Privacy Policy

Polymath Ventures LLC (“Polymath,” “we,” “us,” “our”), a Wyoming limited liability company, operates polymathtools.ai (the “Site”). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

We believe in minimal data collection. We do not sell your personal information.

1. Information We Collect

(a) Information You Provide Directly

• Email address— when you subscribe to our newsletter, download a lead magnet, or submit a contact form (handled by Formspree and, for newsletters, Buttondown).
• Portfolio data— when you use the Portfolio tracker, you may enter market positions, probabilities, and alert preferences. This data is stored in our database (Supabase) and used to deliver the portfolio feature and optional email alerts.
• Referral data— if you participate in the Referral Program, we store your referral code and the anonymized identifiers of users who signed up through your link.
• AI Market Analyzer inputs— URLs, questions, and prompts you submit for AI analysis. These are transmitted to OpenRouter (our LLM provider) for processing.
• Payment information— if you subscribe to Premium, payment information (card details, billing address) is collected and processed directly by Stripe. We do not see or store your full card number.

(b) Information Collected Automatically

• Analytics data— we use Plausible Analytics, a privacy-friendly tool that does not use cookies, does not track you across sites, and does not collect personal data. Plausible records aggregate, anonymized metrics (page views, referrer, country, device type).
• Server logs— our hosting provider (Vercel) automatically logs IP address, user agent, request URL, and timestamp for security, debugging, and rate-limiting purposes.
• Local storage— we store small pieces of data in your browser's local storage for features like the welcome modal, onboarding state, and preferences. This data stays on your device.
• Service worker / PWA— if you install the Site as a Progressive Web App, our service worker caches pages and assets on your device for offline use. No personal data is collected by the service worker.

(c) Third-Party Advertising

We may display advertisements served by Carbon Ads (a privacy-friendly ad network that targets content contextually, not based on user tracking). Carbon Ads does not use third-party cookies or cross-site tracking.

2. How We Use Information

We use the information we collect to:

• Operate, maintain, and improve the Site and its features;
• Deliver features you request (e.g., newsletter, portfolio alerts, AI analysis);
• Process Premium subscriptions and referral rewards;
• Communicate with you about the Site, updates, and — if you opt in — marketing or newsletter content;
• Prevent fraud, abuse, and violations of our Terms of Service;
• Comply with legal obligations;
• Aggregate anonymized data for analytics and product research.

We do not sell your personal information. We do not share personal information with third parties for their own marketing purposes.

3. Third-Party Service Providers (Sub-Processors)

We use the following third-party services to operate the Site. Each has its own privacy practices; we have linked to them for your reference.

We review our sub-processors periodically and may add or remove services. Material changes will be reflected in an updated version of this Privacy Policy.

4. Cookies and Tracking

Our Site does not use tracking or advertising cookies. We do not embed third-party tracking pixels. The only browser storage we use is:

• Local storage (first-party) for UI state (onboarding, preferences);
• Cookies set by Stripe during checkout, strictly necessary for payment processing;
• Service worker assets (if you install the PWA).

5. Data Retention

• Email addresses— retained while you remain subscribed. You may unsubscribe at any time via the link in every email, or by contacting us.
• Portfolio data— retained while your account is active. Deleted on request.
• Analytics data— aggregated and anonymized; retained per Plausible's defaults.
• Server logs— retained for a limited period (typically 30–90 days) per Vercel's defaults.
• Payment records— retained as required by tax and financial-record laws (typically 7 years).

6. Security

We implement reasonable administrative, technical, and physical safeguards to protect information, including HTTPS/TLS encryption, access controls on our database, and secrets stored in encrypted environment variables. No system is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have rights under applicable law (including GDPR in the EU/UK, CCPA/CPRA in California, and similar laws elsewhere) to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your personal information;
• Export your data in a portable format;
• Object to or restrict certain processing;
• Withdraw consent for processing based on consent;
• Opt out of “sale” or “sharing”of personal information (California) — note: we do not sell or share for cross-context behavioral advertising;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email privacy@polymathtools.ai with your request and the email address associated with your data. We will respond within the time frames required by applicable law (typically 30 days).

8. International Transfers

Our Site is operated from the United States. If you access the Site from outside the U.S., your information may be transferred to, stored, and processed in the U.S. and other countries where our service providers operate. Where required by law, we rely on appropriate safeguards (including standard contractual clauses) for such transfers.

9. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at privacy@polymathtools.ai and we will delete it.

10. Do Not Track

Our Site does not respond to “Do Not Track” browser signals because there is no industry-standard implementation, and we do not conduct the kind of cross-site tracking that “Do Not Track” was designed to address.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the rights described in Section 7, including the right to know, delete, correct, and opt out of “sale” or “sharing.” We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To exercise your rights, contact privacy@polymathtools.ai.

12. European Privacy Rights (GDPR / UK GDPR)

If you are in the EU, EEA, UK, or Switzerland, the legal bases on which we process your personal data are: (a) consent (e.g., newsletter signup); (b) contract (e.g., delivering a Premium subscription); (c) legitimate interests (e.g., securing the Site, preventing abuse, improving our services), provided such interests are not overridden by your rights; and (d) legal obligation (e.g., tax records). You have the rights listed in Section 7 and may contact privacy@polymathtools.ai to exercise them. You may also lodge a complaint with your local data-protection authority.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced via a banner on the Site or by email. The “Last updated” date at the top reflects the effective date.

14. Contact

Polymath Ventures LLC
Wyoming, USA
Privacy requests: privacy@polymathtools.ai
General legal: legal@polymathtools.ai