BONDFACTOR

Privacy Policy

Effective Date: July 12, 2026  |  Last Updated: July 12, 2026

1. Introduction

This Privacy Policy describes how BondFactor ("BondFactor," "we," "us," or "our") collects, uses, stores, protects, and shares your personal information when you access or use the BondFactor fixed income analytics platform, including our website, application programming interfaces, and related services (collectively, the "Platform").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not access or use the Platform.

2. Information We Collect

We collect information from the following categories of sources:

2.1 Information You Provide

  • Account Data: Email address, display name, and authentication credentials when you create an account or sign in via Google OAuth.
  • Portfolio Data: Security holdings, face values, and portfolio configurations that you enter into the Platform for analysis.
  • Scenario Parameters: Yield curve shock parameters, custom scenario configurations, and saved analysis states.
  • Communications: Any information you provide when contacting us for support or providing feedback.

2.2 Information Collected Automatically

  • Usage Data: Features accessed, actions performed, session duration, API call logs, and error logs.
  • Device Data: Browser type and version, operating system, device type, screen resolution, and language settings.
  • Network Data: IP address, referring URL, pages visited, and timestamps of access.

2.3 Information from Third Parties

  • Authentication Providers: When you sign in via Google, we receive your email address, display name, and profile identifier from Google in accordance with their privacy policy.
  • Market Data: Yield curve parameters and benchmark data sourced from publicly available repositories. This data does not contain any personal information.

3. How We Use Your Information

We process personal data for the following purposes and on the following legal bases:

  • Service Delivery (Contractual Necessity): To provide, maintain, and operate the Platform, including yield curve calculations, risk analytics, portfolio analysis, and report generation.
  • Account Management (Contractual Necessity): To create and manage your account, authenticate your identity, and provide customer support.
  • Service Improvement (Legitimate Interest): To analyze usage patterns, diagnose technical issues, and improve the Platform's functionality, performance, and user experience.
  • Security (Legitimate Interest): To detect, prevent, and respond to fraud, unauthorized access, and other harmful activity.
  • Legal Compliance (Legal Obligation): To comply with applicable laws, regulations, and legal processes.
  • Communications (Consent): To send you service-related notifications, product updates, and, with your consent, marketing communications. You may opt out of marketing communications at any time.

4. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

  • Essential Cookies: Required for the Platform to function, including authentication session tokens and security cookies. These cannot be disabled.
  • Functional Cookies: Remember your preferences, such as language settings and UI state, to provide a personalized experience.
  • Analytics Cookies: Help us understand how users interact with the Platform, which features are most used, and where performance issues occur.

You can manage cookie preferences through your browser settings. Disabling essential cookies may impair the Platform's functionality.

5. How We Share Your Information

We do not sell your personal information. We share data only in the following limited circumstances:

  • Service Providers: We use authorized third-party providers for cloud infrastructure (Vercel, Render), database hosting (Supabase), and authentication (Google). These providers access data solely to perform services on our behalf and are bound by contractual obligations to protect your information.
  • Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.
  • With Your Consent: We may share information for purposes not described in this policy only with your explicit consent.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

  • Account Data: Retained for the duration of your account. Deleted within 30 days of account closure.
  • Portfolio and Scenario Data: Retained while your account is active and deleted within 30 days of account closure.
  • Usage and Log Data: Retained for up to 24 months for analytics and security purposes.
  • Billing Records: Retained for 7 years where applicable, in accordance with financial regulatory requirements.
  • Backup Data: Removed within 90 days of the deletion of the source data.

7. Data Security

We maintain physical, electronic, and procedural safeguards designed to protect your personal information. These measures include encrypted data transmission (TLS/SSL), encrypted data storage, access controls limited to authorized personnel, intrusion detection systems, and regular security assessments. While we implement industry-standard security measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States and India, where our service providers operate. These countries may have data protection laws that differ from those of your jurisdiction. We ensure that appropriate safeguards are in place for international transfers, including contractual protections with our service providers.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Rectification: Request correction of inaccurate or incomplete personal information.
  • Erasure: Request deletion of your personal information, subject to applicable retention obligations.
  • Restriction: Request that we limit the processing of your personal information in certain circumstances.
  • Portability: Request a copy of your personal information in a structured, commonly used, and machine-readable format.
  • Objection: Object to our processing of your personal information based on legitimate interests.
  • Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at the address provided in Section 12. We will respond to your request within 30 days.

10. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete it promptly. If you believe we have collected information from a child under 18, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date" above. Your continued use of the Platform after any changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

BondFactor
Email: karbburn@gmail.com