Privacy Policy

Effective Date: February 2026

Last Updated: February 2026

INVESTAT ("we," "us," "our," or the "Company") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

INVESTAT Website: https://finextractor-6qkrnhc6.manus.space

2. Personal Data We Collect

We may collect the following categories of personal data:

Category	Examples
Account Information	Name, email address, password (encrypted)
Payment Information	Stripe customer ID, subscription status, cryptocurrency payment records
Usage Data	Pages visited, features used, search queries, analysis requests
Technical Data	IP address, browser type, device information, operating system
Communication Data	Emails and correspondence with us
Cookie Data	Session cookies, preference cookies (see our Cookies Policy)

3. Purpose of Data Collection

We collect and use your personal data for the following purposes:

• Account Management: To create and manage your user account, authenticate your identity, and provide customer support.
• Service Delivery: To provide you with access to our financial data analysis tools and features.
• Payment Processing: To process subscription payments through Stripe and cryptocurrency payment providers.
• Service Improvement: To analyze usage patterns and improve our Website and services.
• Communication: To send you service-related notifications, including email verification codes and subscription updates.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Security: To detect, prevent, and address fraud, security breaches, and technical issues.

4. Legal Basis for Processing

Under the PDPO, we process your personal data based on the following grounds:

• Contractual Necessity: Processing necessary to perform our contract with you (e.g., providing subscribed services).
• Legitimate Interests: Processing necessary for our legitimate business interests, provided these do not override your rights.
• Consent: Where you have given explicit consent for specific processing activities.
• Legal Obligation: Processing necessary to comply with legal requirements.

5. Disclosure of Personal Data to Third Parties

We may share your personal data with the following categories of recipients:

Recipient	Purpose
Payment Processors	Stripe, NOWPayments — to process your payments
Email Service Providers	Resend — to deliver transactional emails
Hosting Providers	Cloud infrastructure providers — to host and operate the Website
Analytics Providers	To analyze Website usage and performance
Legal and Regulatory Authorities	When required by law or to protect our legal rights

Important Notice Regarding Sale of Data to Third Parties:

We may, from time to time, sell, license, or otherwise transfer your personal data (including but not limited to your email address, usage data, and aggregated behavioral data) to third parties for their own commercial purposes, including but not limited to marketing, advertising, research, and analytics.

By using this Website and accepting this Privacy Policy, you acknowledge and consent to the potential sale or transfer of your personal data to third parties as described above. If you do not wish for your data to be sold or transferred, you should discontinue use of the Website and contact us to request deletion of your data.

6. Cross-Border Data Transfers

Your personal data may be transferred to and processed in jurisdictions outside of Hong Kong. Where such transfers occur, we will take reasonable steps to ensure that your data is protected in accordance with the PDPO and applicable data protection standards.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including:

• Account data: For the duration of your account plus 3 years after account closure.
• Payment records: As required by applicable tax and financial regulations (typically 7 years).
• Usage data: Up to 2 years from the date of collection.
• Communication records: Up to 2 years from the date of the last communication.

8. Your Rights Under the PDPO

Under the PDPO, you have the following rights regarding your personal data:

• Right of Access: You may request access to the personal data we hold about you.
• Right of Correction: You may request correction of any inaccurate or incomplete personal data.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.
• Right to Request Deletion: You may request deletion of your personal data, subject to our legal obligations.

To exercise any of these rights, please contact us using the details provided in Section 12 below. We will respond to your request within 40 days, as required by the PDPO.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of passwords using bcrypt hashing.
• Secure HTTPS connections for all data transmission.
• Access controls limiting data access to authorized personnel.
• Regular security reviews and updates.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

10. Children's Privacy

Our Website is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Website with a revised "Last Updated" date. Your continued use of the Website after such changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at the email address provided on the Website.

For complaints regarding our handling of your personal data, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong:

• Website: https://www.pcpd.org.hk
• Hotline: (852) 2827 2827

---

By using INVESTAT, you confirm that you have read, understood, and agree to this Privacy Policy.