Privacy, Security & Data Protection

ClarInsight is a private wealth intelligence platform that consolidates your assets, liabilities, and investment portfolio into a single net-worth dashboard. Because we handle sensitive financial information, privacy and security are foundational to how the product is built. This page explains, in plain language, exactly what data we process, why, and how it is protected.

• Account & identity data: your email address and authentication credentials, used to sign you in and to deliver transactional service emails (authentication links, account notifications).
• Portfolio data: the accounts, holdings, transactions, balances, and goals you enter or import — including monthly net-worth snapshots used to chart performance over time.
• Wealth Recap profile: optional details you provide when generating a Wealth Recap (name, employment status, household composition, monthly income, and monthly debt figures). These are stored against your account to pre-fill future recaps and are never shared with third parties except to generate your AI-written summary (see section 7).
• Display preferences: non-sensitive settings such as your chosen display currency and theme.
• Email delivery records: a service-side audit log of transactional emails sent to you (template name, delivery status, timestamp). This log is accessible only to our backend infrastructure and is used solely to ensure reliable delivery and to honour unsubscribe requests.
• Advisor delegation data: if you invite a wealth manager to view or manage your portfolio (or accept such an invitation), we store the link between the two accounts, the access level you granted, and an audit trail of the actions a manager takes on your data. See section 8.
• Donation records: if you choose to support the project with a donation, the payment itself is handled by our payment processor (Stripe). We never receive or store your card details. See section 9.

We do not connect to or store credentials for your bank or brokerage. All portfolio figures are values you provide directly or extract from documents you choose to upload.

We process your data under two lawful bases of the EU General Data Protection Regulation (GDPR): performance of a contract (providing the service you signed up for) and your consent (for optional features such as AI document import and AI-generated narratives).

As a data subject you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data (or edit it directly in the app).
• Erasure — delete your account and all associated data.
• Portability — export your data in a machine-readable format.
• Restriction & objection — limit or object to certain processing.

We retain your data only for as long as your account is active. When you delete your account, your personal and portfolio data is removed from our systems. Email delivery audit records are retained for a limited operational period and are then purged automatically.

• Encryption in transit: every connection is protected with TLS (HTTPS), and HSTS is sent on every response to prevent protocol downgrade.
• Encryption at rest (infrastructure): the database storing your portfolio is encrypted on disk by our infrastructure provider.
• Application-layer encryption with per-user keys: on top of that, your sensitive free-text details — account and holding names, bank names, holder names, your notes, and the personal information in your profile (full name, date of birth, address, employment details) — are additionally encrypted by the application with AES-256-GCM before they are written to the database. Each user has their own unique encryption key, and that key is itself stored only in wrapped (encrypted) form under a master key that never resides in the database. As a result, a stolen database dump or backup is unreadable on its own. Because features such as your dashboards, AI summaries, and advisor access need the underlying values, our server decrypts them in memory while serving your session — this protects against database or backup theft rather than being end-to-end (zero-knowledge) encryption.
• Row-level isolation: strict row-level security policies enforce, at the database itself, that you can only ever read or write your own data (or data explicitly delegated to you) — no user can access another user's records.
• Defense-in-depth access control: every request resolves the account it is allowed to act on, which is then checked again at the database layer and once more in application logic before any write — so a single missed check cannot expose data.
• Rate limiting: sensitive operations (AI document import, advisor invitations, and account deletion) are throttled per user to limit abuse, in addition to edge-level rate limiting.
• Scrubbed logging: all server-side logging passes through a central redaction layer that strips tokens, credentials, keys, and email addresses, so sensitive data is never written to our logs. Errors shown to you are generic; technical details stay server-side.
• Hardened response headers: every response carries a Content-Security-Policy, anti-clickjacking and MIME-sniffing protections, a strict referrer policy, and a restrictive permissions policy.

• Hashed passwords: authentication is managed by our backend provider; passwords are salted and hashed (bcrypt) and are never seen or stored by our application code.
• Strong-password & breach checks: new passwords must be at least 12 characters, and passwords found in known data breaches are rejected.
• Email confirmation & MFA: email confirmation is required, and you can enable two-factor authentication (TOTP) for an additional layer of protection.
• Authenticated access: all application data is served through authenticated, server-side checks tied to your verified session.

When you use AI Import to extract data from a PDF statement, the document is given the strongest protection in the platform and is never stored:

• Encrypted in your browser: before it leaves your device, the PDF is wrapped in a single-use AES-256-GCM envelope using a freshly generated, ephemeral key — layered on top of the TLS connection.
• Decrypted in memory only: the server decrypts the document in memory, validates it, forwards it to the AI engine, and then immediately discards it. It is never written to a database, storage bucket, or disk.
• Keys discarded after use: the single-use encryption key and the plaintext buffer are zeroized right after the request completes.
• Never logged: document contents and keys are never written to logs.

ClarInsight uses AI in two opt-in features, both powered by Google Gemini 2.5 Flash through the Lovable AI Gateway. In neither case is your data retained by the AI provider or used to train AI models.

• AI Import: the contents of a PDF statement you upload are sent to Gemini for a single extraction request, processed in memory, and immediately discarded. See section 6 for the full security model.
• Wealth Recap narrative: when you generate a Wealth Recap, the financial figures you have entered (net worth, asset breakdown, income, debt ratios, and the optional borrower details from your Recap profile) are sent to Gemini to produce a professional written summary. Only aggregated figures are transmitted — no raw transaction history or document contents. The generated text is returned to your browser, rendered in the PDF that you download, and is not stored on our servers.

ClarInsight lets you share your portfolio with a trusted wealth manager (or, if you are an advisor, lets a client share theirs with you). This feature is entirely opt-in and built so that you stay in control:

• Explicit, token-based invitations: a delegation only exists once an invitation is accepted. Invitations are sent to a specific email address with a unique link and automatically expire if not accepted within 14 days.
• Granular access levels: you choose whether a manager has read-only access (view your data) or read-write access (make changes on your behalf). You can change the level or revoke access entirely at any time.
• Enforced at the database: the same row-level security that isolates users also governs delegated access, so a manager can only ever reach data for clients who have explicitly granted it.
• Full audit trail: a manager always stays signed in as themselves, and every action they take on your data is recorded in an audit log so the change history remains attributable.

ClarInsight is supported in part by optional, voluntary donations. If you choose to donate, payment is handled entirely by Stripe, our PCI-DSS-compliant payment processor, through its hosted checkout page.

• We never see your card details: card numbers and payment credentials are entered on Stripe's checkout and are never transmitted to or stored on our servers.
• Minimal data shared: we pass only what is needed to create the checkout session (such as the amount and your email address for the receipt).

ClarInsight sends transactional emails for account operations (sign-in links, password resets, and similar authentication flows). To ensure reliable delivery and to respect your communication preferences, we maintain:

• Delivery audit log: a record of emails sent to you, including the template type, delivery status, and timestamp. This log is only accessible to our backend infrastructure (not to any user) and is used to detect delivery failures and prevent duplicate sends.
• Suppression list: if you unsubscribe, or if a message bounces or generates a complaint, your email address is added to a suppression list so we do not send further non-essential messages. This record is append-only — it cannot be removed by any automated process — to ensure your preference is permanently honoured.
• Unsubscribe tokens: each non-essential email includes a one-click unsubscribe link backed by a unique token. Clicking it records your preference immediately, without requiring you to log in.

Authentication emails (sign-in links, password resets) are always sent because they are essential to accessing the service. Non-essential emails (feature announcements, etc.) can be opted out of at any time.

We rely on a small number of trusted infrastructure providers:

• Cloud backend provider — hosting, authentication, encrypted database, and transactional email delivery.
• Lovable AI Gateway — AI inference for optional document extraction and Wealth Recap narrative generation.
• Stripe — payment processing for optional donations (see section 9). Card details are handled solely by Stripe.

We do not sell, rent, or share your personal or financial data with advertisers or data brokers.

We use only essential, functional cookies required to keep you signed in and to remember your preferences. We do not use third-party advertising or cross-site tracking cookies.

For any privacy request — access, correction, deletion, or questions about this page — contact our data controller at privacy@clarsight.app.