VestLens Privacy Policy
Last updated: October 27, 2026
VestLens ("VestLens", "we", "us") is operated by Akshay Rakheja, an individual based in Ontario, Canada. This policy explains what personal information VestLens collects, how it's used, who it's shared with, and the choices you have. It applies to vestlens.com, the VestLens dashboard, and the VestLens connector used inside AI assistants such as Claude and ChatGPT.
VestLens is read-only. It does not place trades, move money, or provide investment advice.
Information we collect
Account information. When you sign in, our sign-in provider (Auth0) gives us a unique account identifier for you. We don't store your name or email address. Auth0 holds them under its own terms; we keep only the account identifier Auth0 gives us.
Brokerage data. When you connect a brokerage through SnapTrade, we receive information about your connected accounts: account names and types, balances, positions, orders and transaction history.
Settings. Preferences you choose in VestLens, such as how currencies are displayed.
Information you give us. Only two kinds, and only when you provide them, in chat or on the dashboard:
- TFSA and FHSA room inputs: your contribution room on January 1 as you report it, which of your accounts are TFSAs or FHSAs, your contributions, whether a given deposit or transfer was a contribution, and any TFSA at another institution you tell us about (a name you choose for it, and the deposits and withdrawals you report there). VestLens uses these only to track your room as you described it; it can't see your records at the CRA or at other institutions.
- Concentration limits you set for your portfolio, such as a maximum share for one holding.
From these we also keep the alerts we raise: a limit alert when a holding goes over a limit you set, and a yearly TFSA alert if your contributions go over your room as you described it, with the amount over.
On your device. Our sign-in provider (Auth0) uses cookies to keep you signed in. The dashboard and public pages such as vestlens.com/tfsa-by-age save small preferences in your browser, like the age group you picked; those stay on your device. We don't use advertising or analytics cookies.
Consent records. Which versions of our terms, this policy, our data-sharing notice and SnapTrade's end-user terms you accepted, and when, with a one-way hash of your IP address at the time (not the address itself). We keep these to show what you agreed to, until you delete your data.
Waitlist email. If you reserve a spot for a coming feature on vestlens.com (such as Tax Pass), we store the email address you give and which waitlist you joined. You don't need a VestLens account, and the address isn't linked to one.
Technical information. Service logs record request times, status and error codes, counts, and the names of tools an AI assistant called. Our own log entries never include your identity, email address, holdings or amounts. Google Cloud's request logs also record your IP address, browser type and the address of each request. All service logs are kept for 30 days.
What we don't collect. We never receive your brokerage username or password. You enter those only on SnapTrade's connection page.
How we use it
We don't read your brokerage data until you've accepted our terms, this policy and our data-sharing notice (at vestlens.com/legal/data-sharing). If you use VestLens in an AI assistant before accepting, VestLens won't read your brokerage data and will point you to the dashboard.
- To show your portfolio in the VestLens dashboard and in AI assistants you connect.
- To keep daily snapshots of your accounts so views load quickly and show change over time.
- To find news and filings about the securities you hold.
- To keep VestLens secure, fix problems and prevent abuse.
- To send the one confirmation email when you delete your data.
- To email you once when a feature you joined the waitlist for opens. Apart from that one email, we don't send marketing email.
We don't sell your personal information and we don't use it for advertising.
Who we share it with
We share only what each provider needs to run VestLens:
| Provider | Purpose | What they receive |
|---|---|---|
| SnapTrade | Brokerage connection | Your brokerage connection and account data. SnapTrade's security practices: https://snaptrade.com/security |
| Auth0 (Okta) | Sign-in | Your sign-in identity |
| Google Cloud | Hosting and database | All data VestLens stores |
| Marketaux, U.S. SEC EDGAR | News and filings | Ticker symbols you hold, not your identity or amounts |
| TypeSafe | Rating news relevance | News items and ticker symbols, not your identity or amounts |
| Yahoo Finance, Stooq | Prices and price history | Ticker symbols you hold, not your identity or amounts |
| Bank of Canada | Exchange rates | Nothing about you |
| Resend | Sending the deletion confirmation email and the one waitlist email | For deletion: your verified email address and a fixed confirmation message, once, when you delete your data. For a waitlist: the address you gave, once, when that feature opens |
AI assistants. When you use VestLens inside an AI assistant, the portfolio information the assistant requests is sent to that assistant and handled under its provider's privacy policy (for example, Anthropic for Claude, OpenAI for ChatGPT). You choose whether to connect VestLens to an assistant, and you can remove it at any time in the assistant's settings.
We may also disclose information if the law requires it.
Where it's stored
Your data is stored in Canada, in a Google Cloud database in Toronto. The VestLens application runs on Google Cloud servers in the United States, so your data is also processed there. Some providers above also process data outside Canada. Information stored outside Canada is subject to the laws of that country and may be accessible to its authorities.
How long we keep it
- Portfolio snapshots: older ones deleted after 90 days; the latest per connected account kept until you disconnect or delete, so your dashboard can still show it when SnapTrade is unreachable.
- Activity history and daily values: until you disconnect that brokerage or delete your data.
- Connection update records from SnapTrade: 30 days.
- Your account, settings, consent records, TFSA and FHSA room inputs, concentration limits and the alerts based on them: until you delete your data.
- Waitlist emails: deleted once we've sent the one email, and no later than June 30, 2027 for the Tax Pass waitlist.
- Backups: deleted data leaves our backups within 14 days.
- Service logs: 30 days. Google Cloud separately keeps its own platform audit records for 400 days; those don't contain your account data.
Your choices
- Disconnect a brokerage from your Account page. This removes the connection and its stored data.
- Delete your data from the same page by typing DELETE to confirm. In order: we immediately cut off every AI app connected to your VestLens account; we ask SnapTrade to delete your SnapTrade user; once SnapTrade accepts, we immediately delete everything we hold about you, including connections, snapshots, stored keys, consent records and sign-in records. If SnapTrade can't accept the request, we don't delete anything locally, so nothing is left at SnapTrade that we could no longer find, and you can try again.
- Confirmation email. When your deletion completes, we send one confirmation to the verified email address on your sign-in account. We don't keep the address.
- Download your data from your Account page as a JSON file, at any time, even if you haven't accepted our terms. It includes your brokerage connections, accounts, portfolio snapshots, activity, daily values, sync and data-quality records, settings, TFSA and FHSA room inputs, concentration limits, limit and TFSA alerts, news alerts we've sent you, your consent records (document, version and date), your connected AI apps (name, host and date), pending disconnects, and your SnapTrade user ID and its status. It leaves out security material: the encrypted key we use to reach SnapTrade, any tokens or hashes (including the hashed IP address on consent records), and SnapTrade's connection-update records, which are short-lived and deleted after 30 days.
- See and disconnect AI apps connected to your VestLens account from your Account page.
- Leave a waitlist with the unsubscribe link in the email, or by emailing us; we delete the address.
- Access or correct your personal information by emailing us.
- Withdraw consent at any time by disconnecting or deleting your data. VestLens can't work without access to your brokerage data.
Security
Brokerage connection keys are encrypted. Access to production systems is limited to the operator. No system is perfectly secure; if a breach creates a real risk of significant harm, we'll notify you and the Privacy Commissioner of Canada as the law requires.
Children
VestLens is for adults who have reached the age of majority in their province.
Changes
We'll post changes here and update the date above. For significant changes, we'll tell you in the app and ask you to accept the new version.
Contact
Privacy officer: Akshay Rakheja, support@vestlens.com
If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.
Version 2026-10-27.