Privacy Notice

1. What we collect

• Account: your email address, sign-in identifiers from our authentication provider, how you sign in (password, email link, or Google), your plan, and when you last signed in.
• What you create: watchlists, holdings lists (including share counts and cost basis if you enter them), notes, and settings.
• Your interactions: the requests you make (for example which tickers you analyse or compare and the questions you ask), the AI-generated results we return, your ratings (👍/👎) and anything you write in a feedback box.
• Feedback context: when you use “Send feedback”, the screen you were on, your window size, and your browser name and version, so we can reproduce the issue.
• Technical: request logs (time, page or endpoint, response status, and your account id) for running and securing the service, kept for 30 days. Your IP address is used in memory for rate limiting; our hosting provider may also keep it in its own access logs.
• Waitlist: if you joined the waitlist, the email address you gave.

We do not collect brokerage passwords, bank or card details, or government ID numbers. You cannot trade or move money on Zari Labs.

2. How we use it

• To provide the service: your lists, analyses, notes, inbox, and coach.
• To keep it safe and fair: sign-in, abuse prevention, rate limits, and the monthly analysis credits.
• To improve Zari Labs, including developing and training AI models, as described in section 6 of the Beta Terms. Datasets built from interactions stay inside Zari Labs and are never sold. Your notes and holdings are never used for training, and neither are AI results generated from them, such as a portfolio review.
• To contact you about the beta: replies to your feedback and important service notices. No marketing email without asking.

3. Who processes it for us

We use a small number of service providers, each only for its own job:

• Supabase — authentication (your email and sign-in records).
• Railway — hosting and our database (everything above lives there).
• Anthropic — AI processing. It receives the market data and the request text needed to produce an analysis, and, for portfolio reviews, the tickers in the list you are reviewing.
• Financial Modeling Prep — market data. It receives ticker symbols, never who asked.
• Resend — delivers sign-in emails.
• Sentry — error reports, configured not to send personal data by default.

Our servers and these providers operate in the United States.

4. Cookies and local storage

We use one essential cookie, which keeps you signed in. It is HttpOnly and scoped to our sign-in endpoints. Your browser’s local storage remembers preferences such as light or dark theme. No advertising cookies and no analytics or tracking scripts.

5. How long we keep it

Account data and what you create are kept while your account is open. Request logs are kept for 30 days. AI results without personal content (for example, a ticker’s thesis) sit in a shared cache that serves every user and are not tied to you once your account is deleted.

6. Your choices

• Access or export: email us and we’ll send you a copy of your data.
• Correction: most of it you can edit in the app; for anything else, email us.
• Deletion: email admin@zarilabs.com from the address on your account. We delete your account and the data linked to it, including interaction records, within 30 days. Models already trained on de-identified data can’t be un-trained, but your records won’t be used for any future training.

7. Age

Zari Labs is for people aged 18 and over. We don’t knowingly collect data from anyone younger; if you believe we have, tell us and we’ll delete it.

8. Changes and contact

If this notice changes, the date above changes. If a change is significant, we’ll tell beta users by email. Questions: admin@zarilabs.com.