Bidness ("we," "us," or "our") is operated by Ember Media LLC, a Louisiana limited liability company. We provide a stock screening, AI-powered market analysis, paper trading simulation, prediction market tracking, geopolitics monitoring, and trading education platform accessible at askbidness.com. This Privacy Policy describes how we collect, use, store, and protect your personal information, and your rights regarding that information.

Contact: support@askbidness.com · Ember Media LLC · askbidness.com

Account information: When you register, we collect your email address, username, and display name. You may optionally provide additional profile information.

Platform activity: We collect records of your paper trades, predictions, watchlist symbols, point balances, achievement badges, leaderboard rankings, course progress, Bob AI conversations (see below), affiliate referral activity, and Early Crew participation.

Payment information: We do not store your credit card numbers or full payment details. All payment processing is handled by Stripe, Inc., which stores your payment method securely under Stripe's PCI-DSS Level 1 compliant systems. We receive limited billing metadata from Stripe such as last four digits, expiration date, and billing country.

SMS data: If you opt in to SMS alerts (Pirate+ tier), we collect your phone number. This is transmitted to Twilio Inc. for message delivery only and is not used for marketing without your explicit consent.

Kalshi API credentials: If you use the Kalshi Auto-Trade feature (Captain+ or add-on, currently waitlist-only), you provide RSA keys and API credentials. These are stored encrypted in Supabase and used solely to execute Kalshi trades at your direction.

Bob AI conversations: When you ask Bob a question, the text of your question and the answer are stored in our database so the conversation has a history and so we can review what the compliance filters allowed or blocked. These are kept until you delete your account.

Microphone and speech: Some Bob features let you speak instead of type. If you use them, your browser's built-in speech recognition converts your speech to text. In Chrome and other Chromium browsers that conversion is not done on your device: the browser sends your audio to Google's speech service. That transfer is between your browser and Google, and we neither see nor store the audio. What we receive is the resulting text, and we store it the same way we store a typed question. Voice features are off until you turn them on, and your browser will ask for microphone permission at that point.

Technical information: We automatically collect browser type, device type, operating system, pages visited, time spent on pages, referral URLs, and error logs. This data helps us diagnose issues, prevent abuse, and improve the platform.

IP addresses: How your IP address is handled depends on where it arrives.

For page analytics we do not store your IP address. We store a coarse network prefix derived from it, which identifies a network rather than a person. Our analytics also has a field for a salted one-way hash of the IP address; that field is currently empty for every record, because the code refuses to hash without a salt and no salt is configured in production.

For the contact form and the status-page incident reporter we do store the IP address as submitted, to handle abuse of those forms.

Some features that limit use by network, such as the free trial and newsletter signup, store a salted one-way hash of the IP address rather than the address itself.

Cookies and local storage: We use browser cookies and localStorage to maintain your login session and remember preferences such as your watchlist, theme, and dashboard widget layout. See our Cookie Policy for details.

We use your information to: provide, operate, and improve the Bidness platform; authenticate your identity and maintain your session; display your profile, predictions, and performance data; power leaderboards and community features; personalize Bob AI analysis with relevant context; process payments and manage your subscription; send transactional emails such as receipts, password resets, and account notices via Resend; deliver SMS alerts you have opted in to via Twilio; detect and prevent fraud, abuse, and policy violations; analyze aggregate usage patterns to improve the platform; and operate the affiliate and Early Crew programs.

We do not use your personal information to serve advertising. We do not build advertising profiles or sell your data to any third party for marketing purposes.

We do not sell your personal information to third parties. We do not share your personal information with advertisers or data brokers. We do not use your trading activity to trade against you. Bidness is an ad-free platform — no advertiser pays to have content promoted to you. We do not store your full payment card details. We do not permanently log Bob AI chat conversations on our servers beyond the active session. We do not share your data with any party not listed in Section 5 of this policy.

We share limited data with the following trusted service providers who process data on our behalf:

Supabase (supabase.com): Our primary database and authentication provider. User account data, trading history, predictions, and all platform data are stored in Supabase's secure, encrypted infrastructure. Supabase encrypts all data at rest using AES-256 and in transit via TLS 1.2+.

Stripe, Inc. (stripe.com): Payment processing. Stripe receives your payment information directly and processes transactions under their own Privacy Policy and PCI-DSS Level 1 compliance. We do not store card details.

Vercel Inc. (vercel.com): Hosting and deployment infrastructure. Vercel may process request logs including IP addresses as part of serving the platform. All traffic is served over TLS.

Anthropic, PBC (anthropic.com): We send market context and trading queries to Anthropic's Claude API to power the Bob AI system. Queries are processed under Anthropic's data processing terms. We do not send personally identifiable user data to Anthropic beyond what is necessary for query context.

Upstash (upstash.com): Redis caching layer used to store temporary market data with short TTLs. No personal user data is stored in our Redis cache.

Alpha Vantage (alphavantage.co): Our primary market data provider. We send stock ticker symbols to retrieve OHLCV data, fundamentals, news, and other market information. No personal user data is transmitted to Alpha Vantage.

Resend (resend.com): Transactional email delivery. We transmit your email address and email content to Resend for delivery of account notices, receipts, and system emails. Resend does not use this data for marketing.

ElevenLabs (elevenlabs.io): Text-to-speech only. We send ElevenLabs the text Bob has already written so it can be read aloud. No microphone audio is ever sent to ElevenLabs.

Google LLC: Two separate things. Our pages load fonts from Google Fonts, which means your browser contacts Google and Google sees your IP address on any page you load. Separately, if you use a voice feature in Chrome, Chrome sends your audio to Google's speech recognition service, as described in section 2.

Market and reference data sources: We request public data from Alpha Vantage, the SEC, the Federal Reserve Economic Data service, the World Bank, NewsAPI and Kalshi. These requests carry ticker symbols and similar lookup terms. They do not carry your identity.

flagcdn.com: Serves country flag images. Your browser contacts it directly, so it sees your IP address.

Twilio Inc. (twilio.com): SMS delivery provider. Your phone number, if provided for SMS alerts, is transmitted to Twilio for message delivery only.

Kalshi (kalshi.com): If you use Kalshi auto-trade (waitlist-only), we transmit trade instructions to Kalshi's API using your provided credentials on your behalf. Your Kalshi account data is governed by Kalshi's own Privacy Policy.

cron-job.org: External cron job scheduler used to trigger automated platform maintenance tasks. No personal user data is transmitted.

Meta Platforms, Inc. (meta.com): Advertising measurement. When we are running ads on Instagram or Facebook, the Meta Pixel loads on our pages and tells Meta which pages you viewed and whether you created a free account, began a paid checkout, or started a trial. We send the plan name and its price with those events. We do not send Meta your email address, your name, your user id, or any other identifier for you. Meta receives your IP address and cookie identifiers directly from your browser, as it does on any site carrying its pixel, and uses them under its own Privacy Policy. You can limit this in Meta's Ad Preferences at facebook.com/adpreferences and facebook.com/help/568137493302217, and through your browser or operating system's tracking controls.

X Corp. (x.com): Advertising measurement. The X pixel loads on every page of this site and tells X which pages you viewed, and whether you completed a signup, started a trial or completed a purchase. A purchase event carries the amount, the currency and the Stripe session id; the others carry a row or session id used only to avoid counting the same action twice. None of these events carries your email address, your name, your phone number or your user id. X receives your IP address and cookie identifiers directly from your browser, as it does on any site carrying its pixel, and uses them under its own Privacy Policy. You can limit this in X's settings at x.com/settings/privacy_and_safety under Data sharing and personalization, and through your browser or operating system's tracking controls.

We use essential cookies for authentication and session management (Supabase) and fraud prevention (Stripe). We use Vercel Analytics for aggregate, anonymized page view data to understand platform usage. We use the X (Twitter) pixel and the Meta Pixel for advertising measurement, as described in Section 5. The X pixel is active on every page; the Meta Pixel runs only while we are running ads on Instagram or Facebook. We do not use Google Ads tracking, and we do not use any analytics that build a personal advertising profile out of your trading activity on this platform. See our Cookie Policy for the full list of cookies we set and how to manage them.

On our signup page we use PostHog to record how visitors scroll and tap, so we can fix what is confusing. Anything typed into a form field is masked and is never recorded. This uses no cookie.

We retain your account information and platform activity for as long as your account is active. If you request account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law (financial records may be retained for up to 7 years for tax and compliance purposes). Aggregate, anonymized data that cannot be linked to you individually may be retained for up to 24 months for analytics and platform improvement.

Analytics records are an exception we want to be straight about. Our Data Retention and Disposal Policy sets a schedule for them, but no automatic deletion job is running today, so page-view analytics have accumulated since May 2026 and none have been deleted. We are describing what happens now rather than what is planned.

For full retention schedules by data category, see our Data Retention and Disposal Policy at askbidness.com/data-retention-policy.

You have the right to: access the personal information we hold about you; correct inaccurate personal information; request deletion of your account and personal data; export your prediction and trading history data; opt out of non-essential communications; and withdraw consent for SMS alerts at any time by replying STOP.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to delete your personal information, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information. To exercise California rights, contact support@askbidness.com.

EEA and UK residents (GDPR/UK GDPR): You have the right to data portability, the right to restrict processing, the right to object to processing, and the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are: contractual necessity (account operation), legitimate interests (security, fraud prevention, platform improvement), legal obligation (financial recordkeeping), and consent (SMS alerts, optional features).

To exercise any of these rights, contact us at support@askbidness.com. We will respond to verified requests within 30 days.

Bidness is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a user under 18 has created an account, we will promptly delete their account and all associated data. If you believe a minor has created an account, contact support@askbidness.com immediately.

We implement industry-standard security measures to protect your personal information, including: encrypted HTTPS/TLS 1.2+ connections for all data in transit; AES-256 encrypted storage of all data at rest via Supabase; encrypted storage of sensitive credentials such as Kalshi API keys; secure authentication via Supabase with hashed passwords; multi-factor authentication (MFA) enabled on all admin systems including Vercel and Supabase; and strict access controls limiting production system access to authorized founders only.

Despite these measures, no method of internet transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law, including applicable U.S. state breach notification statutes.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a notice on the platform or sending an email to your registered address at least 14 days before the changes take effect. The updated policy will be posted at askbidness.com/privacy with a revised effective date. Your continued use of Bidness after the effective date constitutes acceptance of the updated policy.

For all privacy-related questions, data requests, or to report a concern:

Email: support@askbidness.com Ember Media LLC · askbidness.com

We aim to respond to all privacy inquiries within 5 business days.