Privacy Policy
This Policy explains what personal data we collect, why we need it, who we share it with, how long we keep it, and how you can exercise your rights.
The essentials
A plain-language overview. It does not replace the Policy below, which prevails.
- We collect little. We collect what we need to run your Account, bill your plan and keep the Service secure.
- No selling, no ad tracking. We never sell your data, and we use no advertising or cross-site tracking cookies.
- Your card stays with Stripe. Your card number goes to our payment provider. We never see it or store it.
- The optional stays optional. Your phone number, onboarding answers and product-update emails are all optional.
- You are in control. You can access, correct, export or delete your data at any time by writing to us.
01Who is responsible for your data
The controller of your personal data is Saïd [LAST NAME] EI, operating Ultramentum, a sole trader registered in France under SIREN [SIREN], [BUSINESS ADDRESS] (“we”, “us”).
For any question about your data or this Policy, write to support@ultramentum.com with “Privacy” in the subject line. Given the size of our business, we are not required to appoint a Data Protection Officer, and we have not done so.
This Policy applies to the Ultramentum website, web application and related services (the “Service”). It is written in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
02What we collect, why, and on what basis
| Data | Why we use it | Legal basis |
|---|---|---|
| Account data first name, last name, email address, password (stored only in hashed form) | Creating and securing your Account, signing you in, verifying your email address, sending service emails (confirmations, security alerts, renewal reminders) | Performance of the contract |
| Waitlist email address; first name and markets of interest (optional); the link or website that brought you to us | Emailing you once when Ultramentum opens, with your demo and priority access to the Lifetime seats; understanding which channels bring visitors, in aggregate | Consent, given when you join the waitlist, which you can withdraw at any time |
| Phone number (optional) | Contacting you about your Account or support requests, only if you provide it. It is never used for marketing calls. | Consent, which you can withdraw by deleting the number |
| Onboarding answers (optional) investor profile, markets of interest, holding horizon, how you heard about us | Opening your demo on what matters to you, and understanding our audience in aggregate | Consent, which you can withdraw at any time |
| Product-update preference | Sending product news and tutorials if you opted in | Consent |
| Subscription and billing data plan, dates, amounts, invoices, billing name and address, company name and VAT number if provided, payment status and the last four digits of your card as reported by the payment provider | Managing your plan, renewals, refunds and invoices, and meeting accounting and tax obligations | Performance of the contract; legal obligation |
| Settings chart settings, layout and preferences saved in your Account | Restoring your setup on any device | Performance of the contract |
| Technical and security data IP address, browser type, operating system, device and session identifiers, sign-in times, error logs | Keeping the Service running and secure, enforcing one active session per Account, preventing fraud, abuse and account sharing, and diagnosing errors | Legitimate interest in securing the Service and protecting our business |
| Support messages emails you send us and our replies | Answering your requests and handling complaints | Performance of the contract; legitimate interest |
| AI assistant messages | Answering your questions in the chat window (see section 5) | Legitimate interest in providing instant help to visitors |
Required fields are marked as such in our forms. Without them, we cannot create your Account or process your order. We do not collect special categories of data (such as health, political opinions or religious beliefs), and we ask you not to send us any.
03What we do not do
- We do not sell or rent your personal data, and we do not share it for third-party advertising.
- We do not use advertising cookies, cross-site trackers or social-media pixels.
- We never see or store your full card number. Card payments are handled entirely by our payment provider.
- We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
- We do not track your investment activity. Ultramentum has no access to your brokerage or exchange accounts.
05The AI assistant
The chat window on our website is an automated assistant powered by a large language model provided by Anthropic, PBC (United States). When you send a message, the text of your conversation is sent to Anthropic to generate a reply. We do not store conversations on our side: they disappear when you close or reload the page. To prevent abuse, we keep your IP address in memory for up to one hour to limit the number of messages per visitor. Under its commercial terms, Anthropic processes these messages on our behalf, retains them only for a limited period, and does not use them to train its models. Please do not share sensitive personal information, passwords or payment details in the chat.
06Who receives your data
Your data is accessible only to us and to the service providers that help us run the Service. They act as our processors, on our documented instructions and under contracts that meet the requirements of Article 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| [HOSTING PROVIDER] | Hosting of the website, application and databases | [COUNTRY] |
| [AUTHENTICATION PROVIDER] | Account creation, sign-in, password storage and reset | [COUNTRY] |
| [EMAIL PROVIDER] | Sending service emails and, if you opted in, product updates | [COUNTRY] |
| Anthropic, PBC | AI assistant (section 5) | United States |
Stripe. Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates). For payment processing, fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
Other recipients. Our accountant, where required for bookkeeping; public authorities, where the law requires us to disclose data; and, if the operation of the Service is transferred to another entity (for example a company set up to run Ultramentum, in France or abroad), that entity, which then becomes the controller. In that case, we inform you in advance, and this Policy or an equivalent one continues to protect your data.
Market data providers do not receive your personal data. Where their licences require it, we only report aggregate user counts to them.
07Transfers outside the European Union
Some of our providers are located, or access data, outside the European Economic Area, notably in the United States. Such transfers are only made with appropriate safeguards: an adequacy decision of the European Commission (including the EU‑U.S. Data Privacy Framework, for certified providers) or the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can request more information about these safeguards by writing to us.
08How long we keep your data
| Data | Retention period |
|---|---|
| Account data, settings, optional information | As long as your Account is open. After 3 years without any sign-in and with no active plan, we delete the Account, after warning you by email 30 days beforehand. |
| Invoices and accounting records | 10 years from the end of the financial year, as required by French commercial law |
| Other subscription and billing data | 5 years after the end of the contract, the statutory limitation period, for evidence purposes |
| Waitlist | Until we open and send the opening email, then 6 months; deleted earlier on request |
| Security and connection logs | 12 months |
| Support messages | 3 years after our last exchange |
| Product-update subscription | Until you unsubscribe, or 3 years after your last interaction with us |
| AI assistant: IP address used for rate limiting | Up to 1 hour, in memory only |
When you delete your Account, we delete or anonymize your data within 30 days, except the data we must keep under a legal obligation or for evidence purposes, which is then archived with restricted access. Backups are overwritten on a rolling cycle of no more than [30] days.
09Security
We implement appropriate technical and organizational measures to protect your data. These include encrypted connections (HTTPS), hashed passwords, access restricted to what is strictly necessary, reputable providers with recognized security certifications, and session controls. No system is completely secure. In the event of a personal data breach, we notify the CNIL where required by law, and we inform you directly if the breach is likely to result in a high risk to your rights and freedoms.
10Your rights
Under the GDPR, you have the right to:
- access your data and obtain a copy of it;
- rectify inaccurate or incomplete data. Most of it can be edited directly in your Account settings;
- erase your data, including by deleting your Account;
- restrict processing in the cases provided by law;
- portability, meaning you can receive the data you provided in a structured, machine-readable format;
- object to processing based on our legitimate interest, for reasons relating to your particular situation;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- give instructions about what happens to your data after your death, as provided by French law.
To exercise these rights, write to support@ultramentum.com from the email address of your Account. If we have reasonable doubts about your identity, we may ask for additional information. We reply within one month. In complex cases, this period can be extended by two months, and we inform you of any extension.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr), or with the supervisory authority of your country of residence.
11Emails we send
Service emails (email confirmation, security alerts, receipts, renewal reminders, important changes) are necessary to run your Account and cannot be switched off while your Account is active. Waitlist: if you join it, we email you once when Ultramentum opens; we do not use the waitlist for anything else unless you also opted in to product updates. Product updates (news, tutorials, new assets) are only sent if you opted in. Every one of them contains an unsubscribe link, and you can also opt out from your Account settings.
12Minors
The Service is reserved for adults aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has created an Account, contact us and we will delete it.
13Changes to this Policy
We may update this Policy to reflect changes to the Service, to our providers or to the law. The date of the latest version appears at the top of this page. If a change is significant, we inform you by email or through the Service before it takes effect.
14Contact
Privacy requests: support@ultramentum.com (subject: “Privacy”)
Postal address: Saïd [LAST NAME] EI — Ultramentum, [BUSINESS ADDRESS]