Privacy Policy

1. Who we are

AerInvest is operated by Adrian Emanuel Rotaru, trading as AerDigital, based in Romania ("AerInvest", "we"). AerDigital is not yet a separately registered legal entity — the individual named above is the data controller. For any privacy question or to exercise the rights below, contact contact@aerdigital.ro.

2. Personal data we collect

• Account data: name and email address (from sign-up or Google sign-in), password (hashed by our authentication provider — we never see or store it in plain text).
• Financial data you enter: portfolio holdings (ticker, shares, cost basis, currency), watchlists, price/AI-score alerts, and investment journal entries you write.
• Billing data: your subscription tier and status. Card numbers are entered directly on Stripe's own checkout page and are never received or stored by AerInvest.
• Requests you submit: consultation-booking details (name, email, phone, preferred time, topic) and partner-program applications (name, email, platform, audience size, pitch), if you use those forms.
• Newsletter: your email address, if you subscribe.
• Technical data: IP address (used transiently for abuse/rate-limit protection, not stored long-term as a profile), browser user agent, and standard server request logs.
• Guest use: if you use AerInvest without an account, any portfolio you build is stored only in your own browser (localStorage) and is never sent to our servers unless you create an account.

3. AI-powered features

Company research, the AI Copilot chat, and portfolio insights are generated by large language models (currently OpenAI). Generating these features sends relevant inputs to that provider — for portfolio-specific features, this includes your holdings (ticker, shares, cost basis) and any investing-profile answers you've given (risk tolerance, experience level, and similar). We do not deliberately include your name, email address, or account credentials in these requests.

AI-generated content (valuations, verdicts, recommendations) can be wrong or incomplete — see our Disclaimer. It is not personalized financial advice and is not a form of automated decision-making that produces legal or similarly significant effects on you: you decide whether to act on it, and no account or eligibility decision is made by AI alone.

4. Why we process it, and on what legal basis

• To provide the account features you request (portfolio tracking, watchlists, alerts, journal, AI research) — necessary to perform our contract with you.
• To process payments and manage subscriptions — necessary to perform our contract with you, via Stripe.
• To respond to a consultation request or partner application you submit — necessary to take steps at your request before entering into a contract, or our legitimate interest in handling business inquiries.
• To send the newsletter — based on your consent, given when you subscribe. You can withdraw it at any time (see Section 7).
• To keep the service secure and prevent abuse (rate limiting, fraud prevention) — our legitimate interest in protecting the service and its users.
• To comply with legal obligations (e.g. financial/tax record-keeping for payments) where applicable.

5. Who we share it with

We use the following processors to run AerInvest. Each only receives what it needs to perform its function:

• Supabase — database, authentication, and file storage.
• OpenAI — AI-generated analysis and chat.
• Stripe — payment processing and subscription billing (PCI-DSS compliant; handles your card details directly).
• Financial Modeling Prep, Yahoo Finance, TradingView, OpenFIGI — market data and charting; these do not receive your personal account data, only the ticker symbols you look up.
• Resend — delivery of alert emails you've configured.
• DigitalOcean — application hosting, in our Frankfurt (EU) data center.
• We do not sell personal data, and we do not share it with third parties for their own advertising purposes.

6. International transfers

Our database (Supabase) is hosted in Frankfurt, Germany, and our application server (DigitalOcean) runs in the same region — your account data is stored in the EU. Some of our processors are US companies, which involves a transfer of personal data outside the EEA when they process it: OpenAI relies on the EU Standard Contractual Clauses; Stripe and Resend rely on the EU-U.S. Data Privacy Framework, backed by the Standard Contractual Clauses. Supabase, as the operator of our EU-hosted database, also relies on the Standard Contractual Clauses for any support access from outside the EEA. Financial Modeling Prep, Yahoo Finance, TradingView, and OpenFIGI do not receive personal data from us at all — only the ticker symbols you look up — so this section doesn't apply to them.

7. Your rights

Under GDPR, you have the right to access, correct, delete, restrict, or export (portability) your personal data, and to object to or withdraw consent for processing based on it.

Export and deletion are self-service: go to Settings → Profile → Your data. Export downloads everything tied to your account as a JSON file immediately. Deleting your account is permanent and immediate — it removes your profile, portfolio, watchlist, alerts, journal entries, and every other record tied to your account, and cancels any active subscription right away. For correction, restriction, or objection requests, or anything the settings page doesn't cover, contact contact@aerdigital.ro — we aim to respond within 30 days, as GDPR requires.

Your account's own past transactions remain with Stripe as our payment processor, and settled partner-referral payouts are kept in anonymized form for accounting purposes — see Section 9.

You also have the right to lodge a complaint with your national data protection authority — in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), anspdcp.ro.

8. Cookies and local storage

AerInvest does not use advertising or analytics trackers (no Google Analytics, Meta Pixel, or similar) — this section covers everything the app actually stores in your browser.

• Authentication cookie (strictly necessary): keeps you signed in once you have an account. Set by our authentication provider (Supabase). We set no cookies at all before you sign in.
• Local storage (on your device only, never transmitted to us unless a feature explicitly sends it): if you use AerInvest without an account, your guest portfolio, watchlist, and any chart drawings are kept here so they persist between visits; signed-in accounts keep the same things in our database instead. Also here: display preferences (currency, sidebar state), draft journal entries, dismissed tips and onboarding progress, a short AI Copilot chat history, and — only right after you follow a referral link — the referral code, until you finish creating an account.
• Because none of this is advertising, analytics, or cross-site tracking, and everything here is either strictly necessary for a feature you're actively using or stays entirely on your device, it doesn't require a cookie-consent banner under ePrivacy rules — there's nothing non-essential to opt into.

9. Data retention

Account data (portfolio, watchlist, alerts, journal) is kept for as long as your account is active, and is deleted immediately when you delete your account yourself or ask us to (see Section 7) — there is no separate holding period. Guest data in your browser's local storage stays there until you clear it yourself; we have no way to reach in and delete it remotely.

Consultation requests and partner-program applications are kept for 24 months from your last contact with us, then deleted, unless a partnership is ongoing. Newsletter subscriber emails are kept until you unsubscribe.

Two things survive an account deletion, both narrowly for accounting reasons GDPR itself allows for (Art. 17(3)(b)): Stripe keeps your billing and payment history under its own retention rules, independent of us; and if you referred a paying customer through our partner program, the anonymized conversion record (amount, plan, date — with your account link removed) is kept for revenue-share accounting.

10. Children

AerInvest is not directed at, or intended for use by, anyone under 18. We do not knowingly collect personal data from children.

11. Security

Data in transit is encrypted (HTTPS/TLS). Database access is restricted by row-level security so that, in the normal product flow, you can only read your own portfolio, watchlist, alerts, and journal entries. We never receive or store your full payment card number.

12. Changes to this policy

We'll update the "Last updated" date above when this policy changes, and post the revised version here.