AlphAIAlphAI — Financial news for AI agents

Privacy Policy

Last updated: November 2, 2026

Introduction

This Privacy Policy explains how ARDOR 0608 OOD ("we") collects, uses, and protects your personal data when you use AlphAI at alphai.io (the "Service") — an AI-curated financial news platform that aggregates market-moving stories from public sources, enriches them with AI, and serves them via our website, REST API (api.alphai.io), and MCP server (mcp.alphai.io). We act as the data controller under the GDPR and applicable Bulgarian law. This policy also covers alphai-tui, our open-source terminal client (see the alphai-tui section below).

  • Company: ARDOR 0608 OOD
  • Address: Azman Dere 423-3, Priselci village, 9131, Bulgaria
  • Email: info@alphai.io

Information We Collect

  • Account data: email, full name, and (if provided) a profile avatar. Passwords are hashed if you register directly.
  • Google sign-in: if you use Google OAuth, we receive your Google name, email, and profile picture.
  • Technical data: IP address, browser and device information, and server logs.
  • Payment data: handled entirely by Stripe — we never store card details, only your Stripe customer and subscription IDs.
  • Saved preferences: the tickers you add to your watchlist or subscribe to for news alerts (paid tiers). Stored with your account; not shared publicly.
  • Sales inquiries: if you submit the /contact form, we keep your name, email, use case, expected volume, and referral source to respond. Not used for marketing.

Legal Basis for Processing

  • Contract: to provide the news platform, REST API, and MCP server.
  • Legitimate interests: to secure, maintain, and improve the Service.
  • Consent: for analytics/marketing trackers and any future marketing email (opt-in only).
  • Legal obligation: to comply with applicable law.

How We Use Your Information

  • Create and manage your account and authenticate access.
  • Provide AI-curated financial news and developer access (REST API, MCP server).
  • Process subscriptions and payments via Stripe.
  • Send service emails (verification, password reset, receipts) and respond to support requests.
  • Maintain security, prevent abuse, and improve the Service.

We do not run marketing newsletters today. If we introduce them, they will be opt-in only.

News Sources & AI Enrichment

Our feed is built from publicly available sources and enriched with AI: articles come from GDELT (a public, openly accessible news index), and summaries, categories, and relevance scores (1–10) are generated using OpenAI's API. Original article links and publisher attribution are preserved on every article.

Note: news content comes from public publishers via GDELT and is processed by OpenAI. We do not guarantee its completeness, timeliness, or accuracy, and we retain the article text only for a short window needed to produce and quality-check each enrichment, after which it is removed.

Developer Surfaces (REST API & MCP)

If you use our REST API or MCP server, we also process:

  • API keys: stored only as an SHA-256 hash plus a masked prefix (e.g. ak_live_xxxx…). The plaintext is shown once at creation and never persisted; revoked keys are kept inactive for audit.
  • MCP OAuth credentials: short-lived client metadata and rotating refresh tokens (chain-reuse detection revokes the grant on replay), held in Redis with a TTL.
  • Request logs: for REST requests made with an API key we record the key and account, the endpoint and query parameters, the response status and timing, the client IP address and user agent, and the error message when a request fails. We keep every failed request and a sample of successful ones. For MCP we record the tool called with its arguments, the MCP client name, the status and timing, the IP address and the user agent. We use these logs to answer support questions, debug errors and stop abuse, and delete them after about 90 days.
  • Rate limits and errors: usage counters per API key are kept briefly in Redis. When error tracking (Sentry) is enabled, an error report may include the IP address of the failed request.

alphai-tui Terminal Client

alphai-tui is our open-source terminal client for Windows, macOS and Linux (source code at github.com/makeev/alphai-tui). It runs on your computer and sends no analytics or telemetry. We never learn which screens you open, and we only see the tickers you look up when you use the AlphAI features described below. This section explains what the app keeps on your computer, where its network requests go and how to delete what it stores.

Data stored on your computer

  • Settings file (config.toml): your watchlist, display and price-source settings, the API keys you type into Settings (AlphAI, Finnhub, Alpaca, Tiingo) and any portfolio positions you add, meaning the ticker, the quantity and the average price paid. On Windows the file is %APPDATA%\alphai-tui\config.toml. On macOS and Linux it is ~/.config/alphai-tui/config.toml (or under $XDG_CONFIG_HOME), unless you point the app elsewhere with --config. Next to it the app keeps an empty config.toml.lock file, which stops two open copies of the app from overwriting each other's changes. If the settings file ever fails to load, the app saves a copy named config.toml.broken before it writes a new one, so the keys in it aren't lost.
  • Quote cache (quotes.json): the last prices and chart candles received for your symbols, shown at startup while a price source is slow or blocked. On Windows the file is %LOCALAPPDATA%\alphai-tui\quotes.json, on macOS ~/Library/Caches/alphai-tui/ and on Linux ~/.cache/alphai-tui/. Entries older than 7 days are dropped when the app starts. The cache holds market data only, not your keys or positions.

How these files are protected

API keys are stored in the settings file as plain text. The app doesn't encrypt them, so anyone who can read the file can use your keys. On macOS and Linux the app keeps the file readable and writable by your user account only (permissions 0600). On Windows the files sit in your user profile and keep its default permissions: your account, administrators and the SYSTEM account can open them, other standard users can't. If your organization uses roaming profiles, Windows may copy the Roaming folder that holds config.toml to its servers. To keep keys out of the file, set them as environment variables instead (ALPHAI_API_KEY, FINNHUB_API_KEY, APCA_API_KEY_ID with APCA_API_SECRET_KEY, TIINGO_API_KEY). The app prefers them over the file and never writes them to it.

Network requests

  • Market prices come straight from the provider you pick: Yahoo Finance by default (no key needed), or Finnhub, Alpaca or Tiingo with your own key. Pre- and post-market prices may also come from Alpaca or Yahoo Finance, depending on the extended-hours setting. These requests go from your computer to the provider and carry the tickers on screen, your key for that provider and your IP address. AlphAI doesn't receive or store them, and each provider's own privacy policy applies.
  • News, SEC filings, earnings and the economic calendar come from api.alphai.io, and only once you enter an AlphAI API key. Without one the app makes no requests to AlphAI. These requests carry your key, the tickers and filters on screen and a user agent with the app version. We handle them like any other REST API request: they go into the request logs described above and are deleted on the same schedule.
  • Links: when you open an article or a filing, the app hands the link to your web browser. The site you land on (alphai.io, the publisher or SEC.gov) applies its own policy from there.

Deleting your data

Uninstalling alphai-tui removes the program but leaves your files in place. To remove them, delete the alphai-tui folders listed above (on Windows, %APPDATA%\alphai-tui and %LOCALAPPDATA%\alphai-tui). You can also clear a single key in Settings or remove a position from the portfolio, and the app takes it out of the file. Request logs we hold for your AlphAI key are deleted with your account, or earlier on request (see Your GDPR Rights below).

Data Sharing

We share data only with providers needed to run the Service:

  • Stripe — payment processing (handles all card data directly).
  • Google — sign-in via Google OAuth / One Tap.
  • Mailgun (EU) — transactional email (verification, password reset, sales-lead notifications).
  • OpenAI — news enrichment from public articles; no personal account data is sent.
  • GDELT — public news index we ingest from; receives no personal data from us.
  • Cloud hosting — application hosting and storage.
  • Analytics & monitoring — PostHog (EU, first-party usage), Ahrefs Web Analytics (cookieless traffic counts) and Sentry (optional error tracking). Consent-gated trackers (Google Analytics, Google Ads, Facebook Pixel, Yandex Metrica) load only after you accept analytics cookies.
  • PR Newswire (Cision) — on licensed press release pages, a pixel that counts views for PR Newswire. It loads only if you accept the PR Newswire service in the consent banner. Cision then receives your IP address and browser details and handles them under its own privacy policy (cision.com/legal/privacy-policy).

We may also disclose data when required by law, and may transfer it as part of a merger, acquisition, or sale of assets.

International Data Transfers

Where data is processed outside the European Economic Area (EEA), we rely on appropriate safeguards — Standard Contractual Clauses or European Commission adequacy decisions.

Data Retention

  • Account data: kept while your account is active; deleted within 30 days of a deletion request (aggregated, non-identifying analytics may remain).
  • Payment data: retained as required by financial law (typically 7 years).
  • API and MCP request logs: about 90 days.
  • Technical logs: up to 12 months.

Your GDPR Rights

You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. To exercise any of these, email info@alphai.io with the subject "Data Protection Request"; we respond within 30 days. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your local supervisory authority.

Data Security

We protect your data with encryption in transit and at rest, need-to-know access controls, bcrypt password hashing, and JWT-based sessions with rotating refresh tokens. Two-factor authentication is not currently offered.

Minors

The Service is not intended for anyone under 16. We do not knowingly collect data from minors and will delete it if we become aware of it.

Changes to This Policy

We may update this policy periodically and will post the revised version here, updating the date above. Continued use after changes take effect constitutes acceptance.

Contact

ARDOR 0608 OOD

  • Address: Azman Dere 423-3, Priselci village, 9131, Bulgaria
  • Email / DPO: info@alphai.io

Supervisory Authority

Commission for Personal Data Protection (Bulgaria)

  • Website: www.cpdp.bg
  • Email: kzld@cpdp.bg