Back to Tilelli

Privacy Policy

Effective Date: August 22, 2026 — Last Updated: September 14, 2026

Tilelli Wealth Systems LLC ("Tilelli," "we," "us," or "our") operates Tilelli Portfolio Insights (the "Service"). This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding your personal data. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address, display name, and a hashed version of your password (if you use email/password authentication). If you sign in through a third-party provider such as Google, we receive your name, email address, and profile image as provided by that service. We never receive or store your Google password.

1.2 Portfolio Data

You may add portfolio information to the Service in whichever way you prefer: by entering it manually; by uploading a spreadsheet (Excel or CSV) or statement; by connecting a bank or brokerage through a secured third-party aggregator (such as Plaid); or by linking a supported platform (such as Coinbase) with a private, view-only API key. The information may include stock symbols, share quantities, cost-basis information, account names, balances, and transaction records. Any account connection we offer is strictly read-only / view-only — we can read balances and holdings to power your analytics, but we can never move money, withdraw, or place trades, and connecting an account is always optional. Where you link an institution through Plaid, your financial-institution login credentials are entered directly with the aggregator and are never seen or stored by Tilelli. This data is stored in our database solely to provide you with portfolio analytics, reporting, and AI-generated insights.

1.3 Usage Data

We automatically collect certain information about how you interact with the Service, including:

  • Pages visited and features used.
  • AI feature usage (number of requests, token counts for cost management).
  • Timestamps of activity (login, last active, feature use).
  • Device type, browser type, and general location (derived from IP address).

We use this data to maintain usage caps, monitor system health, improve the Service, and detect abuse.

1.4 Payment Information

Subscription payments are processed by Stripe, Inc. We do not directly collect, store, or have access to your full credit card number. Stripe collects and processes your payment information in accordance with its own Privacy Policy. We receive only a Stripe customer ID, subscription status, and billing cycle information necessary to manage your subscription.

1.5 Support and Feedback

If you submit a support request, feedback, or message through the Service's support and live chat features, we store the content of your message, your email address, any star rating you provide, and any file attachments you upload. This information is used to respond to your inquiry and improve the Service.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Provide the Service: Deliver portfolio tracking, market data, AI-generated analyses, reports, and other core features.
  • Manage your account: Authenticate you, manage your subscription, and communicate with you about your account.
  • Improve the Service: Analyze usage patterns, monitor system performance, and develop new features.
  • Owner usage monitoring: As described in our Terms of Service, the Service owner monitors aggregate AI usage metrics and system health to ensure quality of service and manage costs. Individual portfolio holdings and financial data are not reviewed unless required for technical support purposes with your explicit consent.
  • Enforce our Terms: Detect and prevent fraud, abuse, and violations of our Terms of Service and Acceptable Use Policy.
  • Legal compliance: Respond to legal requests and comply with applicable laws.

2.1 AI Agents and Internal Model Training

The Service is operated with the assistance of AI agents and AI-powered assistants (for example, the "Ask AI" assistant, AI-generated reports and analyses, and the AI features that power our support and live chat). To keep improving how these agents serve you, we may use your interactions with our AI and support features, including the prompts, questions, and messages you send, the files you attach, and the resulting AI outputs, to train, fine-tune, evaluate, and improve our AI agents and the Service more broadly.

Any such use of your interaction data for AI agent training is strictly for internal use only, for the betterment of the services we provide to our clients. We do not sell this data, and we do not share it with third parties for their own advertising or model-training purposes. Where practical, we de-identify or aggregate interaction data used for training so that it is not linked to you, and you may contact us at the email below with any questions about this use.

3. Data Storage and Security

Your data is stored on secured, managed cloud infrastructure provided by our hosting partner. We employ industry-standard security measures, including:

  • Encrypted database connections.
  • Password hashing with bcrypt (12 rounds).
  • HTTPS/TLS encryption for all data in transit.
  • Session management with secure, HTTP-only cookies.
  • Rate limiting and abuse prevention on authentication and API endpoints.
  • Account blocking capabilities for compromised or abusive accounts.

While we implement robust safeguards, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

4. Third-Party Processors

We share data with the following categories of third-party service providers, solely as necessary to provide the Service:

  • Payment processing: Stripe, Inc. processes subscription payments. We share your email and subscription plan information with Stripe.
  • AI inference: AI-generated content (reports, analyses, chat responses, portfolio suggestions) is produced by sending prompts — which may include your portfolio data — to our AI inference platform. The AI platform processes data in real time and does not retain your data beyond the scope of generating a response.
  • Cloud hosting and storage: Our hosting provider stores application data, including your portfolio information and uploaded files, on managed infrastructure.
  • Account aggregation (optional): If you choose to link a bank or brokerage, Plaid, Inc. securely connects to your financial institution and returns your account and holdings data to us via a read-only connection. Your institution login credentials are handled by Plaid and are never shared with us. Plaid processes your data under its own privacy policy.
  • Exchange connections (optional): If you choose to link a supported exchange such as Coinbase, we use the private, view-only API key you provide to read your balances. This access cannot move funds or execute trades.
  • Analytics: We may use Google Analytics to collect anonymized usage metrics. Google Analytics uses cookies to track page views and general usage patterns. No personally identifiable financial data is sent to Google Analytics.

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

5. Cookies and Local Storage

The Service uses a limited number of cookies and browser local storage entries:

  • Session cookie: A secure, HTTP-only session token that authenticates your login. Essential for the Service to function.
  • Theme and display preferences: Your selected appearance (dark/light mode) and text size are stored in local storage so your preferences persist across sessions.
  • Client-side caching: Certain non-sensitive market data (stock quotes, watchlist selections) may be temporarily stored in local storage to improve perceived loading speed.
  • Analytics cookies: If Google Analytics is enabled, it places cookies to track anonymized usage. You can opt out of Google Analytics by using browser-level cookie controls or a Google Analytics opt-out extension.

We do not use cookies for advertising or cross-site tracking.

6. Your Rights

You have the following rights regarding your personal data:

  • Access: You may request a copy of the personal data we hold about you by contacting us at the email below.
  • Correction: You may update your account information through the Service at any time. For corrections to other data, contact us.
  • Deletion: You may request that we delete your account and all associated data. Upon deletion, your portfolio data, usage history, transaction records, chat messages, and other account-specific information will be permanently removed. Certain data may be retained as required by law or for legitimate business purposes (e.g., aggregated, anonymized analytics data). To request account deletion, contact us at the email below.
  • Data portability: You may export your portfolio holdings as a CSV file through the Service at any time.

7. Data Retention

We keep personal data only for as long as it is needed for the purposes described in this policy — to provide the Service to you, to comply with our legal and regulatory obligations, to resolve disputes, and to enforce our agreements. The list below summarizes how long we retain the main categories of data and what happens to that data when a retention period ends.

  • Active account data (email, display name, hashed password, portfolio holdings, transactions, notes, watchlists, and settings): retained for as long as your account remains open.
  • Unverified free-tier accounts: if you register but never complete email verification, the account and any data attached to it are automatically deleted after seven (7) days.
  • Closed accounts — 90-day grace period: when you (or, at your request, an administrator) close your account, the closure is scheduled rather than applied immediately. Your account remains fully functional during a ninety (90)-day retention window, during which you may cancel the closure and restore full access, or export your data. This gives you time to change your mind.
  • Closed accounts — after the grace period: once the 90-day window ends, an automated process permanently deletes your personal data — including portfolio holdings, transactions, portfolio snapshots, notes, AI-usage records, watchlists, chat and support messages, sessions, API keys, and stored payment identifiers — and anonymizes your remaining account record so it can no longer be linked to you.
  • Deletion on request: you may request full deletion of your account and data at any time, without waiting out the grace period, by contacting us at the email below.
  • Support, feedback, and chat messages: retained while your account is active and removed as part of the account-closure purge, except where we must keep a limited record to comply with law or resolve a dispute.
  • Payment and billing records: subscription payments are processed and retained by Stripe under its own retention practices. On our side we keep only the minimal subscription-history and billing-event records required for accounting, tax, and audit purposes, for as long as required by applicable law (generally up to seven (7) years), and we anonymize these records after account closure wherever possible.
  • Compliance and consent records: your policy acknowledgment (date, time, the email you typed, and network address) and administrative audit records are retained as evidence of consent and for compliance, security, and fraud-prevention purposes, and may be preserved after your account is closed. Where possible these records are de-identified.
  • Aggregated, anonymized data (such as total user counts and system-wide usage metrics that cannot be linked to any individual): may be retained indefinitely.

When a retention period ends, we either securely delete the data or irreversibly anonymize it so that it can no longer be associated with you. Backups are kept for a limited period and overwritten on a rolling basis; data deleted from our live systems is removed from backups in the ordinary course of backup rotation.

8. Children's Privacy

The Service is not directed at, and is not intended for, children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly. If you believe a child under 13 has provided us with personal data, please contact us immediately.

9. State Privacy Rights (CCPA and VCDPA)

9.1 California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose about you; (b) request deletion of your personal information; (c) opt out of the "sale" of your personal information — we do not sell your personal information; and (d) not be discriminated against for exercising your privacy rights. To exercise any of these rights, contact us at [email protected].

9.2 Virginia Consumer Data Protection Act (VCDPA)

If you are a Virginia resident, you have the right to: (a) access, correct, and delete your personal data; (b) obtain a portable copy of your data; and (c) opt out of the processing of your data for targeted advertising, sale, or profiling — we do not engage in any of these activities. To exercise your rights, contact us at the email below.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by email, through the Service, or by updating the "Last Updated" date at the top of this page. Your continued use of the Service after such notice constitutes your acceptance of the revised policy.

11. Contact for Privacy Requests

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: