Privacy Policy
This is a draft for review. It is not legal advice and is not finalized for commercial use. Consult qualified legal counsel before relying on this policy.
1. Data we collect
AbateInvestments collects the information you provide: account credentials (email, password — hashed, never plain text), profile details, organization records, portfolio and investment data, transactions, valuations, and documents you upload. We do not collect brokerage passwords directly.
2. How we use data
Your data is used to provide the platform's tracking, analytics, reporting, and management features. We do not sell your data. Aggregated, non-identifiable analytics may be used for platform improvement.
3. Data security
AbateInvestments uses row-level security, server-side authorization, audit logging, least-privilege roles, encryption in transit, and the storage provider's encryption protections. Private documents use short-lived signed download URLs issued only after server-side authorization.
4. Data isolation
Multi-tenant isolation is enforced at the database layer. One organization's users cannot access another organization's portfolios, documents, financial data, or records by modifying a URL, request parameter, or record identifier.
5. Data retention
AbateInvestments follows data minimization principles. Account deletion and data export workflows are supported. Archived portfolios preserve historical financial records without silent deletion.
6. Your rights
You may access, export, and delete your data through the platform or by contacting support. Where applicable, you may have additional rights under your local privacy regulations.
7. What we don't do
We do not log passwords, access tokens, full identity documents, or unnecessary financial information in audit trails. We do not display invented live prices or falsely claim accounts are connected.
8. Changes to this policy
AbateInvestments may update this policy. Material changes will be communicated through the platform.
DRAFT — This document is a template for legal review and is not a finalized, legally binding privacy policy. It must be reviewed and approved by qualified legal counsel before commercial use.