Privacy Policy

1. Who we are

Cognistruct (formerly National Invest 24; "we", "us") is a stock research service operated by CogniStruct AI Company Limited. This policy explains what personal data we collect when you use our website and mobile application (together, the "Service"), why we collect it, who else processes it, and what rights you have over it.

If you have any question about this policy or wish to exercise a right described below, contact us at support@cognistruct.ai.

2. What we collect

2.1 Information you give us

Data	Why we hold it
Email address	Identifies your account, and is the address your alerts and briefings are sent to.
Password	Handled entirely by our authentication provider (Supabase) and stored only as a cryptographic hash. We never see or store your password.
Display name	The name your emails are signed with. Yours to choose; it need not be your real name.
Preferred language	English, Traditional Chinese or Simplified Chinese, applied to the interface, emails and AI-generated analysis.
Your watchlist	The stock tickers you follow, whether you have marked each as held, and a short list of tickers you recently removed (so you can restore them).

2.2 Information generated by your use of the Service

• Weekly briefing archives — the briefings generated for your tickers, kept so you can read past editions in the dashboard.
• Fundamental score snapshots — the most recent alpha score computed for each of your tickers, cached so repeat views do not re-run the analysis.
• Server logs — for each request, the method, path, response status and duration. These contain no account content.
• IP address — processed transiently to apply rate limits on sign-up and unsubscribe requests, and recorded in infrastructure logs by our hosting provider.
• AI answer records — when you ask the app for an analyst insight, a comparison or a lens on a post, we record which question was asked, for which ticker or tickers, the answer depth chosen, the language, the answer that was written, and whether our content rules allowed it to be shown. We keep these records so that we can show you what you were told, enforce daily limits, review the quality and safety of the answers, and demonstrate to a regulator, if asked, that no answer was investment advice.
• Saved comparisons — when you compare stocks in the app, we save the result you were shown (the tickers, the figures and the written comparison) so you can reopen it from Recent comparisons; we keep only your 20 most recent and delete them with your account.

2.3 Information stored in your browser or on your device

We do not use cookies for advertising, analytics or cross-site tracking. We store the following locally on your own device, where it stays:

• Your session token, issued by our authentication provider so you stay signed in.
• Your language choice and which analysis tab you last viewed, so the interface opens the way you left it.
• A temporary copy of your sign-up preferences, used only if your profile needs to be completed at first sign-in, and discarded afterwards.

Clearing your browser data removes all of these. In the mobile application, the equivalent values are held in the app's own storage and are removed when you sign out or uninstall the app.

2.4 What we do not collect

We do not collect your name (beyond the display name you choose), address, date of birth, government identifiers, or any financial account details. We have no connection to any brokerage and cannot see your actual holdings, balances or trades. The tickers on your watchlist are only what you have typed in, and marking one as "held" records nothing beyond that flag.

We do not take payment through the Service at present, so we hold no card or payment data. Should that change, payment details would be handled by a specialist payment provider and never stored by us, and this policy would be updated before any such feature launched.

3. Why we process it, and on what basis

Purpose	Basis
Creating and maintaining your account; showing your dashboard	Performance of our contract with you
Sending the weekly briefing and price alerts you signed up for	Performance of our contract with you
Sending push notifications, if you enable them in the app	Your consent, given through your device's notification permission, and withdrawable at any time in your device settings
Rate limiting, abuse prevention, security and diagnostics	Our legitimate interest in keeping the Service available and secure
Responding to your support requests	Performance of our contract with you

We do not use your personal data to train any machine learning model. Our stock-scoring model is calibrated exclusively on historical public market data and contains no user information of any kind.

4. Who else processes your data

We use the following service providers. Each processes data only on our instructions and for the purpose shown.

Provider	Purpose	What it receives
Supabase	Database and authentication	Your account record and all data in section 2.1 and 2.2
Railway	Application hosting	Data in transit; infrastructure logs including IP address
Resend	Email delivery	Your email address and the content of emails sent to you
Expo Push Service, Apple (APNs) and Google (FCM) — once push notifications launch	Push notification delivery	A device token and the notification text
EODHD	Market prices, news and fundamentals	Ticker symbols only. No personal data.
Financial Modeling Prep	Company financial statements	Ticker symbols only. No personal data.
Google (Gemini)	Writing the plain-language analysis in briefings, alerts, analyst insights, comparisons and lenses	Ticker symbols, prices, company financial data, public news articles and a language code only. Your email address, name and account are never sent.

Our web pages also load two public code libraries from third-party content delivery networks (cdn.tailwindcss.com and cdn.jsdelivr.net). Loading a file from any web server necessarily discloses your IP address to it. These networks receive no other information from us, and the mobile application does not use them.

We do not sell your personal data, and we do not share it with advertisers, data brokers or analytics companies. We would disclose data to a public authority only where legally required, and to a successor entity in the event of a merger or acquisition, in which case this policy would continue to apply until you were notified otherwise.

5. International transfers

The providers listed above operate infrastructure outside Hong Kong SAR, including in the United States and the European Union. Where personal data is transferred internationally, we rely on the contractual protections offered by each provider, including standard contractual clauses where applicable.

6. How long we keep it

• Account data — for as long as your account exists.
• Weekly briefing archives — the dashboard shows the five most recent briefings per ticker; archives are retained while your account exists.
• Fundamental score snapshots — replaced as they are recalculated; retained while your account exists.
• Server and infrastructure logs — retained for a short operational period in line with our hosting provider's defaults, then discarded.
• Saved comparisons — only your 20 most recent are kept; older ones are deleted automatically.
• AI answer records — retained for 24 months from the date of the answer, then deleted. Shared answers that are cached so the next person asking the same question gets the same text hold no personal data and expire within a day.

When you delete your account, your account record, watchlist, briefing archives, score snapshots, saved comparisons and AI answer records are deleted, and your authentication record is removed so you can no longer sign in. Backups held by our database provider are overwritten on that provider's own cycle.

7. Your rights

Subject to the law of Hong Kong SAR, you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Correct anything inaccurate. Your display name, language and watchlist are editable directly in the dashboard at any time.
• Delete your account and the data associated with it.
• Withdraw consent to push notifications, by turning them off in your device settings, and to emails, by using the unsubscribe link.
• Complain to your data protection regulator. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD).

To delete your account: open Profile › Delete account in the app or on the dashboard, or use the unsubscribe link at the bottom of any email we send you. Deletion is immediate and permanent. This removes your subscriber record and your sign-in credentials in one step, and is immediate. You may also write to support@cognistruct.ai and we will action it for you.

8. Security

Traffic to the Service is encrypted in transit. Passwords are hashed by our authentication provider and are never visible to us. Database access is restricted by row-level security policies so that one account cannot read another's data. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the relevant authority of any breach affecting your personal data where we are required to do so.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the Service changes. The date at the top always reflects the current version. Where a change materially affects how we use your personal data, we will notify you by email before it takes effect.

11. Contact

CogniStruct AI Company Limited 睿構智能有限公司
Room 33, 16/F, Block H, Superluck Industrial Centre Phase 2, 57 Sha Tsui Road, Tsuen Wan, Hong Kong (荃灣荃運工業中心二期H座16樓33室)
support@cognistruct.ai

This policy is published in English. Translations into Traditional and Simplified Chinese are provided for convenience; in the event of any inconsistency, the English version prevails.