Privacy Policy

01 / The service provider

ETSquare AI, LLC, a Florida limited liability company, document number L25000447372, operates SEV. This policy explains information processing for the website, research-discovery API, MCP access, and accounts. For support or privacy questions, contact vtaya@etsquare.ai. SEV provides hosted SEC research discovery.

02 / Information we process

Account information includes your Firebase account identifier, email address, verification status, and name if supplied by your sign-in provider. You may use Google or email and password. Firebase Authentication processes passwords, verification messages, password resets, and identity tokens. Passwords are not sent to the SEV application backend or stored in its Firestore or Oracle records.

SEV stores the verified UID and profile metadata, API-key hashes and identifying prefixes, key labels and status, creation and last-use timestamps, agreement versions, allowances and reservations, request outcomes, and provider-reported token usage. A request fingerprint supports idempotency; ordinary account usage records do not store the raw research question. Questions and filters are processed to run a search, and public passages are processed to select research leads.

When you connect SEV to ChatGPT or Codex, we process your verified SEV account identity, the permissions you approve, authorization and credential hashes, connection status, and creation, expiry and revocation information. These records authenticate the connection, enforce its permissions and allowance, and protect against unauthorized reuse. The research tools do not request your password, authentication codes or API keys. Sign-in takes place through the existing Firebase or Google authentication flow.

Service and hosting logs may include request identifiers, times, status codes, sanitized error categories, and connection metadata such as IP address or browser information. We also receive information you choose to send for support. Do not send sensitive personal information, account secrets, customer production data, or material you are not authorized to process.

03 / How we use information

We use information to provide research discovery and source retrieval; authenticate users; link keys to the correct account; enforce shared allowances and rate limits; prevent fraud and abuse; troubleshoot failures; provide support; communicate material service or policy changes; and comply with legal obligations. When billing is enabled, relevant records support payment administration. Access to your account data is not made public through the research API.

04 / AI processing and query use

SEV sends your question, selected vocabulary and related retrieval context, and relevant public SEC filing passages to TypeSafe/JEV for classification and relevance selection. JEV is the runtime language-model provider. Oracle stores and retrieves the SEC corpus; Google Cloud/Firebase supplies hosting, identity, and account storage. A calling AI agent may separately process the results under that agents own provider terms.

ETSquare does not use your queries to train its own generative models in this release. There is no separate optional query-training program in this release. Provider handling remains subject to applicable service-provider terms and settings; we do not promise an unverified provider-specific retention period or training exclusion. Avoid confidential or sensitive information in questions.

05 / Retention and deletion

Retention follows the purpose and record category. Account identity and profile information are needed while your SEV account is active; on a verified closure request we review them for deletion, subject to necessary legal, security, or unresolved-dispute records. Authentication is managed by Firebase. If the same identity is used by another ETSquare service, closing SEV alone does not necessarily close that other account; we will clarify the requested scope.

Active API-key hashes and metadata are needed to authenticate and manage access. Revocation disables their use; revoked-key records are retained only as needed for security, investigation, or applicable obligations. Evaluation totals and the minimum records needed to enforce the account allowance remain relevant while that allowance applies. Detailed request outcomes and provider usage are retained while needed for troubleshooting, allowance reconciliation, or a specific security or legal matter, and are reviewed on a verified deletion request. We may retain a minimal closed-account or anti-abuse record where necessary to prevent unauthorized access or repeated evaluation resets; retained exceptions are explained when responding to a request.

OAuth authorization requests expire after 10 minutes; one-use authorization codes expire after 2 minutes. Access credentials expire after 10 minutes. An authorization grant and its rotating refresh credentials have an absolute maximum lifetime of 30 days; rotation does not extend that deadline. Expiry and revocation are enforced when credentials are checked. Expiration makes credentials unusable; it does not itself delete server records. Automatic deletion of OAuth records is not currently configured. Expired or revoked records may remain for security checks and are included in the verified account-deletion request process, subject to the necessary retention exceptions described here. Disconnecting a client or signing out does not itself erase these records.

Application and hosting logs follow configured cloud log retention, subject to a specific incident or legal hold. Support correspondence is retained while resolving the request and for justified follow-up, security, or legal needs. Questions and retrieval context are processed to perform discovery; ordinary account usage records do not retain raw questions. External providers have their own applicable processing and retention terms. Future payment records, if billing is introduced, will follow applicable accounting and legal requirements.

To request access, correction, account closure, or deletion, email vtaya@etsquare.ai. We verify identity and authority, identify the relevant records, and respond within the applicable legal timeframe. If deletion is limited by a legal obligation or another justified exception, we explain the retained categories and reason. You can revoke keys immediately in Account. Revocation and sign-out do not themselves erase server-side records.

06 / Sharing and disclosure

We do not sell your personal information. We share information with service providers to operate SEV: Google Cloud/Firebase for hosting, authentication, and account data; Oracle for the filing corpus; and TypeSafe/JEV for classification. Stripe processes payments if paid billing is enabled; SEV does not store payment-card details.

We may disclose information when required by law, to respond to lawful requests, protect rights or safety, or investigate abuse and security incidents. If ETSquare undergoes a merger, acquisition, or asset transfer, relevant information may transfer with the business, subject to applicable obligations and continued protection under the applicable privacy policy.

07 / Cookies and browser storage

An essential, signed, HTTP-only cookie identifies the anonymous evaluation and may last up to one year. Clearing cookies may remove browser trial state but does not authorize evading limits. Browser cookie controls may affect sign-in or trial access. Firebase/Google may use cookies or connection information to complete authentication.

The current SEV sign-in session and a newly displayed API-key secret stay in browser memory for the visit. SEV clears the displayed secret on navigation away from Account or sign-out, and a reload clears in-memory state. No raw key or password is deliberately persisted by SEV in browser local storage. Browser password-manager choices are controlled by you. This release does not include advertising or optional analytics tracking.

08 / Security

We use encrypted production connections, managed secret storage, server-side identity verification, API-key hashing, ownership checks, and managed account storage. Only a key hash and identifying metadata are stored after creation. Research keys do not authorize account-management operations. Revoke a key if you believe it is exposed. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Local development previews are not the public production deployment.

09 / Your rights and choices

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information, or to object to or restrict certain processing. You can sign out, revoke keys, and control browser cookies. Paid cancellation controls will be relevant only if subscriptions are offered.

Send requests to vtaya@etsquare.ai. We may ask for information needed to verify your identity and authority. No optional query-training consent is requested by this release. We will respond to applicable requests within legally required timeframes.

10 / International users

ETSquare is based in the United States. Information may be processed in the United States or other countries where our service providers operate, under applicable safeguards and legal requirements. Where European or UK data-protection law applies, relevant legal bases may include providing the requested service, legitimate interests such as security and abuse prevention, compliance with legal obligations, and consent where required. California residents may have additional applicable rights concerning collection, access, correction, or deletion. We do not sell personal information. Contact us to exercise applicable rights.

11 / Children's privacy

SEV is available to users aged 13 or older, subject to any higher minimum age in their location and parent or guardian permission where required. It is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided information, contact vtaya@etsquare.ai so we can investigate and address deletion as appropriate.

12 / Third-party links

SEV links to original filings on SEC.gov and may link to provider documentation and other external resources. Those sites have their own terms and privacy policies. We do not control their content or information-handling practices. Review their policies when you visit them.

13 / Changes to this policy

The policy version and release status appear above. We may update this policy as the service changes. Material changes will be communicated through the service or an appropriate account notice, and any required consent will be obtained. We do not treat a draft as a released policy merely because it is available for review.

14 / Contact

Use vtaya@etsquare.ai for all support, privacy, deletion, account, billing, and legal questions. One mailbox handles these requests; identify the topic without sending credentials or sensitive material. The service provider is ETSquare AI, LLC, Florida LLC, document number L25000447372.