Privacy Policy

Version 2026-08-14. This policy explains what personal data InvestLab (the “Service”) collects, why, who processes it, and what rights you have. The Service is operated by Stephane Renevier (“we”, “us”) — contact stephane@investlab.app for anything privacy-related, including exercising the rights below.

1. What we collect

Account data. Your email address and a password. Authentication is handled by Supabase; your password is stored only in hashed form and we never see it.
Content you create. Strategies, satellites, portfolios, backtest configurations, and analysis inputs you save or run — including, if you use Portfolio X-Ray or Portfolio Construction, the holdings and weights you enter.
Communications. Emails you send us, demo or contact requests you submit, and — if you subscribe — your newsletter subscription email.
Usage data. Aggregate page-view analytics via Vercel Web Analytics, which per Vercel’s documentation does not use cookies or track individuals across sites.

We do not collect financial account numbers, brokerage credentials, government identifiers, or payment card details, and we do not ask for them.

2. Cookies

The Service uses only strictly-necessary cookies: the authentication/session cookies set by Supabase that keep you signed in. We do not use advertising cookies or cross-site tracking cookies.

3. How we use your data

to provide the Service: authenticate you, store your work, and compute the analyses you request;
to respond when you contact us or request a demo;
to send the newsletter, if you subscribed (you can unsubscribe at any time);
to keep the Service secure and prevent abuse;
to understand aggregate usage and improve the Service;
to comply with legal obligations.

Where GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, aggregate analytics, improving the Service), consent (newsletter), and legal obligation.

4. AI processing of your inputs

Some analyses include written narratives generated by artificial-intelligence models. If you use Portfolio X-Ray, the portfolio details you enter (tickers, weights, and the statistics we derive from them) are sent to Anthropic, our AI provider, to generate the written analysis. Market commentary elsewhere on the Service is generated from market data, not from your personal data. We do not send your email address or account details to AI providers.

5. Who processes your data

We do not sell personal data, and we do not share it with advertisers or data brokers. We use the following service providers (processors) to run the Service:

Supabase — authentication and database (accounts, saved work).
Vercel — web hosting and cookie-free aggregate analytics.
Railway — hosting for the computation API.
Anthropic — AI-generated analysis narratives (section 4).
Kit — newsletter delivery, if you subscribed.
Calendly — scheduling, if you book an intro call (their site, their privacy policy).

We may also disclose data where required by law, or as part of a sale or reorganisation of the Service (in which case this policy continues to apply to it).

6. International transfers

Some of the providers above process data in the United States or other countries outside the UK/EEA. Where they do, we rely on the safeguards those providers offer for international transfers (such as Standard Contractual Clauses or an adequacy framework, per each provider’s data-processing terms).

7. Retention

Account data and the content you create are kept while your account exists. If you ask us to delete your account, we delete your personal data within 30 days except where we must keep it to comply with law or resolve disputes. Newsletter data is kept until you unsubscribe. Aggregate analytics contain no personal identifiers.

8. Your rights

Depending on where you live (including under GDPR, UK GDPR, and similar laws such as the CCPA), you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to our processing of it, and to withdraw consent where processing is based on consent. To exercise any of these, email stephane@investlab.app. If you are in the UK or EEA you also have the right to complain to your data-protection supervisory authority.

9. Children

The Service is not directed at children and is intended for users aged 18 or over. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

When we change this policy, the version date above changes. Material changes will be signposted in the Service. Continued use after a change means the updated policy applies.