Privacy Policy
Last updated: 18 October 2026. What changed: AI apps you connect to Tamarly (section 4). Earlier, on 16 October 2026: usage records linked to your account (sections 1, 2, 9 and 10); for accounts opened before 16 October 2026 this applies from 23 October 2026.
Tamarly Corporation ("Tamarly") is the controller of the personal data described here, for Tamarly Intelligence, the Tamarly Research store and related websites. Contact: privacy@tamarly.ai, 228 Park Ave S #337644, New York, NY 10003.
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, password hash, sign-in provider ID | You, or Google or Microsoft when you sign in with them |
| Profile and preferences | Firm, role, country, dimensions followed, alert settings, language | You |
| Portfolio | Holdings, tickers, quantities, cost basis, companies you add | You |
| Your content | Investment memos, notes, followed companies and funds | You |
| Billing | Plan, Stripe customer ID, invoices, last 4 digits and card brand | Stripe |
| Usage | Pages viewed, time on each page, features used, errors met, device, browser, approximate location from IP; linked to your account when you are signed in. Never what you type | Our systems and analytics |
| Communications | Support emails, feedback | You |
| Questions and AI requests | Questions to Ask the Brain and the Associate with their answers, Associate memory and skills | You |
| Advice requests | Questions asking the Brain what to buy, sell or hold, with their date | You |
| Uploaded files | Files you upload to the Hub or Connectors and their text | You |
| Sharing | Email addresses of people you invite to a fund or document, their role, and when they opened it | You and the people you invite |
| Acceptance records | When you accepted the terms of access, the notice version, a one-way hash of your IP address | Our systems |
We do not collect full card numbers. We do not ask for government ID numbers.
2. Why we use it
| Purpose | Legal basis (EU and UK) |
|---|---|
| Provide the Service, including ranking your Wall and alerts from your portfolio | Contract |
| Bill your subscription | Contract, legal obligation |
| Keep accounts secure and prevent fraud | Legitimate interests |
| Improve the Service from aggregated usage | Legitimate interests |
| Help you with your account and your first weeks on the Service, from the pages and features you use (seen only by authorised Tamarly staff, each look logged) | Consent in the EU, EEA, UK and Switzerland (the "Accept analytics" choice); legitimate interests elsewhere, with an opt-out |
| Send product and research emails | Consent, or legitimate interests for existing subscribers, with opt-out |
| Comply with law | Legal obligation |
3. Your portfolio is confidential
Portfolio data and investment memos are stored in records tied to your account and protected by row-level security in the database, so no other subscriber can read them. Sensitive fields are encrypted at rest. Tamarly staff access them only to resolve a support request you raise or where the law requires, and every access is logged. We never sell portfolio data, never share it with fund managers or companies, and never use it to decide what Tamarly publishes.
4. AI processing
When you use AI features, the text needed for your request is sent to Anthropic's API to produce the output. For Ask the Brain this is your question and the earlier turns of the same conversation, the public platform data relevant to it and, only if you ask about your own holdings or follows, the names of those companies (never quantities, costs or notes). Tamarly keeps each question and its answer with your quick asks, to count your allowance and show your history; the earlier turns of a conversation stay in your browser. A question asking what to buy, sell or hold is not sent to Anthropic: it is refused and recorded for our administrators (see the Terms, section 6). For the Associate, your request, your memory notes and your skills are sent; reports, memory and skills are stored in your account until you delete them. Anthropic processes this data as our service provider and does not use it to train its models under its commercial terms. We do not use your data to train models.
AI apps you connect. If you connect an AI application such as Claude or ChatGPT to Tamarly, we receive the requests the application makes for data (for example a company name or identifier) and record when they were made, to answer them and to apply your rate limit. We do not receive your conversation with the application. For each connected application and each API key we keep its name, the dates it was created and last used, and a one-way hash of the key; the key itself is never stored. The data we return is processed by the application's provider under your agreement with that provider. You can disconnect an application or revoke a key at any time in My Account, API keys.
5. My Funds
My Funds stores the funds you create, the companies in them, position entries (amounts, prices, shares, valuations, ownership), meeting notes and attendees, KPI reports and the files you upload. Amounts, valuations, ownership, shares, notes, attendees, KPI figures and exposure snapshots are encrypted in the application (AES-256-GCM) before they reach the database. Uploaded files sit in a private storage area under your own account; only you can open them, through links that expire after 60 seconds. Exports are produced in your browser and are not stored by Tamarly; each export is logged with its format, options and date. Deleting your account deletes all My Funds data.
Some My Funds features use Anthropic's API:
- Company profiles: the company's name, website and public identifiers are sent, never fund data or your identity. Results are public facts with their sources, shared across the catalogue without recording who asked.
- Proposed figures from an uploaded file: when you choose "Propose figures", that one file is sent to read KPI values and round terms. Nothing is saved until you accept. At most 20 files a day.
- Sector exposure reports: only public platform data and company names are sent. Your amounts, weights and notes are never sent; the app adds your fund's position when you open the report.
Requests Tamarly makes to public sources (public registers, regulators, statistical bodies and news publishers listed in the Third-Party Data Notices) carry no user data.
6. Video
Tamarly uses YouTube API Services. See the Google Privacy Policy (policies.google.com/privacy). Embedded YouTube players load only when you press play, from YouTube's privacy-enhanced domain; once loaded, they may set cookies and send data to Google. Open-licence video (NASA, Wikimedia Commons, Pexels, Pixabay, DVIDS) plays from the source's own address, which sees the request when you press play.
7. Who we share it with
We share personal data only with service providers that process it for us under contract:
| Provider | Purpose |
|---|---|
| Supabase, Vercel, Amazon Web Services, Cloudflare | Hosting, database, storage, security |
| Stripe | Payments and billing |
| Shopify | Tamarly Research store purchases |
| Anthropic | AI features |
| Resend, Loops | Transactional and product email |
| Sentry, PostHog | Error monitoring and product analytics |
| GitHub | Runs scheduled jobs, including alert emails, with access to account emails and alert settings |
| OpenAI | Editorial pictures from prompts written by editors; no reader data |
We also disclose data where the law requires, to protect rights and safety, or in a merger or sale of the business with notice to you. We do not sell or share personal information for cross-context behavioural advertising.
7A. Sharing and co-managers
When you share a fund or a document, we store the invitee's email address and role and show you a log of when they opened it. The invitee sees your name and what you shared. Either of you can end the sharing at any time.
8. International transfers
Data is stored in the United States. Transfers from the EU, EEA, UK and Switzerland rely on the EU Standard Contractual Clauses and UK Addendum, or the EU-US Data Privacy Framework where a provider is certified.
9. Retention
Account, profile, portfolio and My Funds data: while your account is open. When you close your account, it is archived: you can no longer sign in, and the data is kept for 6 years from the date the closure takes effect, in line with regulators' record-keeping expectations, then deleted. While your account is open, you can delete your portfolio, profile details and followed companies and funds yourself from Account, Your data. Investment memos, alerts, AI run records and memo usage counts: 6 years, to support customer record keeping. Uploaded files: until you delete them or disconnect. Associate reports, memory and skills: until you delete them. Co-manager access logs: while the fund exists. Acceptance records, including the hashed IP address, and advice requests: 6 years. Billing records: 7 years for tax law. Security logs: 12 months. Usage records linked to your account: 180 days, or until you turn them off in Account, Your data, which also deletes them.
10. Your rights
Depending on where you live, you may access, correct, delete or export your data, object to or restrict processing, withdraw consent, and opt out of marketing. California and other US state residents may also request to know what we collect, request deletion and correction, and opt out of sale or sharing; we do neither. You can export or delete your data yourself from Account, Your data, or write to privacy@tamarly.ai. You can turn usage records off at any time in Account, Your data, or with the "Cookie settings" link in the footer; Global Privacy Control signals are honoured as an opt-out. We will not discriminate against you for exercising a right. EU and UK residents may complain to their data protection authority.
11. Security
Encryption in transit and at rest, row-level security on every table, two-factor authentication, logged administrative access, regular backups and independent security testing.
12. Children
The Service is not for anyone under 18 and we do not knowingly collect their data.
13. Changes
We will notify you of material changes by email or in the Service before they take effect.