Privacy Policy

Effective date: July 19, 2026
Last updated: July 19, 2026

Cetagon (“Cetagon,” “we,” “us,” or “our”) provides a planning, analysis, and rule-management service for individual investors. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have. By creating an account or otherwise using the service (the “Service”), you confirm that you have read and understood this Policy.

Plain-English summary. We collect the information you give us (account details, investor profile, tax profile, portfolio data, and rules) and the information needed to run the Service (AI request logs, usage events, billing records, brokerage sync metadata, and security logs). We use that information to operate Cetagon, generate AI suggestions, support you, and improve the product. We do not sell your personal information, we do not show third-party ads, and we share your data only with the service providers listed below who help us run the Service.

1. Who we are and how to contact us

Cetagon is the operating name of Cetagon Inc., a corporation incorporated under the Canada Business Corporations Act and based in the Province of Ontario, Canada. For any privacy-related questions, requests, or complaints, contact us at info@cetagon.com. We will respond within thirty (30) days, or sooner where required by applicable law.

2. Information we collect

2.1 Information you provide directly

Account information: email address, first and last name, and (if you sign in with Google) the OAuth provider identifier and basic profile claims.
Investor profile: birth year, employment status, number of dependents, income band, net-worth band, investment time horizon, primary investing goal, risk tolerance, drawdown tolerance, self-reported investing experience, and self-rated investing knowledge.
Tax profile: country of tax residence, state or province, filing status, estimated annual income band, and self-estimated marginal tax rate.
Portfolio data: ticker symbols, share quantities, cost basis, purchase dates, account types (e.g., taxable, IRA, TFSA, RRSP), and institution names, obtained from the brokerage accounts you connect through SnapTrade (see Section 2.3).
Rules and preferences: the planning rules, thresholds, watchlists, universes, notification settings, and scenarios that you create within the Service.
Communications: any content you send us by email or in support channels.
Marketing preferences: whether you have opted in to product update emails.

2.2 Information generated when you use the Service

AI interactions: the prompts you send (which may include portfolio and profile context the Service constructs on your behalf), the responses generated, the model used, token counts, latency, cache-hit status, and error codes. These are stored in our ai_request_logs table.
Usage telemetry: events related to your interactions with the rule builder, critiques, triggers, and other features; session identifiers; the properties attached to each event. Stored in our user_events table.
Device and connection metadata: IP address, browser user-agent, and approximate timing of requests for security and abuse prevention. We do not build marketing profiles from this data.
Billing data: subscription plan code, status, trial dates, invoice metadata, opaque customer and subscription identifiers issued by our billing provider, and ledger entries. We do not store full payment card numbers.

2.3 Information from third parties

Identity providers: if you sign in with Google, we receive the profile claims listed in Section 2.1.
Market data: we obtain end-of-day and intraday market data from third-party data vendors. This data is not personal to you.
Brokerage connectivity: when you connect a brokerage account through SnapTrade, we receive read-only holdings, balances, and transaction history from that account. You initiate and authorize each connection through SnapTrade’s consent flow, and you can disconnect at any time to stop further syncing.

3. How we use information

We use personal information to:

create and maintain your account, authenticate you, and operate the Service;
generate AI-assisted suggestions, critiques, and analyses based on your inputs;
display your portfolio, rules, scenarios, and related calculations back to you;
sync read-only brokerage data if you choose to connect a supported brokerage;
send rule alerts through your selected in-app and email notification settings;
provide customer support and respond to your inquiries;
improve, debug, and secure the Service, including detecting fraud and abuse;
send transactional emails (e.g., account verification, password reset, billing receipts), these are not optional while you maintain an account;
send product update and marketing emails, if you opted in (you can unsubscribe at any time using the link in those emails);
comply with our legal, tax, and regulatory obligations.

We do not sell your personal information, we do not use your portfolio or AI prompts to train third-party machine-learning models, and we do not share information with advertising networks.

4. Legal bases for processing

For users to whom Canadian privacy law applies (PIPEDA, Quebec’s Law 25, and other provincial statutes), we process personal information on the basis of your meaningful consent given when you create an account and use the Service, subject to the additional purposes set out above. You may withdraw your consent at any time as described in Section 10, although doing so may mean we can no longer provide some or all of the Service.

For users to whom U.S. state privacy laws apply (e.g., California, Colorado, Virginia), we process personal information to perform the contract you have entered into with us, to pursue our legitimate interests in operating and improving the Service in a way that does not override your rights, and to comply with law.

5. AI processing disclosure

When you ask the Service for an AI-generated suggestion, critique, or explanation, we send a prompt to Anthropic, PBC(the operator of the Claude family of large language models). That prompt may include the portfolio data, rules, and investor-profile context that the Service constructs on your behalf. Anthropic processes that prompt as our sub-processor under its commercial terms; Anthropic does not use your prompts to train its models. You can review Anthropic’s privacy practices at anthropic.com/legal/privacy.

AI suggestions are produced by a probabilistic model. They can be wrong, out of date, or inappropriate for your circumstances. They are not financial, legal, tax, or accounting advice. Please do not paste unrelated sensitive personal information (such as government identifiers or medical data) into free-form prompts; we do not need it to operate the Service.

We share personal information only with the following categories of recipients, and only as necessary to operate the Service:

Supabase, Inc., authentication, database, and storage hosting (United States). Personal information is stored in encrypted PostgreSQL databases under our control with row-level security enabled.
Anthropic, PBC, AI inference processing (United States). See Section 5.
Resend, Inc., transactional and (if you opted in) marketing email delivery (United States).
Paddle.com Market Limited, payment processing and subscription management (Ireland and United States), if you subscribe, start a trial, manage a subscription, or request billing support.
SnapTrade (Passiv Technologies Inc.), brokerage account connectivity (Canada and United States), once you choose to connect a brokerage account.
Vercel Inc., application hosting and edge networking (United States).
Inngest, Inc., durable background-job and scheduling platform (United States) that processes event payloads, such as portfolio-sync and alert jobs, which may reference your account.
Upstash, Inc., managed Redis used for caching, rate limiting, and short-lived session state (United States).
Professional advisors, accountants, auditors, and legal counsel under duties of confidentiality, where reasonably necessary.
Authorities, when we are required to do so by valid legal process, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of any person.
Successors, a buyer or successor entity in connection with a merger, financing, acquisition, or sale of assets. We will notify you and any new entity will remain bound by this Policy unless and until it is amended.

We do not engage in “sales” or “sharing” of personal information for cross-context behavioural advertising as those terms are defined under California law.

7. Cookies and similar technologies

We use only the cookies and storage that are strictly necessary to operate the Service:

Authentication cookies set by Supabase, which keep you signed in and rotate refresh tokens securely.
Session storage in your browser, which holds a short-lived session identifier so we can group related telemetry events together.
Theme preference stored locally so the Service remembers your light or dark mode choice.

We do not use third-party advertising or cross-site tracking cookies, and we do not run third-party analytics scripts in the application. When you open a Paddle checkout or subscription-management flow, Paddle may load its own scripts or set cookies as necessary to complete payment and fraud-prevention workflows. Because Cetagon does not use cookies for marketing or behavioural profiling, no cookie consent banner is shown. If we add any non-essential cookies in the future, we will request your consent first where required.

8. Data retention

Account and profile information: retained for as long as your account is active, then deleted within ninety (90) days of account closure (subject to backup rotation).
Portfolio data, rules, and scenarios: retained for the life of the account; deleted on the same timeline as the account.
AI request logs: retained for up to twelve (12) months for service quality, abuse prevention, and debugging, after which prompt and response payloads are deleted and only aggregate, non-identifying metadata is kept.
Usage telemetry: retained for up to twenty-four (24) months in identifiable form, then aggregated or deleted.
Billing and tax records: retained for seven (7) years where required by U.S. and Canadian tax law.
Security and access logs: retained for up to twelve (12) months.

We may retain information for longer where required by law, where it is necessary to establish, exercise, or defend legal claims, or where it has been irreversibly de-identified.

9. International data transfers

Cetagon is operated from Ontario, Canada. Most of our service providers store and process personal information in the United States. When we transfer personal information across borders, we rely on the providers’ contractual commitments (including standard contractual clauses where appropriate) and on your consent given through this Policy. By using the Service, you understand that your information may be processed in countries whose data-protection laws differ from those of your home jurisdiction.

10. Your rights and choices

Subject to verification of your identity and to limitations set out in applicable law, you may:

Access the personal information we hold about you and request a copy in a portable, machine-readable format;
Correct personal information that is inaccurate or incomplete (most fields can be edited directly inside the Service);
Delete your account and the personal information associated with it, subject to retention obligations described above;
Withdraw consent to the processing of your personal information (Canadian users), or object to or restrict processing (EU/UK users, if applicable); note that withdrawing consent may prevent us from providing the Service;
Opt out of product marketing emails at any time using the unsubscribe link in those emails or by emailing us;
Designate an authorized agent to submit a request on your behalf (California residents);
Appeal a denial of your privacy request (residents of states that provide such a right, including Virginia and Colorado).

To exercise any of these rights, email info@cetagon.com. We will not discriminate against you for exercising your rights.

If you are not satisfied with our response, you may also lodge a complaint with:

the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial privacy regulator (e.g., Commission d’accès à l’information du Québec); or
for U.S. residents, your state attorney general or the privacy authority designated by your state.

11. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These include: transport encryption (TLS), at-rest encryption of database and storage volumes, row-level security policies, scoped service-role credentials, encrypted broker-connection secrets where applicable, separate development and production environments, and principle-of-least-privilege access for personnel. No method of transmission or storage is completely secure; we encourage you to use a strong, unique password and to enable multi-factor authentication where available.

12. Children

The Service is intended for adults aged eighteen (18) or older. We do not knowingly collect personal information from anyone under 18 (or under 13 in jurisdictions where that lower threshold applies under U.S. federal law). If you believe that a minor has provided us with personal information, please contact us at info@cetagon.com and we will take steps to delete it.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Effective date” at the top of this page, post the revised Policy in the Service, and (where required by law or where the change materially affects you) notify you by email or via an in-app notice at least fifteen (15) days before the change takes effect. Your continued use of the Service after the effective date constitutes your acceptance of the revised Policy.

14. Contact us

Questions, requests, or complaints about this Policy or our handling of your personal information can be sent to:

Cetagon Inc.
2016-30 Greenfield Ave
North York, ON M2N 6N3
Canada
Email: info@cetagon.com