Privacy Policy

This policy explains what personal data Chart AI collects, why we collect it,
who we share it with, and the choices you have. It sits alongside our
Terms of Service, which govern your use of the product.

1. Who we are

Chart AI is operated by GENZCRAZE (Private) Limited ("we", "us"), the
controller of the personal data described here. The service is available at
https://chartaianalysis.com.

2. What this policy covers

This policy applies to the Chart AI website, web application, and any companion
mobile application, together with the accounts, uploads, analyses, and billing
records created through them. It does not cover third-party sites we link to,
which run their own policies.

3. Information we collect

Account data. Your email address, display name, and avatar URL. If you sign
in with Google, the name and avatar come from your Google profile. Sign-in is
handled by Supabase Auth, using either an email and password or Google OAuth.

Onboarding and preferences. The answers you give during onboarding — your
trading style, primary market, and experience level — plus interface
preferences such as theme, accent colour, density, and language.

Content you create. Chart images you upload, the analyses generated from
them, chat threads and messages, watchlist items, and in-app notifications.
Uploaded images are held in a private storage bucket and are served only
through short-lived signed URLs.

Billing data. Your subscription plan, credit balances, and a full ledger of
credit transactions. Payments are processed by Stripe. Card numbers never
reach Chart AI servers — we store only a Stripe customer identifier and the
subscription and price identifiers tied to your plan.

Technical data. Standard request data needed to operate and secure the
service, such as IP address, browser and device information, and server logs.

4. How we use it

We use this data to create and authenticate your account; to generate and store
chart analyses and chat replies; to keep your watchlist, notifications, and
preferences in sync; to meter credits, run subscriptions, and issue receipts; to
diagnose faults, prevent abuse, and keep the service secure; and to answer
support requests you send us. We do not sell your personal data, and we do not
use your uploads to advertise to you.

5. Legal bases

Where the GDPR or UK GDPR applies, we rely on: performance of a contract
for running your account, producing analyses, and taking payment;
legitimate interests for security, abuse prevention, and product
reliability; consent for optional analytics cookies, which you can withdraw by
blocking or clearing cookies in your browser; and legal obligation for tax and accounting records.

6. Who we share it with

We share data with a small set of processors that run the service on our
behalf, each limited to what its job requires:

• Supabase — database, authentication, and file storage.
• Vercel — hosting and serverless execution of the application.
• Stripe — payment processing, subscriptions, and billing records.
• Google — OAuth sign-in if you choose it, and Google Tag Manager for
  analytics.
• GraphAI — our AI analysis provider. Chart images you upload and the
  messages you send in chat are transmitted server-side to GraphAI so it can
  produce the analysis or reply you asked for.

We may also disclose data where we are legally required to, or to establish or
defend legal claims. If the business is ever transferred, your data may move
with it under this policy.

7. Cookies and local storage

Authentication cookies set by Supabase keep you signed in; they are essential
and the product cannot work without them. Google Tag Manager may set analytics
cookies to measure how the site is used. Your browser's local storage holds
interface preferences and "don't ask again" flags for confirmation dialogs —
nothing more. You can clear cookies and local storage in your browser at any
time, though clearing the session cookies will sign you out.

8. Data retention and deletion

We keep your data for as long as your account is active. There is currently
no self-serve account deletion. To have your data deleted or exported, send a
request through our Contact page; we will honour it within a
reasonable period. Some records must be retained afterwards where law requires
it — for example, transaction records held by Stripe for tax and accounting
purposes.

9. Your rights

Depending on where you live, you may have the right to access the personal data
we hold about you, correct it, delete it, receive a portable copy, object to or
restrict certain processing, and withdraw consent you previously gave. Under the
GDPR and UK GDPR you may also lodge a complaint with your supervisory
authority. Under the CCPA, California residents may request disclosure of the
categories of personal information collected and request its deletion; we do not
sell or share personal information as those terms are defined there, and we will
not discriminate against you for exercising any of these rights.

To exercise any right, use the Contact page. We may need to verify
your identity before we act. This section describes how we handle requests; it
is not legal advice.

10. Children

Chart AI is not directed at anyone under 18, and we do not knowingly collect
personal data from children. If you believe a child has given us data, contact
us and we will delete it.

11. International transfers

Our processors operate globally. Your data may be stored and processed in the
United States and in other countries where those providers run infrastructure.
Where personal data leaves the UK or EEA, we rely on the transfer mechanisms our
processors have in place, such as standard contractual clauses.

12. Security

Traffic to and from Chart AI is encrypted in transit. Row-level security is
enforced in the database, so your records are readable only by your own account.
Chart uploads live in a private bucket reachable only through short-lived signed
URLs, and server-side secrets and privileged keys are never exposed to the
browser. No system is perfectly secure, but we work to keep the risk low.

13. Changes to this policy

We may update this policy as the product changes. When we do, we revise the
effective date at the top of this page, and we will give notice in the app for
changes that materially affect you.

14. Contact

For any privacy question, or to make an access, correction, deletion, or export
request, reach us through the Contact page.