Privacy policy

ALB Equity is the name of the service at alb-equity.com. The controller of the personal data described here is the company below.

• Controller

  Detail

  [Legal entity name — to be completed]

• Registered address

  Detail

  [Registered address — to be completed]

• Registration number

  Detail

  [Company registration and VAT number — to be completed]

• Privacy contact

  Detail

  privacy@alb-equity.com

This policy covers the public website, the signed-in web app, the access-request form and the AI connector at https://alb-equity.com/mcp. It does not cover the AI assistants you connect to ALB Equity: those are separate services with their own policies (see section 4).

• Account data. Your work e-mail address, your name and your sign-in credentials. Accounts are created by invitation: your employer or ALB gives us your name and e-mail address to set the account up. A password is held only as a hash by our authentication provider; we never see it.
• Access-request form. The name, work e-mail, firm, role and free-text message you type. Sending it does not create an account.
• Content you create. Saved portfolios (a name, a list of securities and, optionally, the style weights used) and saved reports (a name, a client-name field, the report content and a reference date). These are the free-text fields you type, so please do not enter personal data of other people in them, such as the name of an individual end client. ALB Equity is a professional research tool and is not meant to hold client data.
• AI connector data. If you connect an AI assistant: the OAuth tokens that identify your account and that assistant; the arguments of each tool call the assistant makes (for example tickers, a sector, a search text, a release version, and, when you allow saving, the name and securities of a new list); and the audit log of those calls (section 4).
• Technical data. IP address, browser type and request times, processed by our hosting and security providers to deliver the service and keep it safe.

The model data itself (rankings, deciles and scores of listed companies) is not personal data. We do not ask for special categories of personal data, and we use no advertising or cross-site tracking. Our hosting provider counts page visits and measures page speed, as described in section 10.

• Run your account and the web app: sign-in, saved portfolios and reports, release data

  Data

  Account data, content you create, technical data

  Legal basis (GDPR)

  Performance of a contract (Art. 6(1)(b)); for users acting for a business customer, our legitimate interest in giving them the service they are entitled to (Art. 6(1)(f))

• Operate the AI connector when you ask an assistant to use it

  Data

  OAuth tokens, tool arguments, content you ask it to save

  Legal basis (GDPR)

  Performance of a contract (Art. 6(1)(b)), and your own request to connect the assistant

• Keep the service secure and reliable: audit log, rate limits, abuse prevention, fixing errors

  Data

  Audit log, technical data, OAuth tokens

  Legal basis (GDPR)

  Legitimate interest in the security and stability of the service (Art. 6(1)(f))

• Count website visits and measure how fast pages load

  Data

  Page-visit statistics (section 10)

  Legal basis (GDPR)

  Legitimate interest in understanding how the website is used (Art. 6(1)(f))

• Answer access requests and your messages to support, privacy and security

  Data

  Form entries, correspondence

  Legal basis (GDPR)

  Steps taken at your request before an agreement (Art. 6(1)(b)); legitimate interest in answering you (Art. 6(1)(f))

• Meet legal obligations, such as answering a lawful request from an authority

  Data

  Whatever the obligation requires

  Legal basis (GDPR)

  Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest you can object (section 8). The approval you give on the connector’s consent screen authorises an assistant to use your account; it is not the legal basis for our processing, and you can withdraw it at any time by revoking the connection. We make no decision about you by automated means that has legal or similarly significant effects.

The connector is optional. It starts only when you, as an invited user, sign in and approve an assistant such as Claude or ChatGPT on the consent screen. This is what happens to data when you do.

• What our server receives. The OAuth access and refresh tokens; the arguments of every tool call, such as tickers, a sector or industry, search text and the release you ask about; and, only if you ticked the write permission, the name and the securities of a new list you ask the assistant to save.
• What we log. Every call is written to an audit log: your user ID, the tool name, the status, the duration, a request ID, the query parameters of read calls (tickers, sector, search text) and any error text. Audit entries are kept for 12 months. Saving a list also writes a short-lived technical record (7 days).
• What we never request. Your conversation history. We see the individual tool calls the assistant chooses to make, not your chat, your prompts or the assistant’s answers.
• Where the results go. What a tool returns is sent to the assistant you connected: Claude, run by Anthropic, or ChatGPT, run by OpenAI. That vendor processes it under its own terms and privacy policy, and ALB Equity does not control what it does with the data afterwards. When the assistant asks for them, the results include your saved lists and reports in full (name, securities, style weights, a report’s client name and content) with the dates they were created and last changed. See the Anthropic and OpenAI privacy policies.
• Your account name. The tool that confirms which account is connected returns only your display name.

We use the providers below to run the service. We do not sell personal data and we do not share it for advertising.

• Supabase

  What they do

  Database, authentication and serverless functions, including the AI connector

  Data

  Account data, content you create, connector data and logs

• Lovable and Cloudflare

  What they do

  Web hosting and content delivery of the website and the app, routing of connector requests, and the website's visit statistics

  Data

  Technical data; the content of pages and requests as they pass through; page-visit statistics (section 10)

• Google (Google Fonts)

  What they do

  Serves the font files used on our pages. Your browser requests them from Google's servers.

  Data

  Your IP address and browser details, sent by your browser

• GitHub

  What they do

  Loads each monthly release of reference data into the database

  Data

  No user data

• The AI assistant you connect: Anthropic (Claude) or OpenAI (ChatGPT)

  What they do

  Receives the results of tool calls and processes them under its own terms

  Data

  Model data and, if requested, your saved lists and reports

We may also disclose data to authorities or advisers where the law requires it, or to establish, exercise or defend legal claims.

Some of these providers, and the AI assistants you choose to connect, process data outside the European Economic Area and the United Kingdom, including in the United States. Where personal data leaves the EEA or the UK we rely on an adequacy decision, such as the EU–US Data Privacy Framework for certified recipients, or on standard contractual clauses and the other safeguards in the provider’s data-processing terms. You can ask us for a copy of the safeguards that apply (section 8).

• Account (e-mail address and name)

  Kept for

  While the account exists. Deleted on request (section 9).

• Saved portfolios and reports

  Kept for

  Until you delete them in the app, or the account is deleted.

• Access-request form entries

  Kept for

  24 months.

• AI connector audit log (your user ID, tool name, status, duration, request ID, the query parameters of read calls such as tickers, sector or search text, and error text)

  Kept for

  12 months.

• Rate-limit counters

  Kept for

  2 days.

• Idempotency records of saved lists (a technical record that prevents a double save)

  Kept for

  7 days.

• OAuth authorisation codes

  Kept for

  1 day after they expire.

• OAuth refresh tokens

  Kept for

  30 days after they expire or are revoked.

• OAuth client registrations (the record an AI assistant creates when it first connects)

  Kept for

  Removed after 90 days if no sign-in was ever completed with them; otherwise kept, so the assistant can reconnect. They hold no personal data.

• Records of users who no longer exist

  Kept for

  Removed by the same clean-up that applies the periods above.

Clean-up runs automatically, daily where the database supports it and with every monthly release.

Under data-protection law you have the right to:

• get a copy of your personal data and information about how we use it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where the law gives you that right;
• ask us to restrict how we use it while a question about it is open;
• receive the data you provided in a structured, commonly used, machine-readable format;
• object to processing based on our legitimate interest, on grounds relating to your situation;
• withdraw a consent you have given, without affecting what happened before.

Write to privacy@alb-equity.com. We may need to confirm who you are, and we answer within one month. If you think we have handled your data unlawfully, you may also complain to a data-protection supervisory authority, for instance in the country where you live or work or where the issue arose. The members of the European Data Protection Board are listed on its website. We would appreciate the chance to put it right first.

• Saved lists and reports: delete them yourself in the app, on the Saved portfolios and Reports pages.
• AI assistants: revoke them on the AI assistants page. Access ends at once and the connection records are removed on the schedule in section 7.
• The whole account: ask us at privacy@alb-equity.com. We delete the account together with its saved portfolios and reports, and the records tied to it are removed by the clean-up.
• Access requests: ask at the same address and we will remove your entry before the 24 months are up.

Anything an AI assistant already received lives in that assistant’s own history and has to be deleted there, under that vendor’s controls.

We use no advertising and no cross-site tracking. The app keeps your sign-in session and a few display choices (such as the release month and view you picked) in your browser’s local storage, because it cannot work without them. Our infrastructure providers may set technical cookies to deliver and protect the service.

Our hosting provider, Lovable, adds a first-party statistics script to the website. It records which page was opened, the referring page, the browser, language and time zone, and page-load timings, under a random session identifier kept in your browser for 30 minutes. It is served from our own domain, is not used for advertising and does not follow you to other sites. We use it only to see which pages are read and how fast they load.

Each page loads its font files from Google Fonts, which means your browser contacts Google’s servers when a page opens.

• Connections are encrypted in transit, and accounts exist only by invitation.
• Each account sees only its own saved portfolios and reports, in the app and through the connector.
• Connector access tokens last 30 minutes and refresh tokens 30 days, and a refresh token is replaced each time it is used.
• The write permission is off unless you tick it, and it can only create a new list.
• Revoking an assistant takes effect immediately.

No system is perfectly secure. If a breach is likely to put you at risk, we will inform you and the competent authority as the law requires. To report a vulnerability, see Support.

ALB Equity is a professional service for investment professionals. It is not directed at children, and we do not knowingly collect their personal data.

When we change this policy we update the date at the top. If a change affects how we use your data in a material way, we will say so in the app or by e-mail before it applies.

Privacy questions and requests: privacy@alb-equity.com. For anything else, see Support. Our details are in section 1.