Privacy Policy

Last updated: October 5, 2026

This policy covers the personal data FundFacts API collects through this website, the REST API and the MCP server that AI apps such as ChatGPT and Claude connect to: what we collect, why, who receives it, how long we keep it and what you can do about it. Fund data itself (ISINs, prices, holdings and documents published by fund houses) is not personal data.

Data we collect

  • AccountYour e-mail address, your plan, the date you signed up and, once you pay, your Stripe customer and subscription identifiers. Supabase Auth keeps how you sign in: a hashed password, a magic-link request, or, with Continue with Google, the name, e-mail address and profile picture link that Google shares through OAuth (we never receive your Google password). Supabase Auth also records the IP address and browser of each sign-in session.
  • How you found usWhen you arrive from another site or from a link with campaign parameters (utm_*, ref, or a Google Ads click id: gclid, gbraid, wbraid), a cookie keeps the landing page, the referring page and those parameters. If you then create an account, they are copied to your profile, with the country your IP address points to when you first open the dashboard or connect an assistant (the country only, not the address), so we can see which countries sign up and pay. They are also included in the notifications we receive when you sign up, when you start a checkout and when you write to us in the chat, with your plan if you have an account.
  • API keys and request logAPI keys are stored only as a hash, with a short prefix so you can recognise them, the name you gave them and their creation, last-use and revocation dates. Every API and MCP call is logged with your account, the key or connection used, the endpoint, the ISIN or SCPI identifier when there is one, whether it was answered from cache, the HTTP status, the duration and the time. In these cases the first 32 characters of what was sent are logged as typed: an invalid ISIN sent to the REST API, and an SCPI slug, ISIN or name that /v1/scpi or get_scpi cannot match or fails to load, or that /v1/scpi refuses because a limit is reached. Search terms and portfolio weights are not stored in this log; a search sent to the REST API is part of the request URL recorded in the technical logs.
  • Connected AI apps (ChatGPT, Claude, other MCP clients)When you approve a connection we record the app (its name, client id and redirect addresses, and, for an app that registers itself, the IP address it registered from) and the account that approved it. The connection receives access and refresh tokens, which we store only as hashes. On each tool call the app sends us the tool inputs: ISINs, fund or SCPI names to search for, or a list of positions with their weights. They are used to answer that call; only the request log above is kept, and the first ISIN or SCPI of a call can appear in the Telegram notification described under Support and account notifications. We do not receive your conversation, your prompts, the rest of the assistant's answer or anything from your account with the AI provider. What we send back is fund and SCPI data, and when a limit is reached the error message says which limit and when it resets. An app that asks for OpenID sign-in or for the e-mail permission receives your FundFacts account id; with the e-mail permission it also receives your account e-mail address and whether it is verified. When an app asks for either (ChatGPT does), the approval screen shows one line, “See your account e-mail address”, and you approve or refuse the request as a whole.
  • Documents sent to the extract endpointA fund document (PDF, text or link) you send to /v1/extract is read to answer that request and is not stored; its text is sent to OpenAI for the extraction.
  • Factsheets and webhooksFactsheets you generate (the fund, your options, a copy of the data, a share token and a view count) and the webhooks you register (endpoint URL, signing secret, events, delivery log). Anyone who has a factsheet's share link can open it; it shows fund data only.
  • Support messages and feedbackMessages sent through the in-site chat, with the page you wrote from and the e-mail address you leave, if any; a visitor without an account is recognised by a random id kept in a cookie. Messages sent through the contact form (e-mail, company, topic, message), with the approximate city and country derived from your IP address and whether you wrote from a phone or a computer; these are forwarded to us and not stored in our database. Answers to the in-dashboard feedback form (rating, message, use case).
  • E-mailsA record of each product e-mail sent to you (its type, the date and the Resend message id) and whether you unsubscribed.
  • PaymentsPayments are made on Stripe Checkout. Stripe collects your card details, name, billing address and any tax id, and computes the tax; we never see card numbers. We receive and keep the payment notifications Stripe sends us, which include your e-mail address, name, billing address and subscription details. When usage beyond a plan's monthly requests is billed, we report it to Stripe for invoicing.
  • Technical logsOur hosting providers record each request in their platform logs: the IP address, user agent, URL or path, status and time. Vercel does so for the website, the API and the MCP server, and Supabase for requests to the database and the sign-in service. Messages our code writes to these logs while loading a fund or an SCPI can include its ISIN, SCPI identifier or name; they do not include what you typed when it is not a valid ISIN.
  • Website visits and advertisingTo count visitors we keep one number per day. Your browser gets a cookie that only says it has already been counted; it holds no identifier, and we store no IP address or user agent for it. To compare two versions of the home page, your browser gets a cookie naming the version it is shown and, once it has been shown, the language and time; we count one number per day, version and language, and if you then create an account, the version is copied to your profile. Vercel Speed Insights measures page load performance and sets no cookie. When the Google Ads tag is enabled on the site, Google sets its own cookies and receives the pages you visit and, from your browser, conversion events (sign-up, first API key, first API or MCP call, purchase) labelled with your account id or subscription id so that each event is counted once. We keep a record of each conversion (its type, the date, the account or subscription id and, for a purchase, its amount) so that it is sent only once. The tag allows Google Ads enhanced conversions, which can send Google a hashed form of an e-mail address entered on the page. OpenAI's measurement pixel, for our ads shown in ChatGPT, runs on the site's pages except shared factsheets. It sets __obref (1 year, a random browser reference) and, when you arrive from one of those ads, __oppref (30 days, the reference of the ad click). We send it two events from your browser: your account being created and a paid plan starting (with the plan and its amount), each labelled with your account id or subscription id so that it is counted once, together with SHA-256 hashes of your e-mail address and account id so that OpenAI can match the event to an ad seen on another device. Its automatic matching can also send OpenAI a hashed form of an e-mail address entered on the page. The same record of each conversion keeps them from being sent twice.

How we use it

  • Providing the serviceSigning you in, checking API keys and connections, answering API and MCP calls, generating factsheets and delivering webhooks.
  • Limits, billing and taxCounting requests against your plan, rate limiting, showing usage in your dashboard, invoicing and computing tax. When usage beyond a plan's monthly requests is billed, we report it to Stripe for invoicing.
  • Security and abuse preventionThe request log, sign-in records and the IP address an app registers from are used to detect misuse. Public endpoints are rate limited per IP address; our code keeps those addresses in server memory only, apart from the technical logs of our hosting providers described above.
  • Support and account notificationsAnswering chat and contact messages. We also receive notifications on Telegram about account events (sign-up with how you found us, each API key created with its name, app connected, first call with its ISIN, use of the MCP server, checkout started with how you found us, subscription changes, feedback, usage beyond the plan), each with the account e-mail address. The MCP server notification is sent at most once a day per connected app or API key, on its first tool call of the day (UTC), and names the account and its plan, the app or API key, the tool, the first ISIN or SCPI it asked for, and whether it is the account's first MCP call; it never includes search text. We also receive a daily summary of MCP server use: the number of requests and accounts, and the requests per app and per tool and the apps connected that day, without e-mail addresses. A chat message from a visitor comes with how they found us, and from an account with its e-mail address and plan.
  • E-mailsAccount e-mails (sign-in links, receipts, replies to your messages) and product e-mails, including offers for our plans. Which product e-mail you receive, if any, is chosen from your REST API usage (requests made, limits reached, funds you requested or that we could not find) and from whether your e-mail address is a company address. The e-mails sent in the weeks after sign-up (getting started, not used for a while, and a plan offer), the e-mail for accounts that have not made a call yet and the notice that you reached your monthly requests also count the calls made by connected apps, never their content. Every product e-mail has an unsubscribe link.
  • Improving coverageISINs that could not be answered tell us which funds and fund houses to add.
  • Measuring our marketingHow you found us, the daily visit count and the Google Ads and ChatGPT ads conversions tell us which channels bring users.

We do not sell personal data. What connected AI apps send us (tool inputs such as ISINs, fund names and portfolio weights) is used to answer the call; of it we keep only the request log entry described above, used for limits and billing, security, account notifications and improving coverage. The ISINs, names and weights an app sends are never used for marketing or advertising: they do not choose or fill the product e-mails we send you and are not shared with Google Ads or OpenAI’s ad pixel. Only the number and dates of calls count toward the e-mails sent in the weeks after sign-up, the e-mail for accounts that have not made a call yet and the monthly-requests notice (see E-mails). The only advertising signal tied to API or MCP use is the “first call” conversion described above, which carries no call content.

Who receives it

We use the following service providers, each only for the role stated. Some of them process data outside the European Union, for example in the United States.

  • SupabaseDatabase and authentication host. All the data above that we store lives in a Supabase project on AWS in eu-west-1 (Ireland).
  • VercelHosting of the website, the API and the MCP server; our server functions run in Vercel's Dublin region. Vercel keeps the technical logs of those requests and also provides Speed Insights and the IP-based location used by the contact form.
  • StripePayment processing, invoicing and tax calculation.
  • ResendDelivery of our e-mails: your e-mail address and the content of each e-mail.
  • TelegramMessaging service on which we receive chat and contact messages and account notifications, and from which we reply.
  • GoogleSign-in with Google when you choose it, and the Google Ads tag described above.
  • OpenAI, Firecrawl and OpenFIGITo fetch and read the public documents of a fund, we send these services ISINs, fund names and fund-house web pages or documents, and documents you send to the extract endpoint (OpenAI only). For this we never send them your e-mail address or account details. Separately, OpenAI receives the ChatGPT ads conversions described above.
  • The provider of an AI app you connectOpenAI for ChatGPT, Anthropic for Claude, or the provider of another MCP client receives the results of the tool calls its app makes and, when its app asked for them on the approval screen, your account id and e-mail address. It processes your conversation under its own privacy policy.
  • Recipients you chooseWebhook endpoints you register receive fund change events, and anyone you give a factsheet share link can open it.

How long we keep it

  • Account dataYour account and sign-in data, API keys, connections, request log, factsheets, webhooks, feedback, e-mail record, conversion, notification and usage-report records, and how you found us: for as long as your account exists. When you ask us to delete your account, we delete it and this data by hand within 30 days. You can delete factsheets and webhooks yourself at any time; a revoked API key or a disconnected app stops working at once and stays listed as revoked.
  • OAuth authorization codesValid for 10 minutes and deleted by our daily clean-up one day after they expire.
  • OAuth access and refresh tokensAn access token is valid for 1 hour and a refresh token for 90 days (each refresh replaces it). Token records are deleted by the daily clean-up 7 days after they expire, whether they were used, revoked or not.
  • Registered AI appsAn app's registration, including the IP address it registered from, is deleted once 90 days have passed in which neither the app nor any of its connections was used or disconnected, and none of its connections is still active.
  • Chat conversationsA chat conversation and its messages are deleted by our daily clean-up 3 years after its last message, with or without an account, or by hand within 30 days after you ask us to.
  • Copies on TelegramThe copies we receive on Telegram (chat and contact messages, account notifications) stay in our Telegram chat until we delete them; we do so by hand within 30 days after you ask us to.
  • Payment notificationsThe payment notifications Stripe sends us are kept for up to 10 years for accounting, then deleted by our daily clean-up.
  • Technical logsKept by Vercel and Supabase for the log retention period of our plan with each provider, then deleted by them.
  • CookiesHow you found us: 90 days. Chat visitor id: 1 year. Visit counter: 1 year. Home page version: 90 days. Return address during sign-in: 15 minutes. Sign-in session: until you sign out or the session expires. Google Ads cookies: as set by Google. OpenAI pixel: __oppref 30 days, __obref 1 year.
  • Records kept by StripeStripe keeps payment and invoice records under its own retention rules and the accounting obligations that apply to invoices.

Your controls and rights

  • API keys and connected appsRevoke an API key or disconnect an app at any time from your dashboard. It takes effect immediately: the key or the app's tokens are rejected on the next call, and the app has to ask for your approval again to reconnect.
  • Factsheets and webhooksDelete them from your dashboard; a deleted factsheet's share link stops working.
  • E-mailsEvery product e-mail has an unsubscribe link. Opting out does not stop the e-mails needed to run your account (sign-in links, receipts, replies to your messages).
  • CookiesYou can block or delete cookies in your browser. Signing in needs the sign-in session cookies and the chat needs its visitor id when you have no account; the site works without the others, and blocking googletagmanager.com stops the Google Ads tag and blocking bzrcdn.openai.com stops OpenAI’s pixel.
  • Access, copy, correction and deletionE-mail hello@fundfactsapi.com from the address of your account to get a copy of your data, have it corrected, object to a use or have your account and its data deleted. Deletion follows the periods in How long we keep it.
  • ComplaintIf you live or work in the European Union or the European Economic Area, you can also lodge a complaint with the data protection authority of that country.

Contact

Questions about this policy or your data: hello@fundfactsapi.com, the contact form or the chat on any page. When this policy changes, the date at the top of the page changes with it.