Privacy Policy

1. Introduction

MOTU.ai, Inc. (“Company,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our website, platform, and related services (collectively, the “Service”). By using the Service, you consent to the practices described herein.

2. Information We Collect

2.1 Account Information

• Full name and email address at registration
• Organization name and role (optional)
• Authentication credentials (managed by Supabase Auth; we do not store passwords directly)
• Profile preferences (watchlists, alert settings, display preferences)

2.2 Billing Information

• Payment card details (processed and stored by Stripe; we do not store full card numbers)
• Billing address and invoice history
• Subscription plan and billing cycle

2.3 Usage Data

• Pages visited, features used, and time spent on the platform
• Search queries, stock lookups, and MOTU profile views
• Watchlist and alert configuration activity
• API request logs (Enterprise users)

2.4 AI Assistant Interactions

• Queries submitted to the “Ask MOTU” research assistant
• Conversation history within a session (not retained after session ends unless you save it)
• Context provided to the assistant (e.g., current page, selected manager or stock)

2.5 Device and Technical Data

• IP address, browser type, operating system, and device identifiers
• Referring URL and pages visited before and after the Service
• Cookies, local storage, and similar tracking technologies (see Section 6)

3. How We Use Your Information

• Service Delivery: Provide, maintain, and improve the platform, including MOTU Scores, stock analytics, and alerting features
• Billing: Process subscription payments, issue invoices, and manage account status
• Communication: Send transactional emails (account confirmations, billing receipts, security notices) and, with your consent, product updates
• Analytics: Analyze usage patterns to improve the platform, optimize performance, and develop new features
• Security: Detect, investigate, and prevent fraudulent activity, abuse, and unauthorized access
• Legal Compliance: Fulfill legal obligations, respond to lawful requests, and enforce our Terms of Service

4. Information Sharing and Disclosure

We do not sell your personal information. We do not share your data with third parties for their marketing purposes.

We may share information only in these circumstances:

• Service Providers: With vendors who process data on our behalf (e.g., Supabase for authentication and data storage, Stripe for payments, Vercel for hosting, Polygon.io for market data). These providers are contractually bound to use data only for the services they provide to us.
• AI Providers: When you use the “Ask MOTU” research assistant, your queries may be sent to third-party AI language model providers to generate responses. These providers process query text only and do not receive your account information, billing details, or browsing history. We select providers that do not use customer inputs to train their models.
• Legal Requirements: When required by law, subpoena, court order, or regulatory request
• Safety: When we believe disclosure is necessary to protect the rights, property, or safety of MOTU.ai, our users, or the public
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case you will be notified
• With Your Consent: When you explicitly authorize sharing for a specific purpose

5. Financial Data Handling

MOTU.ai processes publicly available financial data (SEC 13F filings, market data) to generate analytics. Important clarifications:

• We do not collect or store your personal brokerage account information
• We do not have access to your personal investment portfolio
• Watchlists and alerts you create are stored on our servers and associated with your account
• MOTU Scores and rankings are derived from public data and proprietary algorithms, not from user data

6. AI-Powered Features

MOTU.ai includes an AI research assistant (“Ask MOTU”) that uses third-party large language models to answer questions about institutional investor data, stock analytics, and platform features. Important disclosures:

• AI responses are generated by machine learning models and may contain inaccuracies, incomplete information, or errors
• AI responses do not constitute investment advice, financial advice, or any professional recommendation
• Query text is sent to third-party AI providers for processing; we do not send your personal account details, billing information, or browsing history
• We do not use your queries to train AI models
• Conversation history is session-based and is not permanently stored unless you explicitly save or export it

7. Cookies and Tracking Technologies

We use the following categories of cookies:

• Essential: Required for authentication, session management, and security. Cannot be disabled.
• Functional: Remember your preferences (theme, layout settings, watchlist view). Can be disabled.
• Analytics: Help us understand usage patterns and improve the Service. Can be disabled.

We do not use advertising or retargeting cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

8. Data Security

We implement industry-standard security measures, including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest (Supabase)
• Authentication managed by Supabase Auth with industry-standard credential security
• Row-level security policies on all database tables
• Role-based access controls for internal systems
• Infrastructure hosted on SOC 2 compliant providers (Vercel, Supabase)

No system is 100% secure. If you become aware of a security vulnerability, please report it immediately to security@motu.ai.

9. Data Retention

• Account data: Retained for the duration of your account plus 30 days after deletion request
• Billing records: Retained for 7 years to comply with tax and financial reporting obligations
• Usage logs: Retained for 12 months, then aggregated and anonymized
• API logs (Enterprise): Retained for 90 days
• Support correspondence: Retained for 3 years

Upon account deletion, personal data is purged within 30 days. Anonymized, aggregated data may be retained indefinitely for analytics purposes.

10. Your Rights

10.1 All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated personal data
• Export: Request a machine-readable export of your data (JSON format)
• Opt-out: Unsubscribe from non-essential communications at any time

10.2 California Residents (CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

10.3 European Users (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation:

• Right to restrict processing of your data
• Right to object to processing based on legitimate interests
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@motu.ai. We will respond within 30 days.

11. International Data Transfers

MOTU.ai is based in the United States. If you access the Service from outside the U.S., your data may be transferred to and processed in the U.S. We use Standard Contractual Clauses (SCCs) and other appropriate safeguards to protect international transfers as required by applicable law.

12. Third-Party Links

The Service may contain links to third-party websites (e.g., SEC EDGAR, stock exchanges, news sources). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies independently.

13. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from a minor, we will delete it promptly. Contact us at privacy@motu.ai if you believe a minor has provided us with personal information.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered users and by posting an updated version with a revised effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy: