1. Who We Are

Celestice is an AI-powered wealth and investment management platform operated by Celestice Inc ("Celestice," "we," "us," or "our"). We help investors, advisors, and institutions manage portfolios across every asset class.

2. Information We Collect

We collect the following types of data:

• Account Information: Name, email address, phone number, organization, role, and authentication credentials
• Financial Data: Account details, holdings, transactions, and market data you connect for portfolio analysis
• Usage Data: How you interact with Celestice, session timestamps, and feature usage
• Device Information: Browser type, operating system, IP address, and referring URLs
• Payment Information: Billing details processed by our PCI-compliant payment processor

4. AI Model Training

We may use anonymised and aggregated data from your portfolio sessions to improve and fine-tune our AI models. This helps us provide better analytics and optimization to all users.

You can opt out of having your data used for model improvement in your account settings. Opting out will not affect the quality of service you receive.

5. Legal Basis for Processing

Where GDPR applies, we process your data based on:

• Contract: To perform our obligations under your subscription agreement
• Legitimate Interest: To operate, secure, and improve the Service and prevent fraud
• Consent: For optional analytics cookies and marketing communications
• Legal Obligation: To comply with applicable laws and regulations

6. Data Retention

We retain your data only as long as necessary:

• Account data: Until you delete your account
• Financial data: As long as your account is active or as required by regulation
• Usage analytics: 24 months, then anonymised
• Legal/compliance: As required by applicable law and audit obligations

7. Your Rights

Depending on your jurisdiction (including under GDPR, CCPA/CPRA), you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Delete your account and all associated data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities
• Restriction: Limit how we process your data
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at support@celestice.com.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security audits.

Third-Party Sub-Processors: We use the following service providers to deliver Celestice:

• Azure (Microsoft) — Cloud infrastructure and hosting
• Supabase — Database and authentication
• Stripe Inc. — Payment processing
• Vercel Inc. — Website hosting

9. International Transfers

Your data may be processed by infrastructure services located outside the EEA, specifically in the United States.

Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or adequacy decisions. All sub-processors are contractually bound to protect your data to standards equivalent to GDPR.

10. Cookies

We use essential cookies to operate our service and analytics cookies to understand usage. You can manage cookie preferences in your browser settings.

• Essential: Required for authentication, security, and core functionality
• Functional: Remember your preferences and settings
• Analytics: Help us understand usage to improve the Service (can be disabled)

11. Third-Party Links

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

12. Children's Privacy

The Service is intended for business and professional use and is not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will promptly delete it.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the service. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related questions or to exercise your rights:

For EEA/UK residents, you also have the right to lodge a complaint with your local data protection authority.