Privacy Policy
Last updated: August 4, 2026
This Privacy Policy explains how Ombra, Inc. ("Ombra", "we", "us"), a Delaware corporation, collects, uses, and shares personal data when you use Investi, our AI-powered investment research service available at tryinvesti.com (the "Service"). Ombra is the data controller for the processing described here.
We serve users worldwide. We apply the standards of the EU General Data Protection Regulation ("GDPR") to everyone's personal data, and Section 10 describes additional rights for residents of certain US states.
For any privacy question or request, contact us at legal@tryinvesti.com.
1. Data We Collect
Account data. When you sign in with your email we collect your email address. When you sign in with Google, we receive your email address and basic profile information (such as your name) from Google. You may optionally add your name and a self-described role (e.g., retail investor, professional) in the app.
Content you create. Your conversations with the AI (your messages and the AI's responses), notes, uploaded files, workspace organization (including the companies you track), and any custom skills, scheduled monitors, or integrations you configure are stored so the Service can function. When a monitor you scheduled runs, its saved request is processed the same way as a live conversation (see AI Processing below), even while you are not using the Service. This content may include financial information you choose to enter, such as companies or positions you are researching.
Connected brokerage data. If you choose to connect a brokerage account, we receive read-only portfolio data from our portfolio connectivity provider: your accounts (with masked account numbers), holdings, balances, and transaction history, along with connection status and sync timestamps. You authenticate with your broker through the connectivity provider — we never receive your broker login credentials where the provider handles that flow. We use this data solely to display your portfolio and power the research features you request; we cannot trade, move money, or modify your account.
Voice dictation. If you use voice dictation, your microphone audio is streamed from your browser to our transcription provider for real-time speech-to-text conversion. We do not store the audio; only the resulting text becomes part of your message. The microphone is only active when you turn dictation on.
Billing data. If you subscribe to a paid plan, our payment processor collects and processes your payment details directly. We never receive or store your full card number; we keep limited billing records such as your plan, subscription status, and billing period.
Usage data. We keep per-account usage metering (e.g., how much AI capacity you have used in a billing cycle) to enforce plan limits.
Analytics data (only with your consent). We ask for your choice before storing anything on your device for analytics. If you accept, we record which pages and features you use, linked to your account, and may record a session replay of your visit. A replay reproduces the pages as they appeared to you, including the content shown inside the app and what you type into it; credentials you enter, such as integration API keys, are blanked out and never recorded. Only our own team can view replays (see Retention for how long we keep them). If you decline, we receive only anonymous, aggregated counts (page views, country-level location, device type) that store nothing on your device and cannot recognize you across visits. Our hosting provider also collects cookieless, aggregated performance and traffic statistics. We do not use advertising or cross-site tracking in either case.
Technical and log data. Our infrastructure and monitoring providers process IP addresses, browser information, and server logs for security, debugging, and operations. To diagnose problems and keep the AI reliable, our operational monitoring includes traces of AI interactions, which can contain the content of your requests and the AI's responses. Access to these logs is restricted, and they are kept only for a limited period (see Retention).
2. How We Use Data and on What Legal Basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the Service (accounts, AI chat, notes, storage) | Account data, your content | Contract (Art. 6(1)(b)) |
| Portfolio-aware research (if you connect a brokerage account) | Connected brokerage data | Contract (Art. 6(1)(b)) — you request the connection |
| Voice dictation | Microphone audio (transient) | Contract (Art. 6(1)(b)) |
| Billing and subscription management | Billing data | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Security, abuse prevention, and plan limits | Technical data, usage metering | Legitimate interest (Art. 6(1)(f)) — keeping the Service safe and fair |
| Monitoring, debugging, and reliability | Technical and log data | Legitimate interest (Art. 6(1)(f)) — operating a dependable service |
| Product analytics and session replay | Usage events, session replays | Consent (Art. 6(1)(a)) — asked on your first visit, withdrawable at any time |
| Improving the Service | Anonymous aggregated analytics, feedback you give us | Legitimate interest (Art. 6(1)(f)) |
| Responding to your messages | Email, message content | Legitimate interest (Art. 6(1)(f)) |
We do not sell your personal data, we do not share it for targeted advertising, and we do not use your content to train AI models.
3. AI Processing
When you use the AI features, the content needed to answer you — your messages, conversation history, files you attach, and workspace context such as notes you reference or, if you connected a brokerage account, a summary of your portfolio — is sent to third-party AI model providers (through a routing layer) to generate responses. Depending on the model you select, this may include providers such as Anthropic, OpenAI, or Google. Under the API terms we use, these providers do not train their models on data submitted through this channel; they may retain it briefly (typically a limited number of days) for abuse monitoring under their own policies.
When the AI searches the web or looks up market data on your behalf, the search queries and ticker/company lookups are sent to the relevant providers. These requests do not include your identity.
4. Who We Share Data With
We use a small number of service providers (processors) to run the Service, under data processing agreements. Because vendors may change as the product evolves, we describe them by category; email us if you want the specific vendor behind any category:
- Authentication, database, and storage providers — account data and your stored content
- Hosting and infrastructure providers — technical data, plus cookieless aggregated site statistics
- AI model providers (via a routing layer) — the content of your AI interactions, as described in Section 3
- Voice transcription provider — microphone audio in real time, if you use dictation
- Web search and financial data providers — queries generated on your behalf (not your identity)
- Portfolio connectivity provider — if you connect a brokerage account, the provider processes your broker authentication and returns your portfolio data to us; it maintains a registration for you identified by a pseudonymous ID, not your email
- Product analytics provider — identified events and session replays if you accepted analytics; anonymous aggregated counts if you declined
- Payment processor — payment and billing details, if you subscribe
- Monitoring and observability providers — logs and traces as described in Section 1
- Sign-in providers — if you sign in with a third-party account (e.g. Google), that provider processes your profile data to authenticate you
We may also disclose data where required by law, to enforce our terms, or to protect our rights, safety, or property. If Ombra is involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction; it will remain protected under this policy until superseded by one offering equivalent protection.
5. Services You Choose to Connect
The Service lets you connect optional third-party data sources and tools (for example, external data connectors you add yourself, or skills imported from public code repositories). If you connect one, the queries and content needed for it to work are sent to that third party, and any credentials you provide are stored encrypted. Your use of connected services is governed by their own terms and privacy policies — review them before connecting. You can disconnect them at any time.
6. International Transfers
Ombra is a US company and our providers process data in the United States, the European Economic Area, and other countries. Where personal data of EEA, UK, or Swiss users is transferred to countries without an adequacy decision, the transfer is safeguarded by the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as implemented by each provider.
7. Retention
- Account data and content: kept while your account is active. Content you delete in the app (such as notes) is immediately hidden from your workspace and permanently removed when your account is deleted. You can delete your entire account from settings at any time, which removes your account and content from our production systems; residual copies in backups are purged on a rolling basis, typically within 30 days.
- Connected brokerage data: kept while the connection is active. Disconnecting a brokerage account stops synchronization and removes that connection's synced data from our production systems. Deleting your account also removes your registration and data at the portfolio connectivity provider.
- Operational logs and traces: kept for a limited period, no longer than 12 months.
- Usage metering: kept for up to 12 months.
- Billing and invoice records: retained as required by law (accounting and tax rules, typically up to 7 years).
- Analytics events and session replays (if you accepted analytics): kept for up to 12 months, removed sooner if you withdraw consent or delete your account.
- Anonymous aggregated analytics: contain no personal identifiers and are not linked to you.
8. Your Rights (GDPR)
You have the right to access, correct, delete, and receive a copy of your personal data; to restrict or object to processing (including processing based on legitimate interests); and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, email legal@tryinvesti.com — we respond within one month. You can also delete your account yourself in settings, which is immediate and irreversible.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
9. US State Privacy Rights
If you live in California, Colorado, Connecticut, Texas, Virginia, or another US state with a comprehensive privacy law, you may have the rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell personal data, do not process it for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects, so there is nothing to opt out of. For the same reason, browser opt-out preference signals such as Global Privacy Control do not change how we process your data, though we honor them where required.
The categories of personal information we collect, our purposes, and the categories of recipients are described in Sections 1–4. We do not collect sensitive personal information as defined by these laws except any financial information you voluntarily include in your own content or brokerage data you voluntarily connect, which we use only to provide the Service.
To exercise your rights, email legal@tryinvesti.com or use the in-app deletion controls. We will verify your request using your account email and respond within the time required by your state's law. We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision; we will respond to appeals within the period your state's law requires, and if we deny the appeal you may contact your state Attorney General.
10. Cookies and Local Storage
The only storage we set without asking is strictly necessary: session cookies that keep you signed in, and your browser's local storage for app preferences and caches (theme, open tabs, drafts). We do not use marketing or third-party tracking cookies.
Analytics storage is opt-in. Nothing is stored on your device for analytics unless you accept the analytics prompt. If you decline, analytics runs in a cookieless mode that stores nothing on your device. You can change your choice at any time via the Cookie preferences link in the site footer — withdrawing is as easy as accepting.
11. Security
Data is encrypted in transit (TLS) and at rest by our providers. Sign-in uses one-time email codes or Google OAuth — we never store passwords. Credentials for services you connect are encrypted at rest. No system is perfectly secure, but we maintain technical and organizational measures appropriate to the Service, and if a breach occurs that risks your rights we will notify the competent authority and, where required, you, in line with applicable law (including GDPR Articles 33–34).
12. Children
The Service is not directed at anyone under 18, and we do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us and we will delete it.
13. Changes to This Policy
We may update this policy as the product evolves (for example, when we add features or change providers). We will post updates on this page with a new date and notify you of material changes before they take effect.
14. Contact
Ombra, Inc. — legal@tryinvesti.com