Privacy Policy
Privacy Policy
This Privacy Policy applies to all users of plutonal.ai regardless of their country of residence. By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this document. If you do not agree, you must cease using the Platform immediately.
Who We Are
plutonal.ai is a quantitative investment research and analysis platform operated by Plutonal Inc, a corporation incorporated in the State of Delaware, United States of America (“Plutonal”, “we”, “us”, or “our”). Our registered address is 1209 Orange Street, Wilmington, Delaware 19801, USA. Our primary contact email for privacy matters is: hello@plutonal.ai.
Plutonal is not a financial services provider, investment adviser, broker-dealer, or licensed financial intermediary. We are a technology and information company. This distinction is material to the lawful basis on which we process your data.
Scope and Application
2.1 Platforms and Services Covered
This Privacy Policy applies to all personal information collected through:
- The plutonal.ai website and all associated subdomains
- The Plutonal web application and any mobile applications
- The @askplutonal social media accounts and any interactive features associated with those accounts
- Email communications sent to or from Plutonal
- Any beta testing, waitlists, or pre-launch programmes
It does not apply to any third-party websites or services that Plutonal may link to. We are not responsible for the privacy practices of third parties.
2.2 Global Application and Jurisdictional Compliance
Plutonal Inc is incorporated in Delaware and operates globally, serving users across every major market. This Policy is designed to meet or exceed the requirements of the following frameworks simultaneously:
- United States (Federal): Children’s Online Privacy Protection Act (COPPA); CAN-SPAM Act; Electronic Communications Privacy Act
- United States (Delaware): Delaware Personal Data Privacy Act (DPDPA), effective 1 January 2025
- United States (California): California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
- United States (other states): Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and all other enacted state privacy statutes
- European Union: General Data Protection Regulation (GDPR)
- United Kingdom: UK GDPR and the Data Protection Act 2018
- India: Digital Personal Data Protection Act 2023 (DPDP Act) and Digital Personal Data Protection Rules 2025
- Australia: Privacy Act 1988 (Cth) as amended by the Privacy and Other Legislation Amendment Act 2024, and the Australian Privacy Principles (APPs)
- Singapore: Personal Data Protection Act 2012 (PDPA)
- Canada: Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation
- Brazil: Lei Geral de Protecao de Dados (LGPD)
- South Africa: Protection of Personal Information Act 2013 (POPIA)
- Japan: Act on the Protection of Personal Information (APPI) as amended
- South Korea: Personal Information Protection Act (PIPA)
- Middle East / UAE: Federal Decree-Law No. 45 of 2021 on Personal Data Protection
Where a user’s local mandatory law provides greater protections than this Policy, we will comply with those additional requirements. If there is any conflict between the terms of this Policy and the requirements of a local mandatory law that cannot be contractually displaced, the mandatory local law shall prevail to the minimum extent necessary.
What Information We Collect
3.1 Information You Provide Directly
When you register, subscribe, or interact with us, we may collect:
- Full name and email address
- Username or display name
- Billing information (processed by our payment processor; we do not store full card details)
- Country and timezone
- Communications you send to us, including support requests and feedback
- Any queries or prompts you submit through the Platform
3.2 Information Collected Automatically
When you use the Platform, we automatically collect certain technical information, including:
- IP address and approximate geolocation derived from it
- Browser type, operating system, and device identifiers
- Pages visited, time spent, clickstream data, and referral source
- Platform usage patterns, including which features are used and when
- Session identifiers and access timestamps
- Credit usage and subscription tier activity
3.3 Cookies and Tracking Technologies
We use cookies and similar tracking technologies for the following purposes:
- Strictly necessary cookies: Required for the Platform to function (session management, authentication). These cannot be disabled.
- Performance cookies: Help us understand how users interact with the Platform. Used in aggregate, anonymised form only.
- Preference cookies: Remember your settings and display preferences.
- Analytics cookies: Used to understand traffic sources and user behaviour in aggregate.
We do not use cookies for advertising or retargeting purposes. You may manage non-essential cookies through our cookie preference centre. Disabling performance or preference cookies may affect your experience of the Platform.
3.4 Information We Do Not Collect
We do not collect, and you must not submit:
- Government-issued identification numbers (e.g., passport numbers, tax file numbers, social security numbers) unless required for mandatory regulatory identification, in which case this will be stated separately at the point of collection
- Biometric data
- Health or medical information
- Information about minors under the age of 18
How We Use Your Information
4.1 Primary Purposes
We use your personal information to:
- Create and manage your account
- Provide access to the Platform and its features in accordance with your subscription tier
- Process payments and manage credit balances
- Respond to your support requests and enquiries
- Send you transactional communications including receipts, account notices, and platform updates
- Detect, investigate, and prevent fraudulent or unauthorised use
- Comply with legal and regulatory obligations
4.2 Secondary Purposes (With Your Consent or Legitimate Interest)
- Send you marketing communications about new features, products, or research content (you may opt out at any time)
- Conduct aggregate, anonymised analysis of Platform usage to improve our services
- Develop and test new features and analytical models
- Fulfil any legal obligation arising from a court order or regulatory requirement
4.3 What We Do Not Do With Your Information
We expressly confirm that:
- We do not sell your personal information to any third party under any circumstances
- We do not use your personal information to provide you with personalised investment advice or recommendations
- We do not share your personal information with advertisers for targeted advertising
- We do not use your queries to construct a financial profile of you that is shared with any third party
4.4 Automated Decision-Making
Our Platform uses automated processes to generate quantitative research outputs in response to your queries. These outputs are general statistical and analytical outputs and do not constitute decisions about you as an individual. They are not used to determine your eligibility for financial products, credit, insurance, or any similar purpose.
In accordance with the Privacy and Other Legislation Amendment Act 2024 (Cth) and in preparation for the transparency obligations taking effect on 10 December 2026, we disclose that automated processes are used to generate research outputs. These do not significantly affect your legal rights or interests as a data subject.
Legal Basis for Processing Your Information
5.1 United States (Delaware DPDPA, CCPA/CPRA, and Other State Laws)
Plutonal Inc is incorporated in Delaware. Under the Delaware Personal Data Privacy Act (DPDPA), effective 1 January 2025, we process your personal data on the following bases: contract performance (to provide the services you have subscribed to); legal obligation (to comply with applicable law); legitimate interest (for fraud prevention, platform security, and service improvement); and consent (for marketing communications and non-essential cookies). Delaware residents may exercise their rights under the DPDPA by contacting hello@plutonal.ai. Complaints regarding DPDPA compliance may be submitted to privacy@delaware.gov.
For California residents under the CCPA and CPRA: you have the right to know what personal information we collect and how it is used, to request deletion of your personal information, to correct inaccurate personal information, to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising), and to non-discrimination for exercising these rights. To exercise any California privacy right, contact hello@plutonal.ai.
For residents of other US states with enacted privacy laws (Virginia, Colorado, Connecticut, Texas, and others): we process personal data on equivalent bases and will honour your rights as required by the applicable state law. Contact hello@plutonal.ai to exercise any such right.
5.2 European Union and United Kingdom (GDPR / UK GDPR)
We rely on the following lawful bases for processing under Article 6 GDPR:
- Contract performance: Processing necessary to provide the services you have subscribed to
- Legal obligation: Processing required to comply with applicable law
- Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where our interests are not overridden by your fundamental rights
- Consent: Marketing communications, non-essential cookies, and any processing not covered by the above bases
5.3 India (DPDP Act 2023 / DPDP Rules 2025)
We process your personal data on the basis of your consent and, where applicable, on the basis of legitimate use as defined under the DPDP Act. We will provide a clear, plain-language privacy notice at the point of collection for any data collected in connection with our services to users in India. You may withdraw your consent at any time by contacting hello@plutonal.ai, subject to the terms governing your account.
5.4 Australia (Privacy Act 1988 as amended)
We collect, hold, use, and disclose personal information in accordance with the Australian Privacy Principles. We take reasonable steps to ensure information is collected for a legitimate purpose and not used or disclosed for secondary purposes without consent, except where permitted or required by law.
5.5 Brazil (LGPD)
We process personal data in accordance with the Lei Geral de Protecao de Dados. Processing is based on contract performance, legitimate interest, legal obligation, or consent as applicable. Brazilian users may exercise their rights under the LGPD by contacting hello@plutonal.ai.
5.6 South Africa (POPIA)
We process personal information in accordance with the Protection of Personal Information Act 2013. Processing is based on a lawful ground including contract performance, consent, or legitimate interest. South African users may contact hello@plutonal.ai to exercise their rights or lodge a complaint with the Information Regulator of South Africa.
5.7 All Other Jurisdictions
Where we collect your personal data in connection with services offered to you in your country of residence, we process that data in accordance with the local data protection law of your jurisdiction to the extent it applies. We will respond to any request to exercise your privacy rights under local law by contacting hello@plutonal.ai.
How We Share Your Information
6.1 Service Providers
We share personal information with carefully selected third-party service providers who assist in delivering our Platform. These providers are engaged under contractual terms that require them to process your data only on our instructions and to implement appropriate security measures. Categories of service providers include:
- Cloud hosting and infrastructure providers
- Payment processing providers (who handle billing data under their own PCI-DSS compliant environments)
- Analytics and product monitoring services
- Email delivery and customer communications platforms
- Security and fraud detection services
6.2 Legal and Regulatory Disclosures
We may disclose your personal information where we are required to do so by:
- A valid court order, subpoena, or legal process
- A request from a regulatory or law enforcement authority with lawful jurisdiction
- Applicable law in any jurisdiction where we operate
Where legally permitted, we will notify you of any such disclosure request before complying. We will challenge any request we consider to be overly broad, disproportionate, or not legally valid.
6.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring entity. We will notify you by email or through a prominent notice on the Platform before your information becomes subject to a materially different privacy policy.
6.4 Aggregate and Anonymised Data
We may share aggregate, de-identified, or anonymised data that cannot reasonably be used to identify you. This includes statistical data about Platform usage, which may be shared with investors, partners, or published for research purposes.
International Data Transfers
As a globally operating platform incorporated in Delaware, USA, and utilising cloud infrastructure that may be located in various jurisdictions, your personal information may be transferred to and processed in countries other than your country of residence.
We take the following steps to ensure that international transfers of personal information are made with appropriate safeguards in place:
- We assess the privacy laws of recipient countries to determine whether they provide comparable protection to Australian Privacy Principles
- Where required by GDPR or UK GDPR, we implement Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to non-adequate countries
- For transfers to and from India, we comply with the cross-border transfer requirements of the DPDP Act 2023 and DPDP Rules 2025 as they take effect
- We contractually require all service providers handling your data to implement security measures equivalent to those we maintain ourselves
By using the Platform, you acknowledge and consent to the transfer of your information internationally in accordance with the safeguards described in this section.
Data Retention
We retain your personal information only for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law. Our general retention principles are as follows:
- Account data: Retained for the duration of your active account and for a period of 7 years following account closure, to satisfy applicable statutory requirements and to defend against potential legal claims
- Billing records: Retained for a minimum of 7 years in accordance with applicable US federal and state taxation law and any other applicable statutory requirements
- Support communications: Retained for 3 years from the date of the communication
- Usage logs and analytics data: Retained in anonymised or aggregated form for up to 3 years
- Cookies and session data: Retained for the period set out in our cookie preference centre, typically ranging from session-only to 12 months
When we no longer require your personal information, we will securely destroy or permanently de-identify it in accordance with our data destruction procedures.
Your Rights
Depending on your country of residence, you may have some or all of the following rights in respect of your personal information:
- Right of access: To request a copy of the personal information we hold about you
- Right to rectification: To request that we correct inaccurate or incomplete information
- Right to erasure: To request that we delete your personal information, subject to our legal obligations to retain certain records
- Right to restriction: To request that we restrict processing of your personal information in certain circumstances
- Right to data portability: To receive your personal information in a structured, machine-readable format (GDPR users)
- Right to object: To object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing
- Right to lodge a complaint: With your local data protection authority
To exercise any of these rights, please write to us at hello@plutonal.ai. We will respond within 30 days of receiving your request, or within the shorter period required by applicable law. We may need to verify your identity before processing your request.
You will not be charged a fee for making a request unless your request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or decline to act on the request.
Security of Your Information
We implement technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, and destruction. These measures include:
- Encryption of data in transit using industry-standard TLS protocols
- Encryption of data at rest
- Access controls and role-based permissions limiting who can access personal data
- Regular security assessments and penetration testing
- Incident response and data breach notification procedures
No method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we commit to implementing and maintaining reasonable safeguards appropriate to the nature of the data we hold and the risks associated with its processing.
10.1 Data Breach Notification
In the event of a data breach that is likely to result in harm to affected individuals, we will notify relevant regulators and affected users in accordance with the applicable law of each jurisdiction, including:
- United States: We will notify affected individuals and, where required, state attorneys general or other relevant authorities in accordance with applicable state breach notification laws
- European Union / UK: Notification to the relevant supervisory authority within 72 hours of becoming aware of the breach, and notification to affected individuals where the breach is likely to result in a high risk to their rights and freedoms
- India: Notification to affected Data Principals and the Data Protection Board of India within 72 hours of becoming aware of the breach, in accordance with the DPDP Act 2023
- Australia: Notification to the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches scheme
- All other jurisdictions: In accordance with applicable local breach notification law
Children's Privacy
The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from any person under the age of 18. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately at hello@plutonal.ai. We will take prompt steps to delete that information.
In accordance with the Children’s Online Privacy Code framework being developed under the Privacy Act 1988 (Cth), we will update this section as that code takes effect.
Third-Party Websites and Services
The Platform may contain links to third-party websites, data sources, or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices or content of any third-party website. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Post the updated Policy on plutonal.ai with a revised effective date
- Notify registered users by email at least 14 days before the change takes effect
- Where required by law, seek your renewed consent before applying material changes to existing data processing activities
Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of those changes, to the extent permitted by applicable law.
Contact Information and Complaints
For any questions, requests, or complaints relating to this Privacy Policy or our data practices, please contact us:
- Email: hello@plutonal.ai
- Post: Legal, Plutonal Inc, 1209 Orange Street, Wilmington, Delaware 19801, USA
We will acknowledge your request within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction, including:
- United States (Delaware): Delaware Department of Justice, privacy@delaware.gov
- United States (California): California Privacy Protection Agency (CPPA)
- United States (Federal / other): Federal Trade Commission (FTC) or your state attorney general
- European Union: Your local data protection supervisory authority (e.g., the CNIL in France, the BfDI in Germany, or equivalent)
- United Kingdom: The Information Commissioner’s Office (ICO), ico.org.uk
- India: The Data Protection Board of India (once fully operational)
- Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au
- Singapore: Personal Data Protection Commission (PDPC), pdpc.gov.sg
- Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
- Brazil: Autoridade Nacional de Protecao de Dados (ANPD)
- South Africa: Information Regulator of South Africa, inforegulator.org.za
- Japan: Personal Information Protection Commission (PPC)
- South Korea: Personal Information Protection Commission (PIPC)
- All other jurisdictions: Your applicable national or regional data protection authority