Privacy Policy

DataExpansed LLC (“Company,” “we,” “us,” or “our”) operates the Moneyta platform (“Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using the Service, you agree to the practices described below.

1. Information We Collect

1.1 Information you provide

• Account information: name, email address, and authentication credentials (managed by our authentication provider). If you joined our earlier waitlist, your email address is held by the same provider until you create an account or ask us to remove it
• Portfolio and books data: stock tickers, share quantities, cost basis, broker name, account label, account type, transactions, tax lots, ledger and general-ledger entries, target allocations, net-worth snapshots, and notes you enter or paste into the Service
• Other assets you add: real estate (including property addresses, mortgage details, rental income, expenses, and documents you upload), vehicles and vehicle loans, and Vault items (encrypted as described in Section 5)
• Broker connections: if you enable broker sync, the connection identifiers and read-only account and holdings data returned by your broker, under the separate Broker Sync agreement
• Research activity: fund managers and tickers you follow, filing acknowledgments, idea-pad notes, and risk-survey responses
• User preferences: risk profile settings, alert configurations, notification preferences, and digest cadence selections
• What-If simulator inputs: text descriptions of stock ideas you submit for analysis
• Feedback: bug reports, feature requests, and other feedback you submit through the in-app feedback tool
• Payment information: processed exclusively by our payment processor. We never store, process, or transmit credit card numbers or bank account details on our servers

1.2 Information collected automatically

• Usage data: pages visited, features used, analysis frequency, session duration, and interaction patterns
• Device information: browser type, operating system, screen resolution, and device identifiers
• Log data: IP address, access timestamps, and error logs (collected by the application monitoring built into our cloud hosting platform)
• Referral data: if you arrive via a referral link, we record the referral code for attribution purposes

1.3 Information derived from your data

• Health scores and grades: computed from your portfolio composition using our proprietary scoring algorithm
• Observations and insights: generated by artificial intelligence (our third-party AI provider) based on your portfolio metrics
• Simulation results:“what-if” analyses from the What-If simulator

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Calculate health scores, generate observations, and run portfolio analyses
• Process stock idea evaluations and generate AI-powered verdicts
• Send alerts and notifications based on your configured preferences
• Process payments and manage your subscription
• Respond to your feedback, questions, and support requests
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information. We do not share your data with advertisers or data brokers. We do not use your portfolio data for any purpose other than providing the Service to you.

3. AI Data Processing

Moneyta uses third-party AI services to generate portfolio observations, stock idea verdicts, and smart-paste parsing. When AI processing is involved:

• PII scrubbing: We remove personally identifiable information (email addresses, account numbers, phone numbers, Social Security numbers) from data before sending it to our AI provider
• What is sent: Portfolio metrics (percentages, sector allocations, concentration ratios), ticker symbols, and anonymized analytical data, not your name, email, or account details
• Data retention by AI provider: our AI provider retains API inputs and outputs for a limited period for safety monitoring under its API data-usage policy, then permanently deletes them. Your data is not used to train AI models
• Labeling:All AI-generated content is clearly labeled within the application (e.g., “Goodwin · AI-powered analysis”)

4. Third-Party Services

We use a small set of third-party service providers to operate Moneyta, disclosed here by category. Each processes only the minimum data necessary for its purpose, acts on our instructions as a service provider, and may not use your data for its own purposes:

Each provider is governed by its own privacy policy, and our use of each relies on the provider’s standard data-processing terms, which restrict it to processing your data only to provide its service to us. You may request the current list of provider categories and the data each receives at any time via [email protected].

Connecting Moneyta to third-party AI assistants. Moneyta offers an optional connector, built on the Model Context Protocol (“MCP”), that lets you link your account to a third-party AI assistant that supports that protocol. This connection is entirely optional and initiated by you. To enable it you authorize the assistant through a standard OAuth consent screen; you choose to connect it and can revoke access at any time from your authentication settings or the assistant's own settings.

When you ask a connected assistant a question that needs your Moneyta data, the assistant requests that data from us and we return read-only information scoped to your account. Depending on what you ask, that can include portfolio holdings, health scores, risk and correlation metrics, net worth and its history, your ledger and general-ledger statements (balance sheet, income statement, trial balance), annual report summaries, tax-harvesting candidates, alert rules, physical asset records including any property addresses you have added, and recent prices for tickers you hold. The connector cannot place trades, move money, or change your data, and your encrypted Vault contents are never exposed through it.

Once your data is delivered to a third-party assistant at your request, it is processed by that provider under its own privacy policy and terms, which you should review. Moneyta does not control, and is not responsible for, how a third-party assistant stores, uses, transmits, or displays your data once it leaves our systems, or for the accuracy of that assistant's responses. The connector shares data only with the assistant you have authorized, and only when you request it; we do not sell your data.

5. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption at rest: All data is encrypted using AES-256 at the database server level. Sensitive fields (email, portfolio notes, broker details, cost basis) are additionally encrypted at the application level using Fernet symmetric encryption
• Vault encryption (PIN-derived): Vault items (jewelry, precious metals, watches, gemstones) receive an additional layer of protection. They are encrypted with a key derived from a PIN that only you know, using Argon2id to produce a Key Encryption Key (KEK), which wraps per-item Data Encryption Keys (DEKs) used to encrypt each item with AES-256-GCM. We do not store your PIN: when you unlock the Vault, your PIN is transmitted over TLS and used only in server memory to derive the key. Neither your PIN nor the derived keys are written to our disks, and both are discarded after each operation. What we store is the encrypted items, a per-user salt, and the wrapped key, none of which can be read without your PIN. To make forgotten-PIN recovery possible, a copy of your Vault's data key is additionally sealed in a hardware security module operated by our cloud hosting provider. Recovery requires a one-time code sent to your account email, is single-use and time-limited, and is audit-logged; afterward your key is re-sealed under your new PIN. Because this recovery path exists, the Vault is not zero-knowledge. It is a deliberate trade-off so that a forgotten PIN does not result in permanent loss of your Vault data
• Encryption in transit: All connections use TLS (HTTPS). Database connections require SSL. Cache connections use TLS in production
• Payment security: Payment processing is handled entirely by our payment processor (PCI DSS Level 1 certified). We never store, process, or transmit credit card data
• Access controls: Role-based access control, audit logging for administrative actions, and encrypted authentication via our authentication provider
• HTTP security headers: HSTS, Content Security Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers are enforced

6. Data Retention

We retain your data for as long as your account is active, plus:

• Account data: retained while your account exists. After account deletion, data enters a 30-day grace period (soft delete), then is permanently deleted
• After subscription cancellation: a lapsed or cancelled subscription restricts feature access but does not delete your data. Your data is retained while your account exists, and resubscribing restores full access. Deletion happens only through account deletion
• Portfolio analyses and observations: retained for the life of your account to support historical comparison
• AI interaction logs: retained for 90 days for quality monitoring, then purged
• Payment records: retained by our payment processor per its retention policy and applicable tax/accounting laws
• Administrative audit logs: retained for at least 5 years for security and to meet applicable recordkeeping regulations; these records survive account deletion

8. Additional State Privacy Rights

Residents of Connecticut, Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Maryland, and Minnesota may have additional privacy rights under their respective state laws. These rights generally include the right to access, delete, correct, and port your data, and the right to opt out of targeted advertising (which Moneyta does not engage in).

To exercise any state-specific privacy rights, contact us at [email protected].

9. Cookies and Tracking

Moneyta uses a minimal set of cookies and local storage, all of which are necessary for the Service to function:

• Authentication cookies: Set by our authentication provider to maintain your login session (strictly necessary)
• Preferences: Local storage entries for UI preferences like sidebar state (strictly necessary for user experience)
• Referral attribution: Session storage to track referral codes during signup (functional)
• Analytics cookies (consent-gated): Google Analytics and Microsoft Clarity, used to understand how Moneyta is used and improve it. These load only after you accept them in the cookie banner; declining is a first-class choice and the Service works fully without them. For how Google uses data from sites that use its services, see policies.google.com/technologies/partner-sites

You can change your analytics choice at any time using the “Cookie preferences” link in the page footer, which reopens the consent banner. We also honor the Global Privacy Control signal as described in Section 7.

Public pages can be read without an account. For visitors we collect, subject to the same consent, analytics events such as pages viewed and interactions with locked content, used to understand which features matter. We do not collect names or contact details from visitors who simply read public pages.

We do not use advertising cookies or retargeting pixels, and we do not engage in cross-site tracking. Analytics run under the consent described above and are used solely to improve the Service.

10. Email Communications

We may send you the following types of emails:

• Transactional emails: Account verification, password resets, subscription confirmations, payment receipts (cannot be unsubscribed; necessary for Service operation)
• Alert notifications: Portfolio drift alerts, score change notifications (configurable in your alert settings)
• Digest emails: Daily, weekly, or monthly portfolio summaries (configurable in your notification preferences)
• Research digests: Filing and activity digests for fund managers and tickers you follow (configurable in your follow settings)

All non-transactional emails include an unsubscribe link. We honor unsubscribe requests within 10 business days in compliance with the CAN-SPAM Act. Every email identifies DataExpansed LLC as the sender and includes our physical mailing address.

11. Children’s Privacy

Moneyta is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a minor has provided us with personal information, please contact us at [email protected].

12. International Users

Moneyta is operated from the United States and is directed at a United States audience. If you access the Service from outside the United States, your data is transferred to, stored, and processed in the United States, which may have data protection laws that differ from those in your country. By using the Service, you consent to that transfer.

Regardless of where you live, we honor requests to access, correct, delete, or export your personal information as described in Sections 7 and 8; contact [email protected]. Analytics are consent-gated for all visitors, wherever they are located.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice within the Service at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Moneyta.co c/o DataExpansed LLC, 6 Landmark Square, 4th Floor, Stamford, CT 06901, USA
Email: [email protected]