Last updated: June 2026

Privacy Policy

ambiet Effective Date: July 1, 2025 Last Updated: July 1, 2025

Plain-English Summary

ambiet is a personal finance and market intelligence tool. To show you your investment holdings and provide market analysis, we need to access your brokerage data through Plaid. Here is what that means in plain terms:

• We read your account data (holdings, transactions, balances) — we never have your brokerage username or password.
• We do not sell your data to anyone, ever.
• We share limited data with our service providers (Plaid, Supabase, Anthropic) only as needed to run the app.
• You can delete your account and all associated data at any time.

The full policy below contains the legal detail required by applicable law.

1. Who We Are

ambiet ("we," "us," or "our") is operated by Ambiet LLC, a Colorado limited liability company. You can reach us at info@ambiet.com.

2. Scope

This policy applies to the ambiet web application and any related services (collectively, the "Service"). It covers personal information we collect from users of the Service, including during our invite-only beta period.

3. Information We Collect

3a. Financial Account Data (via Plaid)

When you connect a brokerage or financial account, we use Plaid Technologies, Inc. ("Plaid") to access that account on your behalf. Through Plaid, we receive:

• Account information: Account name, account type, institution name, masked account numbers
• Holdings: Current investment positions, including security names, tickers, quantities, and market values
• Transaction history: Past trades and transactions, including dates, amounts, and security descriptions
• Account balances: Current cash and investment balances

We do not receive your brokerage login credentials. Those are entered directly into Plaid's secure interface and are never transmitted to or stored by ambiet.

3b. Usage and Technical Data

When you use the Service, we automatically collect:

• Log data: IP address, browser type, pages visited, timestamps, referring URLs
• Device information: Operating system, screen resolution, browser version
• Feature usage: Which parts of the app you use, search queries within the app

3c. Account Information

To create an account, we collect:

• Email address
• Name (optional)
• Password (stored as a cryptographic hash — we never see your plaintext password)

3d. Communications

If you contact us for support, we retain the contents of that correspondence.

3e. What We Do Not Collect

• Social Security numbers, government ID numbers, or full payment card numbers
• Your brokerage login credentials (Plaid handles those directly)
• Behavioral advertising data or cross-site tracking data

4. How We Use Your Information

We use the information we collect to:

1. Provide the Service: Display your holdings, transaction history, and account balances.
2. Generate market analysis: Your portfolio context and market data are used to generate AI-powered analysis through our ARIA feature (see Section 6 on third-party sharing).
3. Improve the Service: Aggregate, anonymized usage patterns help us understand how the app is used and where to improve it.
4. Security and fraud prevention: Log data and usage patterns help us detect unauthorized access.
5. Communicate with you: Send account-related notifications, security alerts, and (with your consent) product updates.
6. Comply with law: Respond to valid legal process, enforce our Terms of Service, and meet applicable legal obligations.

We do not use your data to sell targeted advertising, build profiles for sale to data brokers, or train AI models on your personal financial data without explicit consent.

5. Legal Basis for Processing

For users in jurisdictions that require a stated legal basis (including California under CPRA):

• Contract performance: Processing your financial data is necessary to provide the core features you signed up for.
• Legitimate interests: Security monitoring, fraud prevention, and aggregate product improvement.
• Legal obligation: Retaining records required by applicable law.
• Consent: Where we seek optional permissions (e.g., marketing communications), we rely on your consent, which you may withdraw at any time.

6. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

6a. Plaid Technologies, Inc.

When you connect a financial account, Plaid acts as the data connector between your brokerage and ambiet. Plaid's own privacy policy governs how Plaid handles your data: https://plaid.com/legal/privacy-policy/. You may disconnect your accounts from Plaid at any time through the ambiet settings page.

6b. Supabase (Database Infrastructure)

Your data is stored in a Supabase-hosted PostgreSQL database. Supabase processes data on our behalf and is contractually prohibited from using your data for its own purposes. Data is encrypted at rest and in transit.

6c. Anthropic, PBC (AI Analysis)

When you use the ARIA market analysis feature, relevant market context and, where applicable to your query, aggregated portfolio context may be sent to Anthropic's API to generate responses. Anthropic's API usage policies prohibit training their models on API inputs. Anthropic's privacy policy: https://www.anthropic.com/privacy.

6d. Legal Process

We may disclose your information if required by law, court order, or valid government request. Where legally permitted, we will notify you before complying.

6e. Business Transfers

If ambiet is acquired or merges with another company, your data may transfer as part of that transaction. We will provide advance notice and give you an opportunity to delete your account before the transfer takes effect.

6f. With Your Consent

We will share your information for any other purpose only with your explicit consent.

7. Data Storage and Security

Your data is stored in Supabase-hosted infrastructure in the United States. We implement the following security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Multi-factor authentication required for all administrative access
• Role-based access controls limiting which systems can read which data
• Automated security monitoring and alerting
• Regular access reviews

We maintain a written information security program as required by the FTC Safeguards Rule (16 C.F.R. Part 314).

No security system is perfect. In the event of a data breach affecting your personal information, we will notify you as required by applicable state breach notification laws.

8. Data Retention

When you delete your account, we will delete or de-identify your personal information within 30 days, except where we are required by law to retain it longer.

9. Your Rights and Choices

9a. All Users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your account and associated personal information.
• Disconnect financial accounts: Disconnect any linked brokerage account through ambiet settings at any time.
• Opt out of marketing communications: Use the unsubscribe link in any marketing email.

To exercise these rights, contact us at info@ambiet.com.

9b. California Residents (CCPA/CPRA)

California residents have the following additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this practice ever changes, we will update this policy and provide an opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (including financial account data) for purposes beyond providing the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

California residents may exercise these rights by contacting us at info@ambiet.com. We will respond within 45 days.

Categories of personal information collected in the past 12 months: Identifiers (email, IP address); financial information (account data via Plaid); internet or other electronic network activity (usage logs); inferences drawn from the above to understand feature usage patterns.

Categories of personal information sold or disclosed for a business purpose in the past 12 months: We have not sold personal information. We have disclosed financial data to Plaid (as the data connector), infrastructure data to Supabase, and query context to Anthropic — all as service providers under written contracts.

9c. Virginia Residents (VCDPA)

Virginia residents have rights under the Virginia Consumer Data Protection Act to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and profiling. Contact us at info@ambiet.com to exercise these rights. Note: VCDPA applies to controllers processing data of 100,000+ Virginia consumers annually; ambiet is currently below this threshold.

9d. Colorado Residents (CPA)

Colorado residents have similar rights under the Colorado Privacy Act. The CPA applies at the same 100,000-consumer threshold. Contact us at info@ambiet.com to exercise these rights.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, contact us immediately at info@ambiet.com.

11. Changes to This Policy

We will notify you of material changes to this policy via email or prominent in-app notice at least 30 days before the changes take effect. Continued use of the Service after that date constitutes acceptance of the revised policy.

12. Contact Us

Ambiet LLC Email: info@ambiet.com

This privacy policy was last reviewed on July 1, 2025.