AstraEye Labs - Privacy Policy

Effective date: October 4, 2026

1. Who We Are

AstraEye Labs ("AstraEye", "we", "us") operates an AI-powered research and analytics platform for crypto assets and U.S. equities. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. It should be read together with our Terms of Service.

AstraEye Labs is not a broker-dealer, investment adviser, commodity trading advisor, exchange, custodian, bank, tax adviser, legal adviser, or money transmitter. AstraEye Labs does not manage money, custody assets, route orders, execute trades for public users, or hold your funds or assets.

2. Information We Collect

We collect the following categories of personal information, from you directly, from your use of the service, and (only when you connect them) from your linked accounts:

• Account and authentication data. Email address, telephone number, country associated with the telephone number, password hash, multi-factor authentication settings, passkey and trusted-device records, session information, and security-verification status used to create, protect, and recover your account. We do not store your password in readable form.

• Billing data. Subscription tier, plan and usage state, and payment identifiers. Card payments are processed by our payment provider (Stripe); full card numbers are entered directly with the processor and do not transit our servers.

• In-app purchase data. When you buy Astra Credits or a plan in the mobile app, Apple (App Store) or Google (Google Play) processes the payment. We receive from the store, and keep, the purchase and subscription records we need to deliver and account for what you bought: the product, the store's transaction, order, and subscription identifiers, the purchase, renewal, expiry, cancellation, and refund status and dates, the price the store displayed, and whether it was a real or test purchase. We also generate a random account token that the app passes to the store with your purchase, so the store's records can be matched to your AstraEye account. We do not receive your payment card details, and we do not receive your Apple ID or Google account email address from these purchases.

• Portfolio and account data. Holdings, balances, symbols, quantities, cost basis, and account labels that you enter manually, import by file, or bring in through an account connection you authorize. This is sensitive information (see Section 10).

• Research and usage data. Research projects, selected templates, analysis types, AI-generated findings, informational research artifacts ("beacons," where enabled), feedback, SAGE questions and answers, and usage/metering data.

• Educational institution data. If an educational institution invites you to an AstraEye account under its own agreement with us, we collect and hold your membership of that institution and your role in it (administrator, instructor, or student), the classes you belong to, the research results an instructor assigns to you, your answers to the multiple-choice tests generated from those results, the score for each test, and a monthly total and completion percentage derived from those scores. Section 19 describes who can see this and how long we keep it.

• Support data. Messages you send to support and our responses.

• Communications data. Notification preferences and records relating to transactional email, security-code text messages, and mobile push notifications, including SMS consent date, consent version and source, delivery/provider identifiers, the push notification handle issued to a mobile device you sign in on, verification challenges, and opt-out or support requests. You control push notifications through your device's own settings, and turning them off there stops them.

• Spoken-audio data (replies we speak to you). If you request a spoken SAGE reply, we send the already-generated reply text to our speech provider - OpenAI or Amazon Web Services (Amazon Polly) - and store the resulting audio file and related metadata (such as voice profile, text hash, duration, and generation cost). The provider receives that text and the voice settings and any delivery instructions needed to speak it, and nothing else about you. We do not use spoken replies to identify you.

• Voice input (what you say to SAGE). If you choose to speak to SAGE, your microphone audio is sent to our transcription provider so it can be turned into text, and that text is then handled exactly like a question you typed. This happens only while you have deliberately started a voice conversation - never in the background, and never without the microphone indicator your browser or device shows.

  We do not store a recording of your voice. The audio is used to produce the transcript and is not written to our systems afterwards; what we keep is the text, in the same conversation history a typed question appears in.

  Our transcription provider does not use your audio to train its models and does not retain it. We use OpenAI's transcription endpoint, which OpenAI documents as having no abuse-monitoring retention and no application-state retention. If we ever move to an option that does retain audio for a period, we will say so here before doing it.

  You are never required to speak to SAGE. Typing does the same things, and declining the microphone permission leaves every other part of the product working.

• Technical and security data. IP address, browser or user-agent information, request and route metadata, cookie and session identifiers, logs, audit and security events, error reports, and diagnostic information used to operate, secure, and troubleshoot the platform. Error reports may include account or request context associated with the error.

We do not intentionally collect government IDs, Social Security numbers, or full payment card numbers.

3. How We Use Information

We use information to:

• Provide, operate, and secure the platform and your account.
• Generate AI-assisted research, analytics, dashboards, and SAGE answers.
• Process subscriptions, credits, usage limits, and billing.
• Communicate with you (transactional email, security-code SMS, security alerts, service notifications, and support). We do not use your telephone number for marketing.
• Operate classroom features for an educational institution that has invited you, which includes recording which research an instructor assigned to you, marking the tests generated from it, and reporting your scores and monthly totals to that institution's instructors and administrator. We do this because the institution has asked us to and because it is what the account it gave you is for.
• Monitor, debug, prevent abuse, and improve the service.
• Measure how people find AstraEye Labs, and reach people who may be interested in it, as described in Section 11.
• Comply with legal obligations.

We use your information only for these purposes and compatible purposes. We do not sell your personal information. Depending on your choices and your location, our use of advertising and analytics services can involve "sharing" personal information for cross-context behavioral (targeted) advertising as those terms are defined under applicable privacy law. Section 11 describes exactly what is and is not shared, and how to turn it off.

Mobile numbers and SMS opt-in/consent records are not sold or shared with third parties or affiliates for their marketing or independent messaging programs. We disclose them only to service providers acting for AstraEye as needed to deliver and secure the SMS messages you requested, or when required by law.

4. AI Processing

To generate research, summaries, or answers, bounded context may be sent to our AI model providers for inference (currently Anthropic and OpenAI). Depending on the feature, this context may include asset symbols, market data, your portfolio positions and approximate values, prior research artifacts, research-observation statistics, and the questions you ask SAGE. Speech synthesis and transcription are separate purposes with their own recipients and their own limits, described below in this section.

Under the providers' standard commercial API terms, inputs and outputs are not used to train their general models by default unless the customer affirmatively opts in. AstraEye does not opt in to provider training or use your personal or portfolio data to train or fine-tune AstraEye or third-party AI models. Under standard API retention, providers may retain inputs, outputs, and related abuse- monitoring data for up to 30 days, and in limited cases longer to enforce usage policies, investigate abuse, provide support, or comply with law. Different retention applies if AstraEye has obtained and enabled an eligible zero-data- retention arrangement.

We design prompts so they should not include passwords, password hashes, raw session tokens, API secret keys, withdrawal credentials, full payment card data, or sensitive administrative secrets. For spoken SAGE REPLIES, our speech provider - OpenAI or Amazon Web Services (Amazon Polly) - receives only the compliant reply text and the voice settings and any delivery instructions needed to speak it. We do not permit either speech provider to use that text to train or improve their models. For SPEAKING TO SAGE, OpenAI's transcription endpoint receives the audio you spoke, for as long as it takes to transcribe it - OpenAI documents that endpoint as not retaining the audio and not using it for training. Because anything you say becomes a prompt, the same rule applies as to typing: do not read passwords, recovery phrases, card numbers or one-time codes aloud to SAGE. See the Risk and AI Disclosure for more detail.

Some AI prompts may include licensed market or research information or compact context derived from it. Where a data license requires transient processing, we use the model provider under no-retention and no-training controls for that licensed data; if those controls are unavailable, the restricted data is excluded from the prompt. This provider-data restriction is separate from, and does not expand, the personal and portfolio context described above.

5. Market and Reference Data

We fetch market, reference, and on-chain data from third-party data providers and cache it in shared snapshots that power research. These providers receive only outbound reference queries (such as ticker symbols, CIK identifiers, asset identifiers, macroeconomic series IDs, and general on-chain queries) and no personal or portfolio data. The exception is a self-custody public identifier you choose to add: we send a public address, or public addresses locally derived from a supported Bitcoin account xpub, to the configured blockchain endpoint to retrieve public balances and asset information.

These market and reference data sources are not subprocessors for this data flow because we do not disclose personal or portfolio data to them. A current list of material data sources, contractual attributions, and general data-delay information is available in our Data Sources and Attributions notice. AstraEye Labs may cache licensed provider data and create derived research only within the applicable commercial license. Provider-data rights may end when a license expires or terminates, in which case affected provider data may be deleted or made unavailable even if other account information remains retained.

6. Account Connections (Brokerage, Exchange, and Data Linking)

You may connect accounts so AstraEye Labs can read your portfolio for research:

• Stock brokerages are connected through Plaid Inc., a read-only data-linking provider that returns holdings and related account data only. When you link a brokerage, Plaid collects and processes your information (including the credentials you enter in Plaid's interface) under Plaid's own end-user privacy policy - available at https://plaid.com/legal/#end-user-privacy-policy - and Plaid's End User Services Agreement. We receive from Plaid only the read-only holdings and account data needed for research; your brokerage login credentials are handled by Plaid and are not shared with or stored by AstraEye Labs.
• Crypto exchanges are connected using API keys you create on the exchange. We request read-only access, which is all that is required to sync your portfolio. We do not request or require withdrawal, transfer, or trade permissions.

Never provide AstraEye Labs with a self-custody wallet seed phrase, recovery phrase, mnemonic, or wallet private key; an exchange password; or any credential capable of authorizing trades, withdrawals, transfers, transaction signing, or asset movement. We may accept a supported exchange's read-only API authentication or signing credential when it cannot authorize those activities.

The public platform has no order-placement or execution capability. Where a venue exposes permission information, AstraEye rejects keys detected as able to trade, transfer, or withdraw. If a venue cannot prove every permission, the connection is treated as unverified rather than represented as proven read-only. AstraEye may reject or disable a connection if its credential permissions later change to include trade, write, withdrawal, transfer, transaction-signing, or asset-movement capability.

AstraEye never requests or uses withdrawal or transfer permissions and cannot move your funds or assets off your accounts. We do not custody your funds or assets. Any future transaction product would require separate technical, security, legal, and consent review and separate applicable terms.

Any API keys, credentials, or access tokens you provide are stored encrypted at rest, are never exposed to your browser or to AI prompts, and are used only to read your portfolio and to operate the features you explicitly enable. You can disconnect a linked account at any time in your settings.

If you add a supported Ethereum, Solana, or Bitcoin public address, or a supported read-only Bitcoin account xpub, we encrypt the full identifier at rest and retain a keyed hash for deduplication. For an account xpub, AstraEye locally derives a bounded range of public receive and change addresses. We send public addresses to the configured standard blockchain RPC or indexer endpoint to retrieve public blockchain balances and asset information. Public identifiers, derived addresses, and blockchain transactions are pseudonymous, not necessarily anonymous; associating an address with your account may link its public activity to you. Except for the request to the applicable blockchain endpoint, full wallet identifiers and derived addresses are excluded from AI prompts, analytics events, AstraEye application URLs, logs, error-monitoring payloads, and user communications by design. If you choose optional Ethereum or Solana address verification, we process the one-time challenge message and signature to verify control of the corresponding signing key. We do not retain the submitted signature after verification; we retain the resulting verification status and timestamp until the wallet connection is removed. Removing a wallet connection deletes its stored address and balance records, subject to any retention required by law.

We minimize linked-account data to what is reasonably necessary to provide the research features you request. We do not sell this data, share it with nonaffiliated third parties for their own independent purposes, or use it for advertising. This is narrower than, and unaffected by, the advertising measurement described in Section 11: your holdings and connected-account data are never sent to an advertising platform. The CFPB's compliance dates for its Personal Financial Data Rights rule, 12 C.F.R. Part 1033, are currently stayed and the rule is under reconsideration. We monitor that proceeding and will update our authorization, revocation, data-use, and retention practices when required by applicable law.

6A. Research API, SAGE Chat Through the API, and Connections to Your AI Assistant

What this is. If your plan includes the Research API, you can let a tool you choose read your own research by creating a personal API token, and, where we offer it, by connecting a supported AI assistant after signing in to AstraEye Labs and approving the connection. By default this access is read-only and limited to your research projects, your report index, and the written prose of your finished reports. If you also grant the optional SAGE chat permission, the tool can read your SAGE conversation, including messages you typed in AstraEye Labs, earlier SAGE replies, and notices that a research run has finished, and, within the daily credit limit you set, send new messages to it and receive SAGE's replies. The same permission lets the tool ask SAGE to take the actions it can take for you in the app, as it would for you: changes to your research projects and watchlist (but not to recurring schedules), starting and stopping research runs, and refreshing balances from your connected exchange accounts. The Research API is available only on personal accounts, not on accounts provided through an institution.

What we send, and to whom. When your token or connection is used, we send the requested content, and any SAGE replies, to the tool or assistant that presented it. We send it because you directed us to, to the tool you chose. That tool's or assistant's provider receives it under your own agreement with that provider, and its terms and privacy practices govern what it does with it, including whether it keeps it. We do not control that provider. The AI assistants we support for connections are listed on our Research API page. Each assistant's provider is an independent business that you choose to send content to; it is not our service provider, even where the same company also provides other services to us (for example Anthropic and OpenAI for AI model inference, or Google for analytics and advertising, as described in Section 7). If the assistant account is provided or managed by an organization, that organization's administrators may also be able to access the conversation under its settings and policies. We do not send your account credentials or payment information, or another member's account data, because you authorized a tool; the reports and conversation content you request may themselves contain information about other people. A SAGE reply through the API uses the same conversation and the same answering, compliance, and billing process as a reply in the app, adapted for a text-only channel; it can perform only the actions listed above; like any SAGE answer, it may refer to information in your own account that SAGE uses to answer in context, as described in Sections 3 and 4.

Messages sent through SAGE chat. Messages a tool sends with the SAGE chat permission, and SAGE's replies, are stored in your SAGE conversation like messages you type, are visible to you on the web and in the SAGE app, and are processed by our AI providers as described in Section 4.

What we keep about this access. For a personal API token, we keep its label, prefix, a one-way hash, its permissions and daily credit limit, and when it was created, expires, was last used, and was revoked; we do not keep the usable token itself. We keep metadata-only audit records of successful Research API reads and of authenticated SAGE API calls: depending on the request, the time, the token, the kind of request, the item read, the outcome, the number of items returned, the message length, the turn, or the connection tool used, but never report or message text. The actions themselves are recorded in your SAGE conversation. We separately keep security events for failed authentication, and records of the credits each day's SAGE API requests, including SAGE replies and quoted research runs, held and used against the credential's daily limit and your account's daily API total. We use these records to show you your own access activity, to enforce limits, to investigate misuse, and for security. Token, audit, and security-event records are security records under Section 9 and are generally kept for up to two years; the daily credit-limit records are erased with your account. Where assistant connections are offered, we also keep the encrypted connection credentials needed to operate and revoke each connection.

Connecting Google's Gemini assistant. When you connect Gemini, Gemini gives us a return address that contains the numeric identifier of the Google account that is setting up the connection. We receive it with the connection request and use it only to send the result of your sign-in back to Gemini. We keep it with that request and its one-time sign-in code, which expire within minutes and are deleted within a day after that; we do not store it with your connection, your account or your activity records, and we do not use it to identify you to anyone or for advertising. Because the connection request passes through our content delivery network and load balancer, the identifier can also appear in their access logs, which we keep as security records for up to 365 days.

Your control. In Settings you can see your personal API token and its recent read activity and today's SAGE API spending, remove the SAGE chat permission, lower the limit for later requests, and revoke the token; where connections are offered, you can revoke each connection independently. Revoking stops further access; it cannot recall content a tool already received. We revoke tokens and connections when you sign out of all sessions, reset your password, or your account is blocked or closed, and we also revoke connections after account recovery for a second factor or a change of your primary or recovery email address. Access does not work while your plan or legal acceptance does not permit it.

Not a sale or sharing for advertising. Sending your content to a tool you chose, at your direction, is not a sale of personal information and is not sharing for cross-context behavioral advertising.

7. Service Providers / Sub-Processors

We share information with service providers that host and operate the platform, strictly to provide the service and under contracts that limit their use of the data. These may include, without limitation:

Two entries below are different in kind and are called out here rather than left to be inferred. For analytics, Google acts for us under those terms. For the advertising described in Section 11, it does not: there it is a recipient using the information for its own advertising purposes, which is what makes that a "share" under California law rather than a disclosure to a service provider. Meta receives information only for that advertising, so everything it receives is a "share" in that sense. OpenAI appears twice below, for two different things: it is a service provider for AI inference, and, separately, an advertising platform for ads shown in ChatGPT. Only the information described in its advertising entry is a "share".

• Amazon Web Services (AWS) - cloud hosting, storage, databases, transactional email (SES), transactional security-code SMS (AWS End User Messaging SMS), logging, related cloud infrastructure, and speech synthesis for spoken SAGE replies (Amazon Polly), which receives the reply text to be spoken.
• Stripe - payment processing and subscriptions.
• Apple and Google - in-app purchases and subscriptions in the AstraEye mobile apps (App Store and Google Play). They process the payment under their own terms and privacy policies and act as independent businesses for that payment data, not as our service providers. We receive the purchase records described in Section 2 from them, including Google's real-time purchase notifications delivered through Google Cloud Pub/Sub.
• Anthropic and OpenAI - AI model inference (and OpenAI for spoken-audio replies and for transcribing what you say to SAGE).
• Plaid and connected brokerages / exchanges - account linking and read-only portfolio data (only when you connect them).
• Google - website analytics, tag management, and advertising (Google Analytics, Google Tag Manager, and Google Ads). Where you have not declined these cookies, Google receives pages viewed, general interaction events, approximate location derived from IP address, device and browser information, and a pseudonymous identifier. It also receives the value of a completed purchase so we can measure which marketing brings people to the platform. Where advertising is enabled for your visit, Google may use that information to measure and personalise advertising, which is the "sharing" described in Section 11. In this analytics and advertising role, Google does not receive your name, your email address, your holdings, the content of your research, or anything you ask SAGE. If you choose to connect Google's Gemini assistant where we support it, Google receives the content you direct to it as your chosen assistant provider, as described in Section 6A. It does receive the web address of the page you are on, which for a research report is an internal identifier rather than the name of any asset, and the type of analysis you ran - see Section 11. You can decline analytics and advertising at any time using the "Your Privacy Choices" link in the footer.
• Meta (Meta Platforms, Inc.) - advertising on Facebook and Instagram (the Meta Pixel and the Meta Conversions API). Only where advertising is enabled for your visit, Meta receives pages viewed, the product events listed in Section 11, approximate location derived from IP address, device and browser information, and a pseudonymous cookie identifier. When you complete a purchase, it also receives the value of the purchase and a one-way hashed (SHA-256) copy of your email address, never the address itself, so it can match the purchase to its own records and tell us which advertising worked. Meta may use this information to measure and personalise advertising, which is the "sharing" described in Section 11. Meta does not receive your name, your email address in readable form, your holdings, the content of your research, anything you search for, or anything you ask SAGE. You can turn this off at any time using the "Your Privacy Choices" link in the footer.
• OpenAI (advertising) - ads shown in ChatGPT (the OpenAI Ads measurement pixel). Only where advertising is enabled for your visit, OpenAI receives pages viewed, the product events listed in Section 11, approximate location derived from IP address, device and browser information, a pseudonymous cookie identifier, the click identifier of an OpenAI ad that brought you here, and the value of a completed purchase, so it can tell us which advertising worked. OpenAI may use this information to measure and personalise advertising, which is the "sharing" described in Section 11. OpenAI does not receive your name, your email address in any form (readable or hashed), your holdings, the content of your research, anything you search for, or anything you ask SAGE through this pixel. You can turn this off at any time using the "Your Privacy Choices" link in the footer.
• Expo - delivery of mobile push notifications to the AstraEye app, and only if you install it and allow notifications. Expo receives the push handle for your device and the words of the notification itself, which are fixed and identical for every recipient: a heading such as "Research run completed" and a line telling you to open the app. It does not receive the name of a project, any holding or symbol, the content of a research report, or anything you ask SAGE. Apple and Google carry the message onward to the device, as they do for every app.
• Sentry - error monitoring.

A current list of material service providers that process personal information on our behalf, and the categories of data and services involved, may be maintained in a separate public subprocessor notice. Market and reference data sources that receive only non-personal reference queries are described separately in our Data Sources and Attributions notice and are not included in the subprocessor list for that data flow.

We may also disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of our users and the platform, and in connection with a business transfer (merger, acquisition, or sale of assets).

8. Data Storage, Security, Location, and Breach Notification

Data is stored with our cloud infrastructure provider (AWS, U.S. region). Sensitive secrets - including any stored account credentials - are encrypted at rest, and data is transmitted over encrypted connections. We maintain a written information security program describing administrative, technical, and physical safeguards for the data we hold. Our safeguards are designed with reference to recognized financial-data security principles, including 16 C.F.R. Part 314. Whether a particular financial-privacy regime applies depends on the activities and regulatory classification of the service; this statement does not claim an exemption from or coverage under that rule.

No online service can guarantee perfect security; you acknowledge the inherent risks of transmitting and storing data online. In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by applicable breach-notification laws, including the Texas Identity Theft Enforcement and Protection Act, Tex. Bus. & Com. Code § 521.053. When that law requires notice to the Texas Attorney General because a breach affects at least 250 Texas residents, the notice must be made as soon as practicable and no later than 30 days after determining that the breach occurred.

9. Data Retention

We retain information for as long as your account is active and as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. Retention windows for security logs, audit logs, and research artifacts follow our internal Data Retention & Deletion Policy. When you close your account, we erase or de-identify your personal information as described in that policy, retaining only what is required for legal or recordkeeping purposes.

Some feature-specific periods are shorter. Authentication sessions have an absolute lifetime of up to 30 days. Generated spoken SAGE chat audio becomes unavailable after 14 days; research anticipated-Q&A audio becomes unavailable after 30 days; and generated audio objects are deleted from active storage no later than 30 days after creation. Security codes become invalid after five minutes; challenge records containing the telephone number and associated security metadata are retained for up to 30 days for fraud prevention and security auditing. Security and administrative audit logs are generally retained for up to two years. Provider copies may remain for the provider periods described in Section 4. Backup, fraud-prevention, tax, billing, compliance, and legal records may be retained for longer where reasonably necessary or legally required.

To enforce the Freelancer rule that an account's own email address, a recovery email address, and a phone number can each receive their one-time Astra Credit grant only once, we retain a keyed, versioned cryptographic hash of the verified phone number, of the verified recovery email address, and of the verified account email address, together with grant status, retry ownership, attempt timestamps, and grant time. Each is hashed under a separate key domain, so these records cannot be matched to one another or to any other hash we retain. We do not store the phone number or either email address itself in that eligibility record. The record may remain after account closure because deleting it would allow the same phone number to claim the grant again. It is used only for grant eligibility, retry, fraud prevention, support, audit, and legal compliance.

10. Sensitive Personal Information

We treat portfolio, holdings, linked-account credentials, and financial-account data as highly sensitive financial information as a matter of company policy. Ordinary portfolio holdings are not, solely for that reason, “sensitive data” under every state privacy statute. Under the TDPSA, statutory sensitive data includes specified trait data, genetic or biometric data processed to uniquely identify a person, data from a known child, and precise geolocation data.

We process financial information only to provide, secure, support, and comply with law for the service you request; we do not use it to infer characteristics about you for advertising, and we do not sell or share it for targeted advertising. The advertising measurement described in Section 11 does not use financial information: apart from the identifiers and device information named for each advertising platform in Section 7, what leaves AstraEye Labs is limited to pageviews, product events, and the value of a completed purchase. We do not collect voiceprints or process generated SAGE audio to identify you. If we process data legally defined as sensitive, we will obtain consent or another authorization required by applicable law and complete any required data-protection assessment. In accordance with Cal. Civ. Code § 1798.121, you may direct us to limit the use of sensitive personal information; because we already limit covered uses to permitted purposes, no additional action is generally required, but you may contact us to confirm.

11. Advertising, Sale, and Sharing

• We do not sell your personal information for money or other valuable consideration.
• We use advertising and analytics services - currently Google Analytics, Google Ads, Meta (the Meta Pixel and Conversions API), and OpenAI (the OpenAI Ads measurement pixel) - to understand how people find AstraEye Labs and to reach people who may be interested in it. Depending on your choices and your location, this can involve "sharing" personal information for cross-context behavioral (targeted) advertising as those terms are defined under California and similar state laws.
• We do not engage in profiling that produces legal or similarly significant effects about you (see Section 12).
• Content we send to a tool or AI assistant you authorize through the Research API is sent at your direction and is not a sale or sharing for advertising (see Section 6A).

What is and is not shared. Apart from the identifiers and device information named for each advertising platform in Section 7, what leaves AstraEye Labs is limited to pageviews, a small set of product events (for example: creating an account, starting checkout, connecting a portfolio, starting a research run or opening its results), and the value of a completed purchase. For a completed purchase, Meta also receives a one-way hashed (SHA-256) copy of your email address - never the address itself - so it can match the purchase to its own records. Each event also records which AstraEye product it happened in - the website or the mobile app - so we can tell the two apart. A research event includes the type of analysis - for example "technical momentum" - so we can tell which parts of the product people arrive for. We do not share the content of your research, your questions to SAGE, your holdings, or the identity of any asset you view, search for, or run research on. Those are treated as your financial information and are never sent to an advertising platform.

Categories shared, in the last 12 months. In the preceding twelve months we have shared the following categories of personal information for cross-context behavioral advertising, and only with the category of third party shown:

We have not sold personal information in that period, and we have not shared any other category - in particular no sensitive personal information, no financial account information, and no information about your holdings or your research.

From September 25, 2026, the same categories may also be shared with Meta, as described in Section 7. For Meta, the Identifiers category also includes the one-way hashed copy of your email address sent with a completed purchase.

From October 4, 2026, the same categories may also be shared with OpenAI, for ads shown in ChatGPT, as described in Section 7. For OpenAI, the Identifiers category also includes the click identifier of an OpenAI ad, and never includes your email address in any form.

Who receives it. Today this is Google, Meta and OpenAI only, as described in Section 7. We will not add another advertising platform - and will not begin sending information to one - without updating this policy first and asking you to accept the updated version.

Your control. Every page carries a "Your Privacy Choices" control at the bottom - in the footer on most pages, and in a short legal line on the few full-screen pages that have no footer. That control is our "Do Not Sell or Share My Personal Information" mechanism, and turning advertising off there stops the sharing described above. In the EEA, the United Kingdom and Switzerland nothing is loaded until you opt in. You also retain the rights described in Section 13.

12. Automated Decision-Making

AstraEye Labs uses AI to generate informational research for you to evaluate. We do not use automated processing to make decisions that produce legal or similarly significant effects about you (such as credit, employment, or benefits decisions). You make all financial decisions yourself. See the Risk and AI Disclosure.

Tests generated for an educational institution are marked automatically, and the score is a fact about that test and nothing else. The institution's agreement with us requires it not to use those scores as the sole basis for any decision producing a legal or similarly significant effect on you - a final grade, progression, discipline, admission, funding, or employment - and to apply meaningful human review to any such decision they inform. Marking is not a decision we make about you.

13. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code § 1798.100 et seq., the Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code § 541.001 et seq., and similar laws in Virginia, Colorado, Connecticut, and other states. In accordance with those laws, and subject to their exceptions, you may exercise:

• Right to know / access the personal information we hold about you and how we use and disclose it (Cal. Civ. Code §§ 1798.100, 1798.110, 1798.115).
• Right to correct inaccurate personal information (Cal. Civ. Code § 1798.106).
• Right to delete your personal information (Cal. Civ. Code § 1798.105).
• Right to data portability - obtain a copy in a portable format.
• Right to opt out of the sale or sharing of personal information and targeted advertising (Cal. Civ. Code § 1798.120). We do not sell your personal information, and we do not profile you in ways that produce legal or similarly significant effects (see Section 12). We do share limited information for advertising as described in Section 11, and you can opt out at any time using the footer link described there.
• Right to limit the use of sensitive personal information (Cal. Civ. Code § 1798.121; see Section 10).
• Right to non-discrimination for exercising a right (Cal. Civ. Code § 1798.125) - we will not deny service, charge different prices, or provide a different quality of service because you exercised a right.

You can manage much of your data directly in the product - for example, account settings, notification preferences, disconnecting account connections, and closing your account.

14. How to Exercise Your Rights, Verification, and Appeals

To make a privacy request, email privacy@astraeyelabs.io. We will verify your identity (typically by confirming control of your account email) before acting, and will respond within the timeframe required by applicable law (generally within 45 days, extendable where permitted). You may use an authorized agent to submit a request on your behalf with proof of authorization.

Appeals. In accordance with the TDPSA, Tex. Bus. & Com. Code § 541.055, and similar state laws, if we decline your request you may appeal by replying to our decision or emailing privacy@astraeyelabs.io with "Appeal" in the subject. We will respond to appeals within the time required by applicable law (under the TDPSA, within 60 days). If your appeal is denied, you may contact your state Attorney General (for example, the Texas Attorney General for Texas residents, who accepts complaints in accordance with Tex. Bus. & Com. Code § 541.155).

15. Cookies, Sessions, and Global Privacy Control

We use strictly necessary cookies and similar technologies to keep you signed in, remember preferences, and secure the platform (including protection against cross-site request forgery). Session cookies may be associated with IP address, browser/user-agent, and security records. Where you have not declined them, we also use analytics and advertising cookies set by the services named in Section 7; Section 11 describes what they carry and how to turn them off.

We honor Global Privacy Control (GPC). If your browser or extension sends that signal, advertising is switched off for your visit without you needing to do anything else - including if you previously turned advertising on here, in which case the signal takes precedence for as long as you send it. GPC only ever switches advertising off; it never turns it on, so if you have declined advertising that stays declined either way. It does not stop first-party analytics, which measures site usage and which you can decline separately using the footer link.

16. Children

AstraEye Labs is not directed to children and is intended for users who are 18 or older. In accordance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6506, we do not knowingly collect personal information from children under 13 (and, as a financial product, do not intend to collect from anyone under 18). If we learn that we have collected information from a child, we will delete it.

17. Users Outside the United States

AstraEye Labs is operated from the United States and is intended for users in the jurisdictions we serve. Your information is stored and processed in the United States. If you access the service from outside the U.S., you understand that your information will be transferred to and processed in the United States, which may have different data-protection laws than your location.

We do not currently offer the service in every country. Availability is limited by applicable sanctions and export-control laws and by the regions we are able to support, and it may change over time. Where the service is not offered, account registration is refused; if you already hold an account, you may still sign in to review and manage your account settings or to close your account. Requests for a copy of your data are handled as described in the rights sections above, through privacy@astraeyelabs.io.

18. Email Communications

AstraEye Labs uses email for account, service, and optional product or research communications. We do not purchase, rent, scrape, or sell email-address lists, and we do not send cold outreach.

Messages we send

Service and account messages may include:

• verification of an email address supplied during account registration;
• password-reset and new-device approval requests initiated by the account holder;
• important account-security notices; and
• payment receipts and payment-failure notices; and
• important service or legal notices.

Optional product, research, and notification messages may be sent only as permitted by law and are controlled by the recipient's notification preferences. They are not required to use AstraEye.

Address verification and abuse prevention

Before an address is verified, AstraEye sends only the registration verification message. Authentication email endpoints are rate-limited by recipient and network source, return non-enumerating responses, and use expiring, single-use tokens.

Bounces, complaints, and suppression

AstraEye processes delivery, bounce, complaint, rejection, and rendering-failure feedback from its email provider. Permanent bounces and complaints are automatically added to provider-level and application-level suppression lists. Suppressed recipients are blocked before another provider send is attempted.

We monitor bounce and complaint rates and investigate alarms before they approach provider enforcement thresholds. We test this feedback path using the provider's mailbox simulator.

Unwanted or suspicious email

If you receive an AstraEye message you did not expect, do not follow its links. Forward the message, including its full headers when possible, to spam@astraeyelabs.io.

For general help, contact support@astraeyelabs.io or visit the authenticated support center after signing in.

Sender identity

Official AstraEye transactional email is sent from the astraeyelabs.io domain. AstraEye configures SPF, DKIM, DMARC, and a custom MAIL FROM domain to authenticate its mail.

19. Educational Institution Accounts

Some accounts are created by an educational institution that has a separate written agreement with AstraEye. This section describes what is different about them. Everything else in this policy applies to you as it does to anybody else.

How the account starts. The institution sends us the email address of each person it wants to invite and we email them a single-use invitation link. The institution decides who is invited; we do not obtain your address from anywhere else. The institution warrants to us that everyone it invites is 18 or older.

What the institution can see. An instructor can see, for the students in their own classes, what was assigned, which tests were submitted, the score for each, and the monthly total and completion percentage. The institution's administrator can see the same figures across the institution. They can export them. They cannot see your SAGE conversations, your settings, or anything you do outside the work assigned to you.

These accounts are watchlist-only. No brokerage connection, exchange API credential, self-custody wallet connection, or portfolio import is available on them. There is no personal financial data of yours in the product to disclose to anyone, because the account structurally cannot receive it. Student accounts additionally cannot create or run research.

Where the record is held. The monthly totals are stored against an institution-scoped reference rather than against your user id. While your membership of the institution exists, that reference can be resolved to you; after the severance described below it cannot be resolved to you by us at all.

Retention, and what happens when the agreement ends. The institution may export its gradebook for 30 days after its agreement with us ends. At the end of that period we sever the retained monthly totals from every identifier that links them to an individual - the institution-scoped reference, the membership record that resolves it, the class rosters, and the assignment and test records

• and we do it whether or not the institution exported anything. What is left is a set of monthly figures that we cannot attribute to a person. An export the institution has already taken is under the institution's own control and this policy does not reach it; the institution's own privacy notice governs it.

Your rights are unaffected. The rights in Sections 13 and 14 are yours, not the institution's, and the institution cannot waive them on your behalf. You can exercise them directly with us at privacy@astraeyelabs.io whether or not the institution agrees.

20. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated as required by law, and the "Effective date" above will be updated.

21. Contact

Questions or privacy requests may be sent to:

privacy@astraeyelabs.io

Mailing address:

AstraEye Labs LLC
11721 Pillion Pl
Manor, TX 78653-3767