Basic Investor

Home / Privacy

Privacy notice

Last updated September 24, 2026

Our Core Privacy Commitment

Basic Investor is built on three foundational principles: privacy-first architecture, zero product conflicts, and direct consumer alignment. We do not sell, rent, or trade your personal information. We do not display third-party advertisements or use invasive tracking pixels.

Client-Side Financial Calculations

All interactive calculators, decision sandboxes, portfolio models, and curriculum quizzes operate locally inside your web browser by default. Your portfolio values, income details, debt balances, and scenario inputs are processed using client-side JavaScript. Unless you explicitly choose to save a portfolio or run an optional AI audit, this financial data is not transmitted to or stored on our servers.

Account Credentials & Saved Data

When you create a Basic Investor Free, Pro, or Premium account:

  • Authentication: Passwords are protected using industry-standard PBKDF2 with SHA-256 and 100,000 key-derivation iterations. Alternatively, secure one-time magic links delivered to your email can be used. We never store plaintext passwords.
  • Data at Rest: Email addresses are encrypted at rest using AES-GCM-256 with isolated cryptographic nonces. Saved portfolio parameters, IPS goals, and diagnostic results are securely tied to your authenticated session.
  • Local Storage: Temporary preferences (such as selected jurisdiction and calculator state) are stored directly in your browser's localStorage for your convenience and can be cleared at any time.

Artificial Intelligence & Cloud Processing

When you use optional AI features (such as the AI Portfolio Audit or AI Education Tutor):

  • The specific financial inputs you provide (e.g., asset allocation percentages, time horizon, risk profile) are processed via Cloudflare Workers AI strictly to generate educational analysis and answers.
  • We do not transmit personal identifying details (such as your name or email) to AI models.
  • User inputs are not used to train public artificial intelligence models.

Subscription Billing & Payment Security

Payment processing for Pro and Premium subscriptions is handled directly by Stripe, a PCI Service Provider Level 1 certified processor. Basic Investor never sees, processes, or stores your credit card number or bank details. Stripe provides us only with a customer token and subscription status confirmation.

Technical Analytics & Infrastructure

We use privacy-first web analytics to monitor aggregate website traffic, page performance, and system health. Our analytics configuration does not collect personal data, track users across third-party websites, or use persistent profiling cookies. Server-side request logs are maintained solely for security protection and abuse mitigation.

Communications & Email Delivery

If you submit an inquiry through our contact form, we use your email address solely to answer your question. If you opt into email reminders for portfolio rebalancing or drift alerts, transactional emails are sent via Resend. We will never sell your email to third-party marketing lists, and automated reminder emails include a single-click unsubscribe link.

Your Rights & Data Deletion (PIPEDA & GDPR Compliance)

You have full ownership of your personal and financial planning data under Canadian PIPEDA, EU/UK GDPR, and applicable privacy regulations. You may at any time exercise your rights directly via self-serve controls:

  • Data Portability & Machine-Readable Export: Export a complete, structured JSON archive of your account data directly from your Dashboard under "Data Portability & Privacy Rights" (or via /api/user/export). This archive includes your profile, decrypted email, learning progress, saved investment portfolios, Investor Policy Statements, financial health scores, metric snapshots, retention settings, course certificates, and communication history.
  • Self-Serve Account Erasure & Immediate Deletion: Permanently erase your account and all associated records directly from your Dashboard ("Delete My Account" button). Upon confirmation:
    • Any active recurring billing or Stripe subscriptions are cancelled immediately via the Stripe API.
    • All database records—including portfolio allocations, IPS records, progress metrics, notifications, lead records, and certificates—are permanently and irreversibly purged via cascading deletion.
    • All active login sessions across devices are invalidated in Cloudflare KV and your authentication cookie is cleared.
  • Local Browser Storage: Clear your local browser cache, theme preferences, and locally cached portfolio drafts at any time using your browser settings or dashboard cache clearing tools.
  • Manual Inquiries: You may also request data access, correction, or deletion assistance by emailing our privacy team at [email protected].