscribe at any time.
• Security and fraud prevention — to detect and prevent abuse of the platform.

We share data with the following sub-processors:

All AI providers are bound by data processing agreements and do not use your data to train their models under their API terms.

• Anonymous analyses (no account) are retained for 90 days, then automatically deleted.
• Account DNA history is retained as long as your account is active.
• PDF reports stored in Supabase Storage are accessible for 1 year via signed URL, then archived.
• Analytics events are retained for 12 months in aggregated form.
• Email subscriptions are retained until you unsubscribe or request deletion.

You have the right to access, correct, export, or delete your personal data at any time.

• Delete your Vault data — sign in, go to /vault, and use the account settings to delete your history. This removes all DNA score records associated with your account from our database.
• Delete your account — email privacy@neufin.app with the subject “Delete my account”. We will process your request within 30 days.
• Export your data — email privacy@neufin.app to request a JSON export of all data we hold about you.
• Unsubscribe from emails — click the unsubscribe link in any email, or email us.

Neufin does not use advertising cookies or cross-site tracking. We use browser localStorage for:

• dnaResult — your most recent DNA analysis result (cleared when you start over)
• ref_token — referral token from a ?ref= URL parameter
• pendingReportId — tracks a paid report waiting for PDF generation
• neufin-auth — Supabase session token (for authenticated users)
• neufin_session_id — anonymous session ID for analytics (tab-scoped)

None of this data is shared with third parties. You can clear it at any time via your browser’s developer tools.

Neufin is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us data, contact us at privacy@neufin.app and we will delete it promptly.

All data in transit is encrypted via TLS 1.2+. Data at rest in Supabase is encrypted using AES-256. We use Row Level Security (RLS) policies to ensure users can only access their own records. PDF reports are stored in a private Supabase Storage bucket and accessed only via time-limited signed URLs.

No security system is perfect. If you discover a vulnerability, please disclose it responsibly to privacy@neufin.app.

We may update this policy as the product evolves. Material changes will be announced by updating the “Effective date” at the top and, for registered users, by email. Continued use of the Service after changes constitutes acceptance.

For any privacy questions, data requests, or concerns: