Privacy Policy
What we collect, how we use it, who we share it with, and the rights you can exercise.
- Version
- 2026-10
1. Who we are and what this covers
This policy explains how dpai.bot ("the site"), operated by PM.finance ("we", "us"), collects, uses, shares and protects your personal data. Together with the Terms of Service it forms the agreement between us. For anything in this policy, write to app@pm.finance.
This policy covers this site only. Google and GitHub sign-in pages are governed by those providers' own policies.
2. What we collect
2.1 Information you give us
- Account information: email address, password (stored only as an irreversible hash, never in plain text), display name, language and time-zone preferences, and your two-factor authentication settings if you turn them on.
- What you create in the workbench: your messages to the AI agent, and the strategies, code, versions, backtests and reports produced for you. We keep them so you can pick up where you left off. By default only you can see them.
2.2 Information we collect automatically
- Sign-in and session information: sign-in time, IP address, browser identifier (User-Agent) and session lifetime.
- Usage records: the chat turns and backtests you use each day and the corresponding usage units, used to apply daily limits and to understand the site's running cost.
- Security and audit logs for sensitive actions.
2.3 Information from third parties
When you sign in with Google or GitHub, that provider gives us your account identifier and email address.
2.4 What is required
An email address (or a Google / GitHub sign-in) is required to have an account. Your display name and preferences are optional.
3. Cookies and local storage
We use cookies and browser storage only to run the site: keeping you signed in, remembering your interface language and preferences, and completing the Google / GitHub sign-in redirect. We set no advertising cookies and use no third-party analytics or behavioural profiling. You can clear them in your browser; you will then need to sign in again.
4. Why we use your data, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run your account and the workbench (chat, strategies, backtests, reports) | To provide the service you signed up for | Performance of a contract |
| Send your workbench content to the engine provider | The engine generates replies, code and backtests | Performance of a contract |
| Apply daily limits and the site-wide usage budget | To keep the free service available and its cost under control | Legitimate interests |
| Detect unusual sign-ins, abuse and fraud | To keep accounts and the site secure | Legitimate interests |
| Send verification and security emails and service notices | To operate your account | Performance of a contract |
| Keep records the law requires | Legal obligation | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights; you may object at any time. We do not sell your personal data.
5. AI processing and the engine provider
The workbench is powered by the DPAI engine, run by an independent engine provider. To generate replies, strategy code and backtests, your conversation, strategy content and the surrounding context are sent to the engine provider, which processes and stores them to provide the engine. On the engine provider's side your account is represented by a pseudonymous identifier we generate; we do not send it your email address or name. The engine provider may delete generated artefacts, such as native reports, after a period of time; we keep a copy of a report you have opened.
Please do not type identity document numbers, bank details, passwords or other people's personal information into the conversation.
6. Who can see your information
6.1 Internal access
Authorised staff can see account information (such as your email address and usage) in the admin console to operate and support the site. Access is granted by role and recorded. Staff do not view your strategy code or conversations; where access is genuinely needed to investigate a technical problem, we ask for your permission first and record the access.
6.2 Service providers
We share personal data, only as far as needed, with:
| Recipient | Purpose | Data involved |
|---|---|---|
| Engine provider (DPAI) | Generating replies, code and backtests | Your workbench content and a pseudonymous account identifier |
| Email service provider | Verification and security emails | Email address and message content |
| Cloud and infrastructure providers | Hosting, storage and logs | Storage and transmission of the above |
| Google / GitHub | Third-party sign-in | Account identifier and email address |
Providers that process data on our instructions are bound by confidentiality and data-processing terms. We also disclose data where the law or a competent authority requires it.
6.3 Transfers of the business
In a merger, restructuring or sale of the business, your data may transfer as part of the transaction. We will tell you who the recipient is beforehand and require it to remain bound by this policy.
7. Cross-border transfers
We and our service providers are not all in the same country, so your data moves between jurisdictions, including to servers in Japan. Where it does, we rely on a lawful transfer mechanism, such as standard contractual clauses. You can ask us for details at app@pm.finance.
8. Your rights
You may access, correct, export or delete your personal data, restrict or object to processing, and withdraw consent you gave earlier.
- Export: account settings let you download your data — your account information, strategies, versions, backtests and conversations — as a file.
- Deletion: account settings let you delete your account. Your sign-in details, profile, strategies and conversations are removed and you can no longer sign in. Usage records we must keep for accounting and abuse prevention are retained without your name or email address. We also ask the engine provider to remove the content held for your pseudonymous account where it supports that. Deletion cannot be undone.
For anything else, write to app@pm.finance. We will verify your identity before acting on a request and normally respond within 30 days. If you are not satisfied with our answer, you may complain to the supervisory authority with jurisdiction.
9. How long we keep it, and how we protect it
9.1 Retention
- Account information and workbench content: kept while your account exists; removed when you delete your account.
- Usage records: append-only for accounting and abuse prevention; kept without your name or email address after deletion.
- Security and audit logs: kept for as long as needed for security and legal purposes.
- Backups: deleted data may persist in backups until the next rotation.
9.2 Protection
- HTTPS across the site; data is encrypted in transit and at rest.
- Passwords are stored only as salted hashes (argon2id); two-factor secrets are encrypted before they are stored.
- Permissions are checked on the server for every request; sensitive actions are written to an audit log.
- Sign-in and other sensitive entry points are rate-limited.
No system is absolutely secure. If personal data is or may have been leaked, altered or lost, we will act immediately, notify the competent authority where the law requires, and tell affected users promptly.
10. Children
The site is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes to this policy
When this policy is updated we will change the version and publish it on the site. Where a change is material we will notify you before it takes effect, by in-app notice or email.
12. Contact us
For any question, request or complaint about this policy, write to app@pm.finance.