Investabl Privacy Policy
Controller: Investabl Limited
1. Who we are
Investabl Limited, registered at Ground Floor, The Sotheby Building, Rodney Bay, Gros-Islet, Saint Lucia (postal address: P.O. Box 838, Castries, Saint Lucia) ("Investabl", "we"), operates app.investabl.ai and decides how your personal data is used. We are the data controller (called the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023).
Questions and requests go to support@investabl.ai.
2. What this covers
This policy covers our website, the trading app, checkout, payouts, the affiliate programme, the AI coach and journal, and support chat. It should be read with our Terms & Conditions.
3. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Email address, display name, profile picture, login ID, referral code | You, via our login provider (email or Google sign-in) |
| Identity verification | Whether you passed, the date, and a reason if you did not. We do not store your ID document, selfie or date of birth; our verification provider holds them. | Our verification provider |
| Device and network | IP address at sign-up and at each login from a new IP; a device identifier generated in your browser; browser type | Your browser |
| Payments | Amount, currency, payment method, order IDs, the wallet address a crypto payment came from, and the payment provider's status messages, which may include details the provider sends us | You and your payment provider |
| Payout details | Wallet address and network for Rewards, and a Telegram handle if you choose to give one | You |
| Trading activity | Every order, position, balance and rule outcome on your Accounts | Your use of the platform |
| App usage | Screens viewed and actions taken (for example opening an order ticket or adding a chart drawing), with IP address and browser details; page-performance timings | Your browser |
| AI coach and journal (optional) | Trade notes, voice notes, daily check-ins, answers about your strategy, and summaries the AI writes about your trading | You, and our AI provider's analysis |
| Imported accounts (optional) | MT5 login number, server name, and the investor password, used once to link the account | You |
| Affiliate programme | Your public handle, who you referred, commissions and withdrawal wallet; for referral link clicks, a one-way hash of the visitor's IP plus browser details | You and referred visitors |
| Support | Conversations with our support team | You, via the support chat |
| Funded-trader questionnaire (optional) | Your answers, and whether you agreed to their publication | You |
4. Why we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Run your account, Challenges and payouts | Account, payments, payout details, trading activity | Performing our contract with you |
| Verify identity and screen against sanctions lists before paying Rewards | Identity verification | Legal obligation, and our contract |
| Prevent fraud and enforce the Terms: duplicate accounts, coordinated trading, payment abuse | Device and network, payments, trading activity | Legitimate interest in protecting the firm and honest traders |
| Support | Account, support conversations | Contract |
| Improve and debug the product | App usage | Legitimate interest. You can object (clause 10.4) |
| Measure advertising | Hashed email, IP address, browser details, ad cookie IDs | Legitimate interest. You can object (clause 10.4) |
| AI coaching and journal | AI coach and journal data | Consent: you turn these features on |
5. Automated decisions
Rule enforcement is automatic. Our system checks each Account against its Program Rules continuously. When a loss limit is reached, it closes positions and ends the Account without a person being involved. This is necessary to run the service you signed up for.
Risk checks can hold a payout, but never refuse one on their own. Automated checks look for patterns such as linked accounts, copied or opposite trading, and account cycling. A match holds a payout request for review. Only a person can refuse a payout or end an Account for a breach of the Terms.
You can ask for any automated outcome to be reviewed by a person and can contest it, as set out in clause 12 of the Terms.
6. Who we share it with
We do not sell personal data. We share it only with the service providers below, who process it for us, and with authorities where the law requires.
| Provider | What they do | What they receive |
|---|---|---|
| Privy | Login and embedded wallets | Email, Google profile, wallet addresses |
| Didit (and a Fillout form as backup) | Identity verification and sanctions screening | Your ID document, selfie and the details you enter, collected directly by them; our user ID |
| Google Cloud | Hosting and database | All data we hold |
| Google (Gemini) | AI coach, journal and voice transcription | Your notes, check-ins, strategy answers, voice recordings and related trades. Not your email. |
| Google Analytics and Tag Manager | Product analytics | App-usage events, your user ID, a shortened wallet address |
| PostHog | Product analytics, session recordings and the in-app feedback form | App-usage events, your email, name and user ID, and how you move through pages. Anything you type is masked in recordings. |
| Meta | Advertising measurement | A one-way hash of your email and user ID, IP address, browser details, ad cookie IDs, and purchase and sign-up events |
| Intercom | Support chat | Email, name, user ID (signed), conversations |
| Slack | Internal alerts to our operations team | Your email address with payment, payout and account events |
| Payment providers (Cashfree, PFU, Spayz, IG and crypto networks) | Taking payments | Order amount and reference, plus whatever you enter on their payment page. We do not send Cashfree your real phone number. |
| MetaApi | Linking MT5 accounts you import | MT5 login, server and investor password |
| Public blockchains | Crypto payments and Rewards | Wallet addresses and amounts. These are public and permanent by the nature of blockchains. |
The device identifier in clause 3 is produced by an open-source library that runs in your browser. It does not send data to any third party.
If Investabl is sold or merged, personal data may pass to the new owner under this policy.
7. What is made public
When we pay a Reward, we may post the amount and a masked form of your email (for example ve***@gmail.com) in our Telegram and Discord communities. To opt out, email support@investabl.ai.
Our payout-proof and transparency pages show an anonymous handle, never your email or name.
Certificates show the display name you choose and are visible to anyone with the certificate link.
The referral leaderboard shows affiliate handles and counts. You can opt out of it.
Funded-trader questionnaire answers are published only if you tick the consent box on the questionnaire.
8. Where it is stored
Our servers and database are in Google Cloud's United States (Iowa) region. We may move them to India (Mumbai). Our service providers operate in the United States, the European Union and elsewhere.
When data leaves your country, we rely on the providers' contractual commitments, including standard contractual clauses where the law requires them.
9. How long we keep it
| Data | Kept for |
|---|---|
| Page-performance timings | 30 days |
| Risk-check results | 90 days, or longer if linked to an open dispute or a finding under the Terms |
| Voice recordings | Deleted as soon as they are transcribed |
| MT5 investor password | Deleted once the account is linked, or when linking fails |
| Everything else, including account, trading, payment and payout records, the IP address log, app-usage events, AI coach and journal data, and support conversations | For as long as your account is open, and afterwards for as long as we need it for legal, accounting, tax, dispute or fraud-prevention purposes. You can ask us to delete it earlier (clause 11). |
10. Cookies and tracking
Needed to run the service: your login token, checkout and payment progress, referral attribution, and your saved app settings. These are kept in your browser's local storage. We do not set our own cookies.
Security: the in-browser device identifier used to detect duplicate accounts (clause 6.2).
Analytics and advertising: Google Analytics, Google Tag Manager, PostHog analytics and session recording, and the Meta cookies (_fbp, _fbc) load when you visit our site. We also report purchases and sign-ups to Meta from our servers. We do not currently show a cookie banner.
How to opt out: you can block or delete these cookies in your browser settings, or use Google's Analytics opt-out add-on. To stop us reporting your purchases to Meta, email support@investabl.ai.
Our login provider and support chat set their own storage to keep you signed in and to keep your conversation.
11. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data (see 11.2);
- give you your data in a portable format;
- stop using your data for analytics or advertising, or withdraw any consent you gave;
- have a person review an automated decision (clause 5);
- name someone to exercise these rights for you if you die or cannot act (India).
When you ask us to delete your data, we delete or anonymise it within 30 days. The exceptions are records we must keep by law (payments, payouts and identity-verification results) and data needed for an open dispute or fraud investigation. Those are kept only for as long as clause 9 allows. Data on public blockchains cannot be deleted by anyone.
Email support@investabl.ai from the address on your account. We reply within 30 days. You can also complain to your local data-protection authority (for India, the Data Protection Board of India).
12. Security
What we do:
- All traffic to our servers is encrypted in transit (TLS).
- We never receive or store your ID documents; our verification provider holds them.
- Wallet private keys we manage for trading are encrypted at rest (AES-256-GCM).
- Messages from payment and verification providers are checked with cryptographic signatures before we act on them.
- Staff access to admin tools requires a secret key, and every admin action is logged.
- Payouts are sent from a smart-contract wallet with an on-chain daily limit, so a compromised signing key cannot empty the treasury.
- Service secrets are held in Google Cloud Secret Manager.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.
13. Age
Investabl is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If we learn that we have, we close the account and delete the data, except payment records we must keep.
14. AI features
The AI coach and journal are optional. When you use them, your notes, voice recordings, check-ins and related trades are sent to Google's Gemini service to produce transcripts, summaries and coaching.
Voice recordings are deleted from our systems as soon as they are transcribed. AI output is guidance only and is not investment advice.
15. Marketing
We do not currently send marketing emails, SMS or WhatsApp messages. If we start, we will ask first where the law requires, and every message will include a way to unsubscribe.
16. Changes
We will post changes here. For significant changes we will also notify you by email or in the app at least 14 days before they take effect.
17. Contact
Investabl Limited · Ground Floor, The Sotheby Building, Rodney Bay, Gros-Islet, Saint Lucia (postal address: P.O. Box 838, Castries, Saint Lucia) · support@investabl.ai