Weft Privacy Notice

1. Who we are

Weft (weft.trade) is run by Geo Nicolaidis, an individual, not a company ("we", "us"). We are the controller of the personal data described in this notice: we decide why and how it is used.

Contact for anything about your data: geo@geonicolaidis.com

We have not appointed a data protection officer; we are not required to. This notice applies the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018, which supplements it.

2. What we collect, why, and on what legal basis

The GDPR requires a legal basis for each use of personal data. We rely on these:

• Contract (Article 6(1)(b)): we need the data to provide Weft as described in our Terms of Use.
• Legitimate interests (Article 6(1)(f)): the interest is named each time.
• Consent (Article 6(1)(a)): only for the optional AI context in the daily brief, with a second, separate consent for including your own research. You can withdraw consent at any time in Weft.
• Legal obligation (Article 6(1)(c)): where the law requires us to keep or use data, for example to answer a request under the GDPR.

Your right to object. Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, by emailing geo@geonicolaidis.com. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Rate limits and IP addresses. To limit signups, sign-in attempts and unsubscribe requests, Weft counts requests from your IP address; for sign-in, it counts your IP address together with the email address entered. For everything else it counts by account. Weft stores only a one-way hash (SHA-256) of the scope, the identifier and the time window, never the raw IP or email address. The hash is not salted, so someone with access to the database could test guesses against it: it is pseudonymised, not anonymous, and we treat it as personal data. Counters cover windows of one minute to one hour, and Weft deletes expired counters during normal use.

What Weft does not collect. We do not ask for your bank, card or broker login details, government ID or date of birth. Weft does not connect to broker accounts. Weft's own application logs record errors and job results. They are written to leave out your email address, holdings and the text you write, although an error can name the market symbol that failed.

If you do not provide your email address and a password, we cannot create an account. Everything else is optional or depends on the features you use.

3. AI features

Both AI features are off until you switch them on, and we can also switch them off for everyone. AI output is labelled in Weft. It never changes the facts, dates or prices Weft shows. It is not investment advice.

AI context in the daily brief. If you opt in, Weft sends OpenAI a selection of evidence for that day's brief: headlines, short source text, dates and publishers, and observations about companies you follow, hold or have alerts on, such as a price change over a stated period. It also sends background records about those ecosystems. This shows OpenAI which companies and ecosystems are in your brief. Weft does not send your name, email address, account ID, quantities, costs or portfolio values.

If you also give the separate private-research consent, Weft adds excerpts from research you own: the title and up to about 1,400 characters of each of up to three documents you added (pasted or fetched), and the title, thesis and counter-thesis (shortened to about 700 and 500 characters) of up to two open research cases you own. Anything you wrote there, including any personal data, goes to OpenAI. Research other people have shared with you is never sent. If you edit the thesis of a case someone else owns, your text is part of their case and can be sent if the owner gives this consent.

The generated context is stored with that day's brief for 30 days (section 7).

AI explanations in Live. If you switch this on in your Live settings, Weft sends OpenAI the title, summary, publisher and date of a public headline and asks for a general explanation. Weft sends nothing about you: no holdings, research, scope or account details. The explanation is stored without any link to you and can be shown to other users who see the same headline.

How OpenAI handles it. Weft calls OpenAI's standard API (api.openai.com), not its European data-residency option, so AI requests are processed in the USA (section 6). Response storage is turned off (store: false) and no tools are used. OpenAI states that it does not use API data to train its models unless the customer opts in. OpenAI states that, by default, it keeps API inputs and outputs for up to 30 days to detect abuse, unless the law requires it to keep them longer or it needs them to protect its services or others from harm (see OpenAI's data controls (opens in a new tab)). Weft records the cost and size of each AI call against a fixed monthly budget. Those records contain no prompts and no account details.

Switching off. You can switch either feature off at any time: AI context in the brief settings, AI explanations in the Live settings. Withdrawing consent does not make processing before then unlawful. When you switch AI context off or change its settings, Weft deletes the AI text and evidence it already stored under your earlier settings. While your account has not accepted an updated version of the Terms of Use, Weft generates no AI context for you.

4. Emails

Weft sends emails through Resend:

• Account emails: six-digit codes when you change your email address, sent to your old and new addresses.
• Alert emails: when one of your alerts fires. Each email lists the alerts that fired.
• Daily brief emails: only if you turned them on, or when you ask Weft to email you today's brief. A brief email names companies you follow or hold and their price changes, headlines, upcoming events, alerts that fired and, if enabled, AI context. It does not include your quantities or portfolio values. Every brief email has an unsubscribe link that works without signing in, and you can turn the email off in Weft.

Every HTML email shows Weft's logo, loaded from weft.trade. If your email app loads images, it fetches the logo from our host, which records the request like any visit (section 2, hosting logs). The logo address is the same for everyone, so it does not tell us who opened which email.

We do not send marketing emails. If we ever want to, we will ask first.

5. Who receives your data

Service providers (processors). These companies process data for us under contract and only on our instructions:

Vercel also uses some request data, such as IP addresses, for its own purposes, for example to protect its network against attacks and fraud, as described in Vercel's privacy notice (opens in a new tab).

Other Weft users. Collaborators on a research case see that case and the names and email addresses of the people on it. Ecosystems you publish are visible to every Weft user, without your name.

Data providers. To show market data, news and other information, Weft's servers request data from third parties such as Yahoo Finance, Google News, FRED, EODHD, Financial Modeling Prep and public agencies. These requests come from Weft's servers, not your browser. They contain only what is needed to fetch the data, for example a ticker or a company name, and never your name, email address or account ID. Some requests do follow from your activity:

• The symbols of your positions, watchlist names and price alerts are sent to our market-data providers (Yahoo Finance, and EODHD or Financial Modeling Prep where configured) to fetch their prices and price history, never quantities or costs.
• The text you type into instrument search, and identifiers from a portfolio import, are sent to Yahoo Finance's listing search.
• The symbols of positions held by users with the Live monitor switched on are used to fetch Yahoo Finance's public headline feeds. Weft fetches each symbol once for everyone who holds it.
• When you ask Weft to fetch a document, Weft's servers fetch the address you entered. The website receives the request from Weft (by default identified as "Weft research importer"), not from you.

Live TV broadcasters. As soon as you open Live TV, or switch channel, your browser starts loading that channel's stream, muted, directly from the broadcaster or its delivery network: DW (through Akamai), Bloomberg, Al Jazeera or Sky News. Weft opens the channel you last chose (Bloomberg at first), or the one it suggests for a finding you opened it from. The broadcaster receives your IP address, browser details and the fact that the request came from Weft. Its own privacy notice applies. Depending on your browser, it may also be able to set or read its own cookies. Nothing is loaded from broadcasters until you open Live TV.

Links. If you follow a link to another website, that site's privacy notice applies.

Others. We may disclose data if the law requires it, for example to a court or public authority, or to protect the rights and safety of Weft, its users or others. If Weft is taken over by someone else, your data would move to them; we would tell you first.

We do not sell your personal data or share it for advertising.

6. Where your data is processed

Weft's server code runs in Vercel's Frankfurt region, Germany, and its database is hosted in Frankfurt, Germany (AWS region eu-central-1). Some providers are based outside the European Economic Area (EEA) or may access data from outside it:

• Vercel (Vercel Inc.) is a US company. Vercel's global network handles incoming requests and may do so at locations near you, including outside the EEA. Safeguard: the Vercel Data Processing Addendum (opens in a new tab), which forms part of Vercel's terms, applies the Standard Contractual Clauses. Vercel also states that it is certified under the EU-US Data Privacy Framework (opens in a new tab).
• Supabase contracts through Supabase Pte. Ltd, a Singapore company. Supabase and its sub-processors may process data outside the EEA, for example when its staff operate and support the service. Safeguard: the Supabase Data Processing Addendum (opens in a new tab), which forms part of Supabase's terms, applies the Standard Contractual Clauses.
• Resend (Plus Five Five, Inc.) is based in the USA and stores email data there. Safeguard: the Resend Data Processing Addendum (opens in a new tab), which forms part of Resend's terms, applies the Standard Contractual Clauses, and Resend states that it participates in the EU-US Data Privacy Framework (see Resend's GDPR page (opens in a new tab)).
• OpenAI (only if you switch AI on): Weft uses OpenAI's standard API, so AI requests are processed in the USA. Safeguard: under the OpenAI Data Processing Addendum (opens in a new tab), which forms part of OpenAI's terms, OpenAI Ireland Ltd processes data covered by EEA data protection law and transfers it outside the EEA only under agreements containing the Standard Contractual Clauses or under an adequacy decision of the European Commission. Data covered by UK data protection law is processed by OpenAI OpCo, LLC under the Standard Contractual Clauses as amended by the UK Addendum.

The EU-US Data Privacy Framework is covered by an adequacy decision of the European Commission (GDPR Article 45). Standard Contractual Clauses are an appropriate safeguard under GDPR Article 46. You can ask us for more detail or a copy of the safeguards that apply.

7. How long we keep data

Closing your account. Weft has no self-service account deletion; we close accounts on request (section 11). When we close yours, Weft deletes your account and the data linked to it: profile, settings, brokers, watchlists, portfolios and positions, checkpoints, scenarios, saved screens, alerts, briefs and their delivery records, AI settings and context, Live monitor data, the research cases you own with everything in them, your documents, and the ecosystems you created. Some things stay, or affect other people:

• Content you added to a research case someone else owns (claims, evidence, catalysts, risks, targets, decisions, and edits to its thesis and other text) stays in that case without your name. Your comments there, the thesis versions and claim revisions you saved, and your entries in its activity log are deleted. Ask us if you want the content removed too.
• Documents you added to a case someone else owns are deleted, together with the citations to them in that case.
• If someone else shared a research case with you, that case's activity log keeps a line with your email address recording when it was shared. Ask us and we will remove it.
• Ecosystems you published stop being available to other users, and the watchlist names and alerts other users had on their companies are deleted too.
• Deleted data remains in our database provider's backups until they expire (see the table above).

If we must keep anything longer, for example to deal with a legal claim, we keep only what is needed for as long as it is needed.

8. Cookies and browser storage

Weft sets two cookies. Both are strictly necessary, so the law does not require your consent for them:

If we turn on our host's protection against automated attacks, Vercel may also set its own short-lived security cookie to check that a visitor is not a bot.

Weft also keeps some preferences in your browser's local storage. You set some yourself, such as the theme; Weft remembers others as you use it, such as the last company tab, chart period or Live TV channel. They stay on your device and are never sent to us:

Weft also uses session storage (weft:scroll:…) to put you back at the same scroll position when you return to a page. It is cleared when you close the tab.

You can clear all of this in your browser settings. Clearing the session cookie signs you out. Weft uses no advertising, analytics or tracking cookies, and its fonts and map data are served from Weft itself, not from third parties.

9. How we protect your data

Measures built into Weft include:

• Passwords are stored only as bcrypt hashes. Passwords must be at least 12 characters.
• Sign-in sessions use signed, HttpOnly cookies, sent only over HTTPS in production. Changing your password or email address signs out your other sessions, and you can sign out other sessions yourself.
• Changing your email address needs your current password and a code sent to both your old and new addresses. Codes expire after 10 minutes and are stored only in hashed form.
• Sign-in gives the same answer and takes about the same time whether or not an account exists. Signing up, and adding a collaborator to a research case, do show whether an email address is registered; both are rate-limited.
• Rate limits slow down password guessing and abuse, using hashed (pseudonymised) identifiers.
• Weft checks on every request that you may access the record concerned. Sensitive account actions also check that the request came from Weft itself.
• Scheduled jobs require a secret key. Unsubscribe links are signed and stop working after a password or email change.
• AI requests use a fixed allowlist of fields, as described in section 3.
• Weft is served over HTTPS.

We also rely on the security measures of our hosting and database providers. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will tell you as the law requires.

10. Automated decisions and profiling

Weft makes no decisions about you that have legal or similarly significant effects (GDPR Article 22). Nothing in Weft decides whether you can use a service, on what terms, or at what price.

Some features process your data automatically:

• Research priorities orders companies for further research. If you answered the investor questions, the order is adjusted slightly by your risk appetite and trading style, and labels such as "fits conservative profile" explain why. It only changes the order of a list. You can change or clear your answers at any time, or object (section 11).
• The daily brief, alerts and Live monitor select information from the names, holdings and ecosystems you follow.
• AI context (if you opt in) explains public information. It does not assess you.

11. Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict how we use your data, for example while we check a complaint;
• data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another provider where that is technically possible;
• withdraw consent at any time, without affecting processing before you withdrew it.

Your right to object. You can object at any time to processing based on legitimate interests (section 2), on grounds relating to your particular situation.

In Weft you can: edit your name, investor answers and preferences; change your email address and password; sign out other sessions; delete watchlist names, positions, portfolios, alerts, research and documents; turn the daily brief email off (also through the link in any brief email); switch the AI features off; and pause or reconfigure the Live monitor.

By email: for anything else, including a copy of your data and closing your account, email geo@geonicolaidis.com, preferably from your account's email address. Weft does not yet offer self-service account deletion or data export, so we do these by hand. We may ask you to confirm your identity. We reply within one month. If a request is complex, or you send many, we may take up to two more months and will tell you why. Requests are free, unless they are clearly unfounded or excessive.

12. Complaints

Please contact us first so we can try to resolve the problem. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or where you think the problem happened. In Cyprus this is:

Office of the Commissioner for Personal Data Protection

• Address: 15 Kypranoros Street, 1061 Nicosia, Cyprus
• Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus
• Telephone: +357 22 818 456
• Email: commissioner@dataprotection.gov.cy
• Website: www.gov.cy/dataprotection (opens in a new tab)

13. Children

Weft is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, tell us and we will close it and delete its data.

14. Changes to this notice

We will update this notice when Weft or the law changes. Each version has an identifier and date at the top. If a change materially affects how we use your data, we will tell you by email or in Weft before it takes effect. Where a change needs your consent, we will ask for it.

15. Contact

Geo Nicolaidis, operator of Weft: geo@geonicolaidis.com