Privacy Policy
Last updated: September 10, 2026
Your Privacy Matters: Catalist ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our financial data and analytics platform.
1. Information We Collect
1.1 Personal Information You Provide
When you register for an account or use our services, we collect:
- Account Information: Name, email address, password (encrypted), and profile details
- Authentication Data: If you sign up using Google OAuth, we receive your name, email, and profile picture from Google
- Payment Information: Payment details are processed securely through PayPlus, our payment processor. We do not store your full credit card information on our servers
- Communication Data: Messages you send us through contact forms or support requests
- Verification Data: Email verification codes (OTPs) for account security
1.2 Automatically Collected Information
When you access our platform, we automatically collect:
- Usage Data: Pages visited, features used, search queries, stocks viewed, filters applied, and time spent on the platform
- Device Information: Browser type, operating system, device type, IP address, and general location data
- Analytics Data: We use Google Analytics to understand how users interact with our platform
- Cookies and Similar Technologies: Session cookies, authentication tokens, and preference settings
1.3 Financial Market Data Preferences
- Stock symbols you search for or view
- News items and SEC filings you read
- Filter preferences and screening criteria you apply
- AI summary requests and interactions
2. How We Use Your Information
We use your information for the following purposes:
2.1 Service Delivery
- Provide access to real-time and delayed stock market data
- Display news articles, SEC filings, and AI-generated summaries
- Process your subscription and manage your account
- Authenticate your identity and maintain account security
- Send email verification codes and password reset links
2.2 Platform Improvement
- Analyze usage patterns to improve our features and user experience
- Develop new financial analysis tools and AI capabilities
- Test and optimize platform performance
- Conduct research and analytics on market data consumption
2.3 Communication
- Send subscription updates, payment receipts, and invoices
- Notify you about important platform changes or security issues
- Respond to your support requests and inquiries
- Send service-related announcements (with your consent)
2.4 Legal and Security
- Comply with legal obligations and regulatory requirements
- Detect, prevent, and address fraud or security issues
- Enforce our Terms of Service and protect our rights
3. Information Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
3.1 Service Providers
- PayPlus: Payment processing for subscriptions (they have their own privacy policy)
- Google Analytics: Website analytics and user behavior tracking
- Google OAuth: Authentication services (when you choose to sign in with Google)
- Email Service Providers: For sending transactional emails (verification codes, password resets)
- MongoDB Atlas: Secure cloud database hosting
- OpenAI: AI-powered features and content analysis (data is processed anonymously)
3.2 Legal Requirements
We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to:
- Comply with legal processes or government requests
- Protect our rights, property, or safety
- Investigate fraud or security issues
- Protect the rights and safety of our users
3.3 Business Transfers
If Catalist is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
4. Data Security
We take security seriously and implement industry-standard measures to protect your information:
- Encryption: All passwords are encrypted using bcrypt hashing. Data transmission uses HTTPS/TLS encryption
- Authentication: Secure session management and token-based authentication via NextAuth.js
- Access Controls: Restricted access to personal data on a need-to-know basis
- Payment Security: We never store full credit card information; all payments are PCI-compliant through PayPlus
- Monitoring: Regular security audits and monitoring for suspicious activity
Note: While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
5. Your Rights and Choices
5.1 Account Access and Updates
- Access: You can access and review your account information in your profile settings
- Update: You can update your name, email, and profile picture at any time
- Password: You can change your password or reset it via email
5.2 Account Deletion
You have the right to delete your account and associated data. To request account deletion, contact us or use the account deletion feature in your profile. Please note:
- Account deletion is permanent and cannot be undone
- Some information may be retained for legal or legitimate business purposes
- Subscription cancellation must be processed separately
5.3 Marketing Communications
You can opt out of promotional emails by clicking the "unsubscribe" link in any marketing email. Note that you will still receive transactional emails related to your account and subscription.
5.4 Cookie Preferences
You can control cookies through your browser settings. However, disabling cookies may affect platform functionality.
5.5 Data Portability
You have the right to request a copy of your personal data in a machine-readable format.
6. Cookies and Tracking Technologies
We use cookies and similar technologies for:
- Essential Cookies: Required for authentication and core platform functionality
- Analytics Cookies: Google Analytics to understand user behavior and improve our services
- Preference Cookies: Remember your settings, filters, and preferences
- Session Management: Maintain your logged-in state securely
Most browsers accept cookies by default. You can adjust your browser settings to refuse cookies, but this may limit your ability to use certain features.
7. Third-Party Links and Services
Our platform contains links to external websites and data sources, including:
- SEC filings on the SEC website
- External news sources
- Stock exchange websites
- TradingView charts (if applicable)
We are not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies.
8. Children's Privacy
Catalist is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If we discover that we have collected information from a child under 18, we will delete it immediately.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using Catalist, you consent to the transfer of your information to our servers and service providers located globally.
10. Data Retention
We retain your personal information for as long as necessary to:
- Provide our services and maintain your account
- Comply with legal obligations (e.g., tax records, payment history)
- Resolve disputes and enforce our agreements
After account deletion, we may retain certain anonymized or aggregated data for analytics purposes. Payment records may be retained for up to 7 years for tax and accounting compliance.
11. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- Right to Know: Request details about the personal information we collect and how we use it
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt out of the sale of personal information (note: we do not sell personal information)
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise these rights, please contact us at the email below.
12. European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation:
- Right of Access: Obtain confirmation and access to your personal data
- Right to Rectification: Correct inaccurate personal data
- Right to Erasure: Request deletion of your personal data
- Right to Restriction: Restrict processing of your personal data
- Right to Data Portability: Receive your data in a structured format
- Right to Object: Object to processing of your personal data
- Right to Withdraw Consent: Withdraw consent at any time
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
- Posting the updated policy on this page with a new "Last Updated" date
- Sending an email notification to your registered email address
- Displaying a prominent notice on our platform
Your continued use of Catalist after changes are posted constitutes your acceptance of the updated Privacy Policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Website: finalle.ai
- Support: Use the "Contact Us" form on our platform
- Data Protection Inquiries: For privacy-specific questions or to exercise your rights
We will respond to your inquiry within 30 days.
Transparency Commitment: We believe in transparency. If you have questions about how we handle your data or want to understand any aspect of this policy in more detail, please don't hesitate to reach out. Your trust is important to us.