ChatAnalytica
Only what is needed.
What we store, where and why · Oct 25, 2026
What we store about you
When you sign in with Google we store your stable Google account identifier, your name as Google provides it and a hash of your email. We do not store the email in clear text unless your account is placed on the waiting list or you join it: then we store it encrypted, only to tell you when your access is activated, and you can remove it from the waiting screen with "Turn off the notice". The first time you enter the chat we ask for your age, in years, and we store it with the day you gave it (so we know your age today). ChatAnalytica is for people aged 18 and over: under 18, the chat cannot be used. Your age changes no answer and is never sent to the model that answers you; we use it in aggregate figures and in internal customer profiles (see below). We no longer ask for your gender; if you told us before, it stays stored and unused (it changes nothing and is in no figure) and you can ask us to delete it. Your portfolio is not stored on our server: if you use it in the desk, it stays in your browser (if you turn on phone alerts, only the list of its symbols, without quantities or amounts: see "Phone alerts").
What for, and on what legal basis
Each use has its basis in Article 6 of the General Data Protection Regulation (GDPR). Performance of the contract (6(1)(b)), that is, providing the service you ask for: your account, the chat and the desk, your general chat conversations, what Ultra remembers, your Design Vault websites, your profile and portfolio when the question needs them, usage limits and the minimum age in the terms. Your consent (6(1)(a)): the waiting-list email notice, which you withdraw with "Turn off the notice", and phone alerts, which you turn off with "Turn all off" or by removing the permission in your browser. Legal obligation (6(1)(c)): the invoice and accounting of a purchase, and the record of each Ultra analysis required by the rules on investment recommendations. Our legitimate interest (6(1)(f)): improving the service with your questions and ratings and with the anonymous measurement of the general chat, protecting the site (the per-IP limit and security logs), aggregate figures by age and internal customer profiles. You can object to what we do on the basis of legitimate interest (see "Your rights").
What we store about your usage
Daily usage and counters of answers and factsheets; identifiers of the assets viewed in each session; and, for AI answers, the evidence sent and the model output. During the beta we store the text of your questions and the answers to improve the service; never your portfolio or any financial data about you. The per-IP limit uses a daily hash of the address, not the address. In Ultra we count the tokens you use each day and week to apply its limit. Each day we count how many different people ask about each asset: only the count, not who.
Internal customer profiles
To understand who uses ChatAnalytica, every night an AI model reads the questions you write in the chat and fills in a fixed record: your experience, your time horizon, the risk you accept, the products you are interested in, your goal (learning, saving, retirement or short-term trading), your doubts, which sources you trust and your approximate capital, in bands and with how certain that is. The record does not copy your sentences. With the records, our code groups people into profiles ("segments") so we know what kind of customers we have. We do this under our legitimate interest in understanding our customers and improving the service (Article 6(1)(f) GDPR), with these safeguards: the record is stored under a pseudonym, without your name or email, in a separate database; it never reaches the chat or the model that answers you, so it changes no answer (there is no personalised advice); it is only used inside the company, as group figures; outside it we only give aggregate figures of at least 20 people, and we never sell or share data about an individual. Nothing about health, religion, politics, sexuality or origin is inferred or stored: questions on those topics are not read. It is not done for minors or for anyone who has not given their age. If your browser is set to a Canadian time zone, it is only done if you say yes. You can object with one click in "Your data" › "Do not use my data for profiles": we take you out and delete your record. The record is included in "Download my data" and is deleted when you delete your data or your account.
Your profile and portfolio, in your browser
In the desk, your profile (experience, horizon, risk, goal and capital), your portfolio and your broker connections are stored only in your browser. They travel with the question that needs them (and, with it, to the AI provider that answers it), are used to answer it and are not stored on our server or in its logs. Your broker keys are encrypted on your device and never reach us. If you clear your browser data or use another browser, the desk starts without them.
What Ultra remembers
So it does not start from scratch each time, the desk stores in your account your conversation with Ultra, a summary of each stretch and up to 50 notes about your interests, the assets you follow, your preferred format and your level. It does not store amounts, wealth, income, age, health or risk tolerance as notes. You can view, edit and delete each note in "What Ultra remembers"; deleting one also removes it from your desk version history.
Your general chat conversations
In the general chat we store your conversations (what you ask and what it answers) in your account, so they come back in "Recent". To answer you, in all three modes, we send to the US AI provider or, on the accounts where we have switched it on, to the Netherlands one (see "AI providers") your question, the latest messages in that conversation (up to 12), what the search finds with its source and date and, if you are in the Finance beta, the vault data the question asks for; never your age, the desk profile and portfolio or your internal customer profile. If one of our Vaults already has the answer, Light calls no model. The web search is done by the US provider or, with the Netherlands one, by our own code before asking it (and never with what you tell us about your health): the search engine only receives the text of the search, without your name, email or account. A conversation with files always goes to the US one. The general chat sends nothing to the Asian provider. Basis: the contract (6(1)(b)), because it is the service you ask for. If in a question you tell us about your health or other specially protected data, we use it only to answer you and keep it in "Recent", because you give it to us for that (explicit consent, Article 9(2)(a) GDPR), and you can withdraw it at any time with "Delete my data". To answer properly when someone may be at risk or in an emergency, a small model from the US provider reads each message with the two previous turns (at most four messages) and only says whether there is a risk, an emergency or nothing; if there is, the answer includes the helplines or emergency numbers for your country, and that message is not used for anything else. For each answer we also add 1 to some weekly counters (the type of question, the mode, the range of what it cost, how long it took and whether it was liked), without the text, your account, your IP address, the conversation, the day or the time, to learn what people ask and improve the service (legitimate interest, 6(1)(f)); "Like" and "Dislike" only add to those counters. Your conversations are included in "Download my data" and are deleted with "Delete my data" or, otherwise, 24 months after each message. The weekly counters contain no data about anyone and are kept. Like all of ChatAnalytica, it is only for people aged 18 and over.
Your Design Vault websites
If you use Design Vault, we store what you describe about your website or dashboard (with the brands you like), the plan with the texts of each page and the assembled website, only to make it, show it to you and let you download it. If you upload a data file for a dashboard, your browser sends us the table: we use it to calculate the totals and series on your website; the AI model only receives the file name, the column names and what is calculated, never the values, and the table is not stored separately, only inside your website. So that new websites do not repeat each other, we keep the design of each one (structure, typography and colours), without your texts or data; when you delete the website, that design stays with no link to your account. We also record what each step uses, in tokens, for usage limits. The three free options are deleted after 7 days unless you build them; everything else, when you delete the website or your data.
Files you upload to the Chat
If you upload a file to the Chat (a PDF, a Word file, an Excel file, a CSV, a text or an image), we store it to answer you about it and only for that: we do not use it to improve the service or for internal customer profiles, and it does not go into what the chat remembers. We read it on our server, apart from everything else and without running anything it contains (macros, scripts or formulas), and we strip hidden data from photos, such as the location. The AI model only receives the part of the file your question needs, and always the US provider under a processor contract (see "AI providers"), never the Asian one; with a file, Light also uses AI. Spreadsheet calculations are done by our code, not by the model. What we give back to you (an Excel file or a CSV) is stored just like your files. They are deleted automatically 30 days after you upload or we create them, and earlier if you remove them or use "Delete my data"; deleting a file also deletes what the Chat answered about it. Your files and what the Chat answers about them are not included in backups: what is deleted disappears at once. Your question stays in the conversation, like any message. Basis: performance of the contract (6(1)(b)). If you upload other people's data, you must be entitled to do so (see /terminos).
AI providers
In the desk, Light does not send your question to any AI model. When Medium or Ultra answers there, we send your question, the necessary context (the recent conversation, what Ultra remembers and, if you use them, your profile and portfolio) and market data to an AI model provider: Ultra, to one in the United States (and, on days when our spending limit is exceeded, to the Medium one); Medium and conversation summaries, to one in Asia (Singapore, with its parent company in China). For internal customer profiles, we send your questions, without your name or email, to a provider in the United States. For Design Vault, what you describe about your website and its texts go to the same US provider as Ultra. In the general chat, all three modes and the web search go to the US provider (Light, only when no Vault already has the answer), except where we switch on the Netherlands one (below), and nothing goes to the Asian one (see "Your general chat conversations"). The US provider is a processor under contract (Article 28 GDPR), does not use what we send to train its models, and the transfer relies on the European Commission’s standard contractual clauses, which are part of that contract (Article 46(2)(c)). Singapore and China have no European Commission adequacy decision, those safeguards are not yet in place with the Asian provider, and its terms allow it to use what it receives to improve its models: we are replacing it with one under a processor contract, and we will say so here. The Netherlands provider runs open-weight models on its own servers, currently in the United States and the United Kingdom (it chooses the region): it is a processor under contract (Article 28 GDPR), does not use what we send to train any model, we only use it with zero data retention switched on (it does not keep your messages or its answers), the transfer relies on the European Commission’s standard contractual clauses, which are part of that contract (Article 46(2)(c)), and whoever made those models receives nothing. On the accounts where we switch it on, the three modes of the general chat and, in the desk, Light (when the vault does not already have the answer), Medium and Ultra go to it; your files, never. There are no third-party analytics, pixels or tracking cookies.
Matching your question
Before answering, to take the fastest route, we check whether your question is one we already know (for example, "what is the P/E ratio?"). To do so we send the text of the question to a classification provider in the United States (TypeSafe AI, Inc.), without your account or your conversation and with emails, phone numbers, documents, cards, links, the name you introduce yourself with and the personal names we recognise removed, and never a question that touches on your health, religion, sexuality, origin or political opinion. According to its policy, it does not use what it receives to train models. We do not yet have a processor agreement with standard contractual clauses with it: we have asked for one and will say so here. For each question we record only which known question it was, or that it was none, without the text. Every night, with the US AI provider that is a processor under contract (see "AI providers"), we review the previous day's questions, without your name or account, to check that the matching is right and to add to the list the questions that five or more people ask; only the generic question reaches the list ("which broker do people use to buy a stock?"), never your text. People who chose "Do not use my data for profiles", minors and specially protected topics are left out. Basis: the contract (6(1)(b)) to match your question, and our legitimate interest in improving the service (6(1)(f)) for the nightly review, which you can object to with that same click.
Backups
Every night we back up what we store. The backup stays on our server in France for a week and, encrypted there before it leaves with a key only we hold, it is also kept off-site with a cloud storage provider in its Amsterdam data centre (Netherlands, European Union): daily backups for 14 days, and the first of each month for 90. They are there to restore the service if the server is lost. That provider is a processor under contract (Article 28 GDPR) and cannot read the backups. It is a US company: the contract includes the European Commission’s standard contractual clauses (Article 46(2)(c)). What you delete disappears from the backups when they expire, at most about three months later.
Phone alerts
Phone alerts are off until you turn them on, one type at a time. If you turn them on, we store in your account the alert address your browser gives for that device (up to five devices), the alert types you have on, your language, your time zone (so we do not alert you at night) and the list of symbols to watch from your Portfolio: only the symbols, never quantities or amounts. Each alert travels encrypted to your device through your browser's push service (Apple, Google, Mozilla or Microsoft), which carries it without being able to read it. We keep a record of what we sent you for 30 days so we do not repeat it. "Turn all off", in "Phone alerts", immediately deletes your devices and that list; "Delete my data" deletes everything. You can also withdraw the permission in your browser settings.
Download and delete your data
From the desk you can download a file with everything we store about you, together with what is in your browser, and delete it. When you delete, we truly erase your conversation, summaries, notes, journal, desk history, internal customer profile, general chat conversations, phone alerts and Design Vault websites, and also what is in your browser. Ultra analyses are kept in a record that cannot be modified, because the rules on investment recommendations require keeping each report with its data; when you delete, that record is no longer linked to your account (pseudonymisation, Article 17(3)(b) GDPR). The same applies to the Ultra and Design Vault token counts.
How long we keep them
Desk data (conversation, summaries, notes, journal and history) is kept while you have an account or until you delete it. The internal customer profile, while you have an account, until you delete it or until you say no. Browser data, until you delete it. Your Design Vault websites, until you delete them or your data; the three free options, 7 days unless you build them. Phone alert data, until you turn alerts off or delete your data; what we sent you, 30 days. General chat conversations, until you delete your data, and at most 24 months from each message; their measurement is weekly counters that contain no data about anyone. The log of questions and answers we use to improve the service (the text of each question, the evidence and the generated answer, and your ratings), 24 months from the question. The security log, 24 months. Every night we delete whatever is past those periods. Pseudonymised Ultra analyses, five years (the period for bringing claims about them). Backups rotate automatically and deleted data disappears from them when they expire.
Cookies and preferences
Only technical cookies, which do not need your consent (Article 22(2) of the Spanish e-commerce law, LSSI): a session cookie and a temporary one during Google sign-in; if your account is placed on the waiting list, another with your encrypted email for 30 days so you can turn the notice back on. Language, theme and motion preference live only in your browser. In the classic chat, the conversation lives in the tab memory and disappears on reload; the desk conversation is saved in your account (see "What Ultra remembers"). In the desk, your profile, portfolio and broker connections are stored in your browser (IndexedDB), not in a cookie.
Payments
If you pay for a plan, payment is processed by Stripe Payments Europe, Ltd. (Ireland) on its own page: we neither see nor store your card details. Stripe is our processor for payment and invoicing and, to prevent fraud and meet its own legal obligations, a controller in its own right (see its privacy policy). Stripe issues your invoice with your name (or your company’s, if you buy for it), email, billing address and, where needed, the tax ID (NIF): your company’s in Spain, or yours if you live in Spain and the purchase is over €400 (Founders Pro). You give it to us before paying and it only goes on the invoice (we do not store it in our database). We keep your account, the plan you buy, your country, whether you asked to start straight away, the amount, the VAT, the payment reference and your masked email. Basis: the contract (6(1)(b)) and our tax and accounting obligations (6(1)(c)), for the periods set by law (six years for accounting records).
Your rights and the controller
You can request access, rectification, erasure, portability, restriction or objection by writing to contacto@chatanalytica.com, withdraw your consent at any time (without affecting what was done before) and lodge a complaint with the Spanish Data Protection Agency (aepd.es). To object to internal customer profiles you also have the one-click option in "Your data". Controller: THEFREEMOVEMENT, S.L. (sociedad unipersonal, a single-member company), tax ID B88950043, C/ Bahía de Pollensa 5-7, 28042 Madrid, Spain. Contact: contacto@chatanalytica.com. Deleting your account removes your identifier and name; generated-answer records are kept without any link to you until they are 24 months old.