Privacy Policy

This Policy applies to information we collect through the Service — including our website, API, and any integrations through which you access CoreThesis. It does not apply to third-party platforms, agent frameworks, marketplaces, or payment processors through which you may reach or use the Service; those are governed by their own privacy policies. CoreThesis is a publisher of general financial information and is intended for users who are at least 18 years old. We do not knowingly collect information from anyone under 18.

We collect only the information needed to operate the Service, bill for usage, and keep accounts secure. The categories are:

We do not ask for and do not want sensitive personal information (such as government identifiers, health, or biometric data). Please do not send it to us.

We use the information we collect to:

• provide, operate, and maintain the Service and deliver the reports you request;
• authenticate your account, issue and manage API keys, and keep the Service secure;
• meter usage, process payments through our payment processor, manage prepaid balances, and enforce spending limits;
• respond to your support requests and send you service-related and billing-related communications, including price-change notices;
• monitor, troubleshoot, prevent abuse of, and improve the Service; and
• comply with legal obligations and enforce our Terms of Service.

We do not use your account, billing, or usage information to build the financial reports themselves. Reports are generated from public data sources and are identical for every user who requests them; they are not based on your personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these limited circumstances:

• Service providers. With vendors who perform functions on our behalf — for example, payment processing, cloud hosting and storage, and infrastructure — and who are permitted to use the information only to provide those services to us.
• Legal and safety. When we believe disclosure is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of CoreThesis, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, in which case information may be transferred as part of that transaction, subject to this Policy.

Our payment processor is Stripe, which collects and processes your payment-card information directly under its own privacy policy. We receive transaction confirmations and limited billing metadata, not your full card details.

We keep your information for as long as your account is active and as needed to provide the Service. After you close your account, we retain information only as long as reasonably necessary to comply with legal, tax, and accounting obligations, resolve disputes, prevent abuse, and enforce our agreements, after which we delete or de-identify it.

We use reasonable administrative, technical, and organizational safeguards designed to protect your information, including hashing passwords and limiting access to account and billing data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and API keys confidential.

Regardless of where you live, you can:

• access and update your account information in your account settings;
• regenerate or revoke your API key;
• close your account at any time; and
• request a copy or deletion of the personal information we hold about you by emailing support@corethesis.io. We will respond consistent with applicable law.

Depending on your state of residence, you may have additional rights — such as the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. Because we do not sell or share personal information for advertising, there is no opt-out of sale to exercise. To make any request, email us at the address above; we may need to verify your identity before responding, and you may use an authorized agent where the law permits.

The Service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

CoreThesis is operated from the United States and intended for U.S. users. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those of your location.

We may update this Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice by reasonable means, such as email or an in-product notice. Your continued use of the Service after the changes take effect means you accept the updated Policy.

Questions about this Policy or our privacy practices may be directed to: