Privacy Policy

Mezan Investing, a product of Nafitech LLC ("Mezan," "we," "our," or "us"), operates the website mezaninvesting.com and the related Mezan: Investing mobile application (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the Service you consent to the practices described here. If you do not agree, do not use the Service.

We collect the following categories of information:

• Account data: name, email address, hashed password, Firebase user ID, sign-in timestamps.
• Subscription data: subscription tier, status (active/canceled/past-due), Stripe customer ID, plan ID. We do not store full credit-card numbers; payment data is collected directly by Stripe under Stripe's privacy policy.
• Profile and usage data: pages viewed, search queries, tickers researched, watchlists, click events, session timestamps, IP address, browser/device type, operating system, approximate location derived from IP.
• Communications: messages you send to support@mezaninvesting.com, including any attachments.
• Cookies and similar technologies: session cookies for authentication, anonymous analytics cookies. See §8.
• Mobile app analytics and advertising data: in-app events (screens viewed, content opened, searches, subscription and purchase events), app version, and mobile advertising and device identifiers (Apple IDFA / Google Advertising ID), collected via analytics and advertising SDKs (see §8). On iOS, the advertising identifier is collected only if you grant permission through Apple's App Tracking Transparency prompt.
• Inferred data: derived aggregates such as your approximate region, device class, or research preferences used to personalize the Service.

What we do NOT collect: we do not collect government IDs, social security numbers, or biometric data. We do not collect or store credit-card numbers, CVVs, or banking credentials — those go directly to Stripe.

We use information for the following purposes only:

• To provide, operate, and maintain the Service (account creation, subscription gating, search, research generation).
• To process payments and subscriptions through our payment processor.
• To communicate with you about the Service (transactional emails, security alerts, billing notices).
• To send marketing or product-update emails — you may opt out at any time via the unsubscribe link or by emailing us.
• To improve and personalize the Service, including analytics and aggregated usage measurement.
• To measure and optimize our advertising and marketing, including attributing app installs and in-app actions to campaigns on third-party platforms such as Meta and Google.
• To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations and enforce our Terms.

Some features of the Service use artificial intelligence (specifically OpenAI's GPT models) to generate company summaries, investment theses, and analysis text. To produce this content, we send the relevant ticker symbol and publicly available company description (sourced from Financial Modeling Prep) to OpenAI's API. We do not send your personal information, account data, watchlists, or browsing history to OpenAI. AI-generated content is clearly labeled and is provided for informational purposes only — it is not financial advice.

We share information with the following service providers ("subprocessors") only to operate the Service. Each is bound by their own privacy and security obligations:

• Stripe (Stripe, Inc.) — payment processing, billing, and subscription management. Stripe receives your name, email, billing address, and card details directly. See stripe.com/privacy.
• Firebase / Google Cloud (Google LLC) — authentication, hosting of certain data, and app analytics via Google Analytics for Firebase (in-app events and identifiers used for analytics and advertising measurement). See firebase.google.com/support/privacy.
• MongoDB Atlas (MongoDB, Inc.) — primary application database hosting. See mongodb.com/legal/privacy-policy.
• Vercel, Inc. — website hosting, edge runtime, and (if enabled) anonymous analytics. See vercel.com/legal/privacy-policy.
• Google Cloud Platform (Google LLC) — backend API and batch processing infrastructure.
• Anthropic, PBC — AI-generated company summaries (see §4 above for what data is sent). See anthropic.com/legal/privacy.
• Finnhub Stock APIs (Finnhub) — market data provider; we send only ticker symbols, never user data. See finnhub.io/privacy-policy.
• RevenueCat, Inc. — mobile-app subscription management. See revenuecat.com/privacy.
• Meta Platforms, Inc. (Facebook) — mobile app analytics and advertising measurement via the Meta SDK; receives in-app events and, where you permit it, advertising identifiers to attribute and optimize our ad campaigns. See facebook.com/privacy/policy.
• Apple Inc. and Google LLC — for in-app purchase processing on iOS and Android.

We may also disclose information in the following limited circumstances: (a) in response to lawful requests from public authorities (subpoenas, court orders); (b) to protect our rights, property, or safety, or those of our users or the public; (c) in connection with a merger, acquisition, financing, or sale of all or part of our business — in which case the successor entity is bound by this Policy as to existing data.

We do not sell your personal information for money. To run and measure our advertising, we do share limited app-analytics data and — only where you permit it — advertising identifiers with advertising and analytics partners (such as Meta and Google); see §8 for what is involved and how to opt out. We never share your account credentials, watchlists, or research history with advertisers.

We retain account and subscription data for as long as your account is active and for up to 24 months after account closure to comply with tax, accounting, fraud-prevention, and legal obligations. Anonymous and aggregated data may be retained indefinitely. You may request deletion at any time (see §9).

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, processed in, and stored in the United States. By using the Service you consent to this transfer. Where required by law (e.g., for users in the European Economic Area or the United Kingdom), we rely on Standard Contractual Clauses or equivalent mechanisms with our subprocessors.

We use the following cookies and similar technologies:

• Strictly necessary cookies: session token, authentication, CSRF protection. The Service cannot function without these.
• Analytics cookies: anonymous, aggregated data on which pages are viewed and how the Service is used. Helps us improve the product.
• Preference cookies: remember your theme (dark/light), recent tickers, and similar UI choices.

Our website does not use third-party advertising cookies. You can disable cookies through your browser settings; doing so may break sign-in and other features. We do not currently respond to "Do Not Track" browser signals because no industry standard exists.

Mobile app analytics and advertising. Our mobile app uses the Google Analytics for Firebase and Meta (Facebook) SDKs to understand how the app is used and to measure the performance of our advertising. These SDKs collect in-app events and device/advertising identifiers. On iOS, we ask for your permission through Apple's App Tracking Transparency prompt before using your advertising identifier (IDFA) for cross-app tracking; if you decline, we do not use it and rely only on privacy-preserving, aggregated measurement (such as Apple's SKAdNetwork). You can reset or limit your advertising identifier at any time in your device settings (iOS: Settings › Privacy & Security › Tracking, and Apple Advertising; Android: Settings › Privacy › Ads).

Depending on your jurisdiction, you have the rights below. To exercise any of them, email support@mezaninvesting.com from the address associated with your account. We will respond within 30 days (or as required by your jurisdiction).

Users in the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR):

• Right of access — obtain a copy of personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention requirements.
• Right to restrict processing — limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on our legitimate interests, including direct marketing.
• Right to lodge a complaint — file a complaint with your local supervisory authority.
• Lawful bases we rely on: performance of a contract (for Service operation), legitimate interest (analytics, fraud prevention), consent (marketing emails), and legal obligation (tax, anti-fraud).

Users in California (CCPA / CPRA):

• Right to know what categories of personal information we have collected, the sources, the business purposes, and the categories of third parties we shared it with.
• Right to delete personal information, subject to legal retention exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" — we do not sell your personal information for money. Our use of advertising SDKs (such as Meta) to measure app-install and in-app conversions may qualify as "sharing" for cross-context behavioral advertising under the CPRA; you can opt out on iOS by declining the App Tracking Transparency prompt, on Android via your device ad settings, or by emailing us.
• Right to limit use of sensitive personal information — we do not use sensitive personal information beyond what is necessary to operate the Service.
• Right to non-discrimination — exercising any of these rights will not affect your service or pricing.

All users:

• You may close your account at any time via account settings or by emailing support.
• You may download or request a copy of your personal data.
• You may unsubscribe from marketing emails using the link in any marketing message.

The Service is not directed to and not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you become aware that a child under 18 has provided us with personal information, please contact support@mezaninvesting.com and we will delete it promptly. If we learn that we have inadvertently collected information from a child under 13 (US) or under 16 (EEA/UK), we will delete it as required by COPPA and GDPR respectively.

We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest for sensitive fields, access controls, and routine security reviews. However, no system is perfectly secure. We cannot guarantee absolute security and disclaim liability for unauthorized access that occurs despite our reasonable safeguards. If we become aware of a security incident affecting your data, we will notify you and, where required, the relevant authorities, in accordance with applicable law.

The Service may link to third-party websites, services, or content (including external broker platforms, news sites, or charting tools). We are not responsible for the privacy practices of those third parties. Review their policies before providing information.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent change. For material changes that affect your rights, we will notify you by email or through the Service at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

Questions, requests, or complaints about this Privacy Policy or our handling of your data:

Email: support@mezaninvesting.com
Subject line: "Privacy Request"