Privacy Policy
Last reviewed: 2026-06-18. This policy applies to AI Alpha Engine and describes how personal data is processed when you use this service.
Operator and contact
This service is operated by Lighthouse Cat AB as a private portfolio tool. Enquiries about your personal data, including access, correction, and deletion requests, can be sent to:
Privacy contact: [email protected]
Data we process
Depending on how you use the service, we may process the following data:
- Login identity — email address and/or Discord user ID and display name, used to authenticate you and identify your account.
- Uploaded portfolio data — holdings, quantities, market values, currencies, and purchase history imported from Avanza CSV files or Montrose snapshots.
- Generated reports and diagnostics — AI-generated analysis, thesis validation results, and portfolio diagnostics produced from your portfolio data and market signals.
- Technical and security logs — server access logs, error logs, and session records retained for operational security purposes.
Purposes and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Authentication and account access | Contract — necessary to provide the service (Art. 6.1.b) |
| Portfolio import and storage | Contract — you explicitly upload this data to use the analysis features (Art. 6.1.b) |
| Report generation and diagnostics | Contract — core service delivery (Art. 6.1.b) |
| Security and operational logs | Legitimate interest — protecting the service and its users from misuse (Art. 6.1.f) |
AI processing
Portfolio and market data may be sent to a third-party AI model provider (see Subprocessors below) to generate analysis reports and diagnostics. This app does not use your data to train public AI models and does not submit identifiable financial data beyond what is necessary to generate the requested output.
Retention
- Account and portfolio data is retained while your account is active.
- You may request deletion of your account and all associated data at any time (see Your rights below).
- Security and operational logs are retained for a limited period (typically up to 90 days) and then deleted.
Your rights
Under the GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your account and associated personal data.
- Restriction — request that we restrict processing of your data in certain circumstances.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a structured, machine-readable format where technically feasible.
- Complaint — lodge a complaint with the Swedish Authority for Privacy Protection (IMY, Integritetsskyddsmyndigheten) at imy.se.
To exercise any of these rights, contact: [email protected]
Subprocessors
Depending on the deployment configuration, the following categories of third-party processors may handle personal data on behalf of this service:
- Hosting and server infrastructure — the server or cloud provider where this service is deployed.
- AI / model provider — if configured, an AI API (e.g. OpenAI) receives portfolio and market data to generate reports. Their privacy policy applies to data submitted to their API.
- Market data provider — if configured, a financial data provider (e.g. FMP) receives ticker symbols to fetch news and analyst grades. No personal data is included in these requests.
- Email delivery provider — if email login is configured, an email service provider may process email addresses to deliver authentication codes.
- Discord — if you log in via Discord, Discord processes your identity according to their privacy policy.
International transfers
Some subprocessors (including AI and market data providers) may be located or process data outside Sweden and the European Economic Area. Where such transfers occur, appropriate safeguards are used (e.g. Standard Contractual Clauses or adequacy decisions). Contact us for details specific to the current deployment configuration.
Cookies
This service uses only necessary cookies for login session management. No advertising, analytics, or cross-site tracking cookies are used. See the Cookies page for the full list. Cookies.
Changes to this policy
This policy may be updated to reflect changes to the service or applicable law. The date at the top of this page indicates when it was last reviewed.