Privacy Policy

1. Scope

This policy explains what information Ridhics collects when you use the Ridhics EVA web application, our APIs, or the EVA MCP server, including when EVA is used as a connector or app inside an AI assistant such as ChatGPT or Claude, and how we use and protect it.

2. Information we collect

• Account information: name, email, organization name/ID, role, and authentication identifiers, such as Google, WorkOS SSO, or demo access identifiers.
• API keys and credentials: MCP/API keys we issue to you, stored only as salted SHA-256 hashes and never in plaintext.
• Usage data: queries or requests you submit, such as tickers, metrics, and search terms; timestamps; tools invoked; response sizes; tier; and usage-control counters. We use this to operate the Service, enforce usage controls, bill usage, and support you.
• Technical data: IP address, request metadata, and logs required to run and secure the Service.
• Payment information: processed by our payment processor, Stripe. We do not store full card numbers.
• Client content: when you use EVA's application and workflows, we store content you create or that EVA generates for you, including watchlists, custom valuation assumptions, generated valuations/DCFs and reports, saved analyses, and EVA's persistent memory of your prior work. Client content may include personal information. This is your confidential information. Ridhics keeps it access-controlled, does not sell it, does not share it with other customers, and does not use it to train any model, whether Ridhics-owned or third-party, except where you expressly agree in a separate written agreement.

What is public, not personal: the market and fundamental data the Service serves is public-domain SEC/XBRL data, such as 10-K, 10-Q, and 8-K filings and tagged facts. Ridhics does not collect brokerage records or personal investment holdings. Your watchlists and assumptions are confidential even when the underlying securities data is public.

3. How we use information

We use information to provide and maintain the Service; authenticate you; enforce subscription tiers and abuse-prevention controls; meter usage and bill; provide support; detect and prevent abuse; secure the platform; and improve product reliability, quality, and user experience using operational metrics and, where feasible, aggregated or de-identified information. We do not sell or share your personal information as those terms are used under the CCPA/CPRA, and we do not use your client content to train any model, whether Ridhics-owned or third-party, except where you expressly agree in a separate written agreement.

Where the EU or UK GDPR applies, our legal bases include performance of a contract for account access and service delivery; legitimate interests for security, abuse prevention, product reliability, and customer support; legal obligations for billing, tax, compliance, and dispute records; and consent where required for optional communications or non-essential cookies.

4. How we share information

• Infrastructure and service providers: providers acting on our behalf, under contract, including AWS for hosting and databases, TigerData/TimescaleDB for data storage, Voyage AI for text embeddings, Redis for caching, sessions, and usage controls, and Stripe for payments.
• AI/LLM processing providers: Ridhics uses large-language-model providers to generate EVA analyses. When you run a live query, report, or valuation, your request and the resulting analysis may be processed by OpenAI, Anthropic, and Google Gemini models, plus Voyage AI embeddings, under their enterprise/API terms. Ridhics does not use this client content to train Ridhics-owned models, and uses provider/API paths that are documented by those providers as not training public models on submitted inputs or outputs. EVA may use different providers for different workflows depending on quality, latency, availability, cost, and customer configuration.
• Internal data processing: we may use additional models, including DeepSeek, solely in back-end pipelines that build EVA's knowledge base from public SEC/XBRL filings. These operate on public-domain filings and EVA-generated drafts, not on your watchlists or saved assumptions. We disclose this because some customers have provider-origin preferences; on request we can describe the exact models used in any path and, for enterprise customers, scope which providers touch their workflows.
• AI assistants you connect EVA to: when you use EVA inside an AI assistant such as ChatGPT or Claude, data exchanged between that assistant and Ridhics servers is also handled under that AI provider's applicable terms and policies.
• Bring-your-own data: if you connect your own third-party data entitlement, such as FactSet or Aiera, through EVA, that data is used to fulfill your request and is governed by your agreement with that vendor.
• Legal and safety: where required by law, or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, or asset sale, with notice where appropriate.

5. Data retention

Account data is retained while your account is active. Usage counters are short-lived, with Redis counters generally retained for approximately 32 days. User queries, analysis request logs, application audit logs, and authentication logs are retained for 90 days by default, unless a shorter or longer enterprise retention period is agreed in writing. Enterprise audit-log retention may be configured up to 1 year. Billing, payment, tax, security, and legal records may be retained longer where required, including up to 7 years for payment and tax records. After account closure or a verified deletion request, we delete or de-identify client content within 30 days unless retention is required by law, security, billing, dispute-resolution, or a separate enterprise agreement; backup copies roll off under normal backup cycles. You may request deletion as described below.

6. Security

We use TLS in transit; encryption at rest where supported by our cloud and database providers; API keys stored as hashes; abuse-prevention controls; least-privilege access controls; organization-scoped access controls for customer data; audit logging for sensitive operational paths; and incident-response procedures. The MCP server exposes public SEC/XBRL and related market-data outputs through dedicated service paths. No method is perfectly secure, but we apply industry-standard safeguards. Security questions or vulnerability reports may be sent to support@ridhics.com.

7. Your rights

Subject to applicable law, including California's CCPA/CPRA, Canada's PIPEDA, and the EU/UK GDPR where applicable, you may request to access, correct, export, or delete your personal information, and to close your account. If your client content contains personal information, these rights may apply to that content as well. California residents may also request information about categories of personal information collected and disclosed, opt out of sale or sharing (Ridhics does not sell or share personal information), and exercise rights without unlawful discrimination. Contact support@ridhics.com. We respond within 30 days, unless a longer period is permitted by law.

8. International data transfers

Our infrastructure is hosted in AWS US-East-1, United States, including AWS and TigerData/TimescaleDB infrastructure used by the Service. If you access the Service from outside that region, your information may be transferred to and processed there. Where required, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses, Data Privacy Framework-certified providers where applicable, and contractual data-processing terms. Enterprise customers may request a Data Processing Addendum and subprocessor information.

9. Cookies

www.ridhics.com uses cookies and local storage strictly necessary for authentication and preferences, such as session tokens and theme preferences. We do not use third-party advertising trackers.

10. Children

The Service is a business/professional tool and is not directed to children under 18. We do not knowingly collect personal information from children under 18.

11. Changes

We may update this policy. Material changes will be posted here with a revised effective date and, where appropriate, notice.

12. Contact

support@ridhics.com · Ridhics Inc, Unit 098, 285 Taunton Rd E, Oshawa, ON, Canada L1G 3V2.