Privacy Policy

The controller responsible for your personal data is [TODO: legal entity name, e.g. Example Technologies Ltd.], a company registered in [TODO: country of incorporation] under number [TODO: company registration number], with its registered office at [TODO: registered office address].

• Privacy requests and questions: [TODO: privacy contact email, e.g. privacy@getfalcon.co]
• Data protection officer: [TODO: data protection officer contact, or state that none is appointed]
• Representative in the European Union: [TODO: EU representative under GDPR Art. 27, or remove if not required]
• Representative in the United Kingdom: [TODO: UK representative under UK GDPR Art. 27, or remove if not required]
• Turkey (KVKK): [TODO: VERBIS registration and KVKK data controller representative, if applicable]

What we hold depends on how you use Falcon. Much of the desktop app's working data is kept only on your computer and never reaches us; where that is the case we say so.

Account and sign-in

• Account details: your email address, a password (stored by our authentication provider as a one-way hash; we never see it in readable form), the name you give us, your account identifier, and account status such as whether you have been admitted from the waitlist, your membership tier and the dates your account was created and last signed in.
• One-time codes: sign-up confirmation and password reset use codes emailed to you.

Early-access application

• Your full name, email address and phone number (with country code), and a password for the account the application creates.
• Your answers to the application questions: what best describes you (for example founder, finance professional or trader), the approximate band of capital you trade with, how you make trading decisions, and your free-text answers about what you find hardest and what you hope Falcon will do for you, and whether you accepted the programme's terms.

Profile and onboarding

• Your name, what Falcon should call you, and any instructions you write in your profile. Profile instructions are stored with your account and are not currently used by any feature.
• Your onboarding answers: how long you have been investing, the sectors you follow, your typical holding period, how you want positions handled, the panels you want on your desk, your preferred signal format, and how you heard about Falcon. We also record a country code taken from your computer's language and region settings.
• Your profile photo, if you add one. It is stored only on your computer.

What you do in the app

• Stored with your account: your paper (simulated) portfolio (cash, and for each position the ticker, number of shares and cost) and its value history, which our engine records at most once a minute while the US market is open and less often outside market hours, and only when the value has changed (or once an hour to show it has not); the company research you start, with its results; and a summary of any brokerage you link (see below).
• Stored only on your computer: your watchlist, layout and preferences, recent searches, a copy of your paper account, saved briefings, the list of holdings Falcon has researched or queued, your research agents (their briefs, instructions, reports and the messages you exchange with them), calendar events you add, notification settings, the state and settings of the app's market engines (including the tickers they follow), and caches of public data such as SEC filings, relationship graphs and news.
• Sent to our engine service: when the app uses Falcon's hosted engine, it sends your paper account (cash and positions with their market value) so risk readings can be calculated, and the tickers you hold and watch so the engines follow them. Your paper account copy, risk readings and watchlist are filed under your account identifier and are only returned to you. Followed tickers are kept in a shared list that is not linked to your account.

Brokerage connection (optional)

If you choose to link a brokerage, the connection is made through SnapTrade. You sign in to your brokerage on SnapTrade's and your brokerage's pages; we never receive your brokerage username or password. We request read-only access. We identify you to SnapTrade only by a Falcon account identifier, never by name or email. We receive and store a summary of each linked account (its name or number, the institution and its balance) so it can be shown in the app; we do not currently retrieve individual positions or transactions. To keep the link working, SnapTrade issues a user secret for your connection. It is stored encrypted, with a key only our servers hold, in a restricted table in our database that only our servers can read. In some configurations of the app it is also kept in a file in the app's data folder on your computer, one per account, encrypted with your operating system's protection for your user account; where the system offers no such protection, it is kept in memory only and never written to disk. It is never included in data exports.

Content you send to AI features

Some features send content to our AI model provider to produce a result. See Section 4 for exactly what is sent.

Technical data

• Network data: like any internet service, our servers and providers receive your IP address and basic request information when the app or website contacts them. Our website uses IP addresses briefly, in memory, to limit abusive request rates; it does not store them for that purpose.
• Error reports: when a Falcon app reports an error to our website, or a request to Falcon's research worker fails, the report sent to our team includes the ticker involved, a description of the error and, so reports from the same account can be told apart, a pseudonymous code derived from your account (or, where that is not available, your email address with everything before the @ hidden except the first character). It does not include your name, your full email address, sign-in tokens, keys or IP addresses. See Section 6.
• Update checks: the desktop app asks GitHub, where our releases are published, whether a newer version exists.
• No analytics: neither the website nor the app uses analytics, advertising, usage tracking or crash-reporting tools.

If you apply for a job or internship

We collect your name, email address, LinkedIn profile, the role you apply for, your introduction and other answers, how you heard about the role and who referred you, your CV if you upload one, and, as your application progresses, our assessment notes, any task you submit and interview scheduling details.

When you contact us

The content of your messages and your contact details, so we can reply.

We do not ask for, and ask you not to provide, special categories of personal data (such as health data or political opinions) or government identifiers.

• From you, when you apply, sign up, set up your profile, or use the app.
• From your brokerage, through SnapTrade, if you choose to link an account.
• Automatically, from your device, when the app or website communicates with our servers (for example your IP address and error reports).
• From people who refer you, if you apply for a role and name a referrer, or are named as one.

Market data, filings and news shown in Falcon come from public and licensed sources. They are about companies and markets, not about you.

Falcon uses large language models provided by Anthropic (the Claude API). In the released desktop app, requests are relayed through Falcon's research worker, which checks your session, removes your sign-in token and IP address, and then forwards them. The model provider receives:

• tickers, public SEC filing text and news headlines, to build relationship graphs, signals and reads;
• for Falcon's read on news, the text of a news story you open that has no ready-made read; you can switch this off in Settings, Privacy;
• for your briefing, the tickers you hold the most of, sized only as large, medium or small, and their percentage moves; never dollar amounts, share counts or cash balances;
• the questions you type into Insight chat, with the facts of the event you are asking about; we do not store these conversations;
• for research agents, each agent's brief and instructions and the messages you exchange with it, together with the public market data it gathers;
• text you select in the app to have explained, with the surrounding context.

Model requests may pass through a model gateway service before reaching the model: [TODO: name the model gateway the research worker forwards to, or state that requests go directly to Anthropic].

We do not send your name, email address or profile instructions to the model provider. To give Falcon's read on a story, the app itself downloads the article from the publisher's website. Please do not type personal information about yourself or others into chat or agent prompts.

Anthropic processes this content to provide the service to us. Under Anthropic's commercial terms for its API, customer content is not used to train its models by default; Anthropic may retain API inputs and outputs for a limited period, for example for trust and safety purposes, as described in its own policies.

Outputs are generated automatically and are not decisions about you. We do not use AI or other automated processing to make decisions that have legal or similarly significant effects on you. Early-access applications are reviewed by our team.

Where the GDPR, the UK GDPR or similar laws apply, we rely on the following legal bases (Article 6 GDPR). Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and you can object (Section 10).

We do not sell personal data, share it for cross-context behavioural advertising, or use it to profile you for marketing. We do not trade on your data. If we ever want to use personal data for a new purpose that is not compatible with these, we will tell you first and, where required, ask for your consent.

We share personal data only with the service providers that help us run Falcon, under contracts that limit their use of it to providing their services to us, and in the limited cases described below.

We may also disclose personal data:

• to comply with law, a court order or a lawful request from a public authority, or to protect the rights, property or safety of Falcon, our users or others;
• to professional advisers (such as lawyers and accountants) under confidentiality obligations;
• as part of a merger, acquisition, financing or sale of assets, in which case the recipient will be bound by this policy or one at least as protective, and we will tell you before your data becomes subject to a different policy.

Several of our providers are in the United States or other countries outside the European Economic Area, the United Kingdom and Turkey. Where we transfer personal data from those places to a country without an adequacy decision, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient participates, or, for transfers from Turkey, the mechanisms available under Article 9 of the KVKK, including the standard contracts published by the Personal Data Protection Authority. You can ask us for a copy of the relevant safeguards at [TODO: privacy contact email, e.g. privacy@getfalcon.co].

Copies may remain in our providers' backups for a limited period after deletion, until those backups are overwritten.

• Data is encrypted in transit between the app, the website and our servers (HTTPS).
• Keys for our AI and data providers are kept on our servers or in the app's background process, never in the part of the app that displays web content.
• Database tables holding personal data are protected by row-level security, so each account can reach only its own rows; the most sensitive tables (such as SnapTrade user secrets and job applications) can be read only by our servers.
• Access to the admin tools is limited to authorised team members.
• Passwords are stored by our authentication provider as one-way hashes.

No system is perfectly secure. Data kept on your computer is protected by your computer's own security, so please keep your device and operating system account secure. If we become aware of a breach that affects your personal data, we will notify you and the authorities where the law requires.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests;
• restrict processing in certain circumstances;
• withdraw consent where we rely on it, without affecting earlier processing;
• not be subject to decisions based solely on automated processing that significantly affect you.

How to use them

• Export: in the desktop app, Settings, Privacy, Export data saves one JSON file with your account record, the data stored with your account, your saved briefings, portfolio files, agents (with their reports, activity and chats) and calendar events on that computer, your profile photo and the app's stored preferences. Only the signed-in account's files are included. Your sign-in session and SnapTrade user secret are left out.
• Delete: in the desktop app, Settings, Account, delete your account. This deletes your sign-in account and the data stored with it, your user at SnapTrade with its brokerage connections, your paper account copy, watchlist and risk readings on our engine, and, on the computer you delete from, that account's agents, calendar events, saved briefings, profile photo, brokerage link key and the app's stored data for it; then it signs you out on every device. If a step cannot be finished at that moment (for example, SnapTrade cannot be reached), the app tells you which one, and Falcon retries it automatically. It does not remove error reports already sent to our team, shared caches of public data and device settings on your computer, or Falcon files on other computers you used (remove the app's data folder there). Saved briefings and recent searches can also be cleared in Settings, Privacy.
• Correct: edit your name, profile and instructions in Settings.
• Anything else, or if you cannot use the app (for example, you applied but were not admitted): email [TODO: privacy contact email, e.g. privacy@getfalcon.co].

We will respond within the time the law requires (one month under the GDPR, which can be extended in some cases; 30 days under the KVKK; 45 days under the CCPA). We may need to verify your identity, usually by confirming control of the email address on your account. You can use an authorised agent where the law allows; we may ask for proof of their authority. We will not discriminate against you for using your rights.

You also have the right to complain to a data protection authority, in particular where you live or work: for example your local EU supervisory authority, the UK Information Commissioner's Office, or Turkey's Personal Data Protection Authority (KVKK). We would appreciate the chance to address your concern first.

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), in the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2, 3 and 5, and disclosed them for business purposes to the service providers in Section 6:

• Identifiers (name, email address, phone number, account identifier, IP address);
• Customer records and financial information (trading capital band from applications; brokerage account names and balances if you link a brokerage; your paper portfolio);
• Internet or network activity (requests to our servers, error reports);
• Professional or employment information (for job applicants);
• Approximate location (a country code from your computer's settings).

We do not draw inferences from your personal information to create a profile about you.

We do not sell or share personal information, as those terms are defined in the CCPA, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. Some information we hold may be sensitive personal information (account log-in details, and the SnapTrade user secret that keeps a brokerage link working); we use it only to provide the Service and as otherwise permitted by the CCPA, so a right to limit its use does not apply. You have the rights to know, delete, correct and not be discriminated against, which you can exercise as described in Section 10.

Under Law No. 6698 on the Protection of Personal Data (KVKK), [TODO: legal entity name, e.g. Example Technologies Ltd.] is the data controller. We process personal data for the purposes and on the grounds set out in Section 5, which correspond to the conditions in Article 5 of the KVKK (in particular, processing necessary for the establishment or performance of a contract, compliance with legal obligations, and our legitimate interests), and transfer it abroad as described in Section 7.

Under Article 11 of the KVKK you may ask whether your data is processed and request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Turkey or abroad to whom it is transferred; ask for correction of incomplete or inaccurate data and for deletion or destruction, and for these to be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing. Send requests to [TODO: privacy contact email, e.g. privacy@getfalcon.co].

Falcon is meant for adults. You must be 18 or older to use it, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact [TODO: privacy contact email, e.g. privacy@getfalcon.co] and we will delete it.

Our website does not use advertising or analytics cookies, and so does not show a cookie banner. It uses only storage that is strictly necessary for features you ask for:

• when you sign in on the website, your browser's local storage keeps your session so you stay signed in;
• after you join the waitlist, local storage remembers that you did, the email address you used and your ticket (your name, member number and join date), so the site can show your status. The ticket is read once with your own sign-in; the site never looks up anyone's status by email address. It is all cleared when you sign out;
• session storage remembers a plan you picked on the membership pages until you close the tab;
• members of our team who use the admin tools receive a secure, short-lived session cookie.

The desktop app stores your preferences, layout, watchlist, paper account and recent searches in its own storage on your computer. You can see what it holds, and turn off remembering recent searches, in Settings, Privacy.

We will update this policy when our practices change. We will post the new version here with a new "Last updated" date, and if a change is significant we will tell you in advance, by email or in the app.

Questions or requests about this policy or your personal data: [TODO: privacy contact email, e.g. privacy@getfalcon.co], or write to [TODO: legal entity name, e.g. Example Technologies Ltd.], [TODO: registered office address].