Privacy Policy
EZvest Privacy Policy
Last updated: 1 August 2026
1. Who is responsible for your information
EZvest is currently an unincorporated online service operated from South Africa under the trading name "EZvest". In this policy, "EZvest", "we", and "us" mean the individual operator trading as EZvest. The operator is the responsible party under South Africa's Protection of Personal Information Act, 2013 ("POPIA") and, where applicable, the controller or organisation responsible for personal information under other privacy laws.
- Privacy and support contact: support@ezvest.co.za
- Website: https://ezvest.co.za
This policy covers the EZvest website and app, accounts, FinBot modes and Tutor, portfolio and watchlist tools, saved reports, Learning Hub, alerts, subscriptions, credit purchases, and related support. It does not govern third-party websites you visit from EZvest.
2. A short explanation
- We use account, portfolio, learning, billing, device, and FinBot information to provide and secure the service.
- FinBot sends the information needed for your request to an AI provider. Do not include passwords, identity numbers, banking credentials, special-category information, or another person's confidential information.
- We do not sell personal information, share it for cross-context behavioural advertising, or use it to serve targeted advertising.
- You can ask to access, correct, export, or delete information, subject to applicable law and necessary legal records.
- EZvest is for adults aged 18 or older.
3. What we collect, where it comes from, and why
| Category and source | Examples | Main purposes |
|---|---|---|
| Account and profile You, Supabase Auth, or Google if you choose Google sign-in | Name, username, email, authentication identifier, sign-in provider, account dates, country/region and, only if you voluntarily supply it in a profile or FinBot feature, age. Google sign-in provides the basic profile details needed to authenticate you; EZvest does not request access to Gmail, Drive, contacts, or unrelated Google services. | Create and authenticate your account, localise features, provide support, and protect the service. |
| Settings and learning activity Your use of EZvest | Currency and display preferences, notification settings, Learning Hub progress, quiz activity, notes, bookmarks, and badges. | Remember choices, personalise learning content, and provide requested features. |
| Portfolio and research content You and market-data providers | Holdings, tickers, units, average cost, watchlists, alerts, reports, tags, folders, and notes. | Provide tracking, calculations, alerts, research, saved content, and regional account options. |
| FinBot inputs and outputs You, EZvest context, and AI providers | Prompts, chat messages, analysis answers, selected portfolio context, learning context, evidence packs, generated responses, reports, usage counts, and credit deductions. | Generate the response you request, maintain conversation context, prevent abuse, and operate credits. |
| Subscription and transaction records You, EZvest, and Payfast | Plan, price, currency, billing status, checkout and transaction references, Payfast customer/subscription identifiers, verification results, and billing events. EZvest does not intentionally store full payment-card numbers. | Process and verify payments, provide plan access and credits, manage renewals/cancellation, prevent fraud, and meet accounting and consumer-law duties. |
| Technical, security, and usage data Your browser/device and our providers | IP address, browser and device information, request metadata, timestamps, session events, rate-limit records, errors, and security logs. If you allow optional analytics, this also includes page paths, clicks or taps, scrolling, interaction timing, and strictly masked session-replay events. | Deliver content, authenticate sessions, diagnose faults, understand usability, improve EZvest, prevent abuse, and secure the service. |
| Communications You | Support requests, privacy requests, complaints, feedback, and related contact information. | Respond, investigate, keep an appropriate record, and improve support. |
If you do not provide information required for an account, payment, or requested feature, we may be unable to provide that part of EZvest. Portfolio values and FinBot profile fields are generally optional unless a particular analysis needs them.
4. Legal grounds for processing
Depending on the information, purpose, and law that applies, we process information because it is necessary to perform our contract with you; you consented; the law requires it; it protects a legitimate interest such as security, fraud prevention, support, and responsible product improvement; or it is needed to establish or defend legal rights. Where we rely on legitimate interests, we consider the impact on your rights. You may withdraw consent at any time, but withdrawal does not make earlier lawful processing unlawful.
5. FinBot and automated processing
FinBot requests are processed through EZvest's Supabase backend and may be sent to Anthropic, together with selected portfolio, learning, market, or conversation context needed to answer the request. Anthropic processes that information for EZvest as an AI service provider under its applicable business terms. A provider may maintain limited safety or operational records under its terms and applicable law.
FinBot outputs are probabilistic and may be inaccurate, incomplete, or outdated. They are educational and informational, not personalised financial, investment, tax, accounting, or legal advice. FinBot does not make decisions that produce legal or similarly significant effects about your employment, credit, insurance, housing, or access to essential services. If that changes, we will provide any notice, explanation, consent, and review rights required by law.
6. Browser storage, cookies, analytics, fonts, and delivery networks
EZvest uses essential browser storage, including localStorage and session storage, to maintain sessions and remember preferences, bookmarks, read articles, filters, alerts, notifications, and local fallback data. Clearing browser data can reset these features or sign you out.
With your explicit permission, EZvest uses Microsoft Clarity to understand how people navigate and use the service through aggregated interaction analytics, heatmaps, clicks or taps, scrolling, and strictly masked session replays. We configure EZvest page content for masking, keep form inputs and selections masked, deny advertising storage, and do not use Clarity for advertising. Clarity is not loaded before you allow analytics. If allowed, Clarity may use identifiers such as _clck and _clsk. You can refuse without losing core functionality and can change your choice at any time in Settings under Privacy.
Our use of Google Fonts and the jsDelivr content-delivery network can disclose ordinary connection information, such as your IP address, browser type, requested file, and time of request, to those providers.
7. Who receives information
We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. We also do not use sensitive personal information to infer characteristics about you or for purposes unrelated to providing and securing EZvest.
8. International transfers
EZvest is operated from South Africa and some providers process information in other countries. Those countries may have different privacy laws. Where required, we use a legally recognised transfer basis and safeguards, which may include an adequacy decision, contractual commitments such as the European Commission's Standard Contractual Clauses, security measures, and transfer-risk assessments. Transfers from South Africa are handled in accordance with POPIA's cross-border requirements; Canadian information remains subject to our contractual and organisational controls while processed abroad. You may contact us for information about the safeguards relevant to your data.
9. Security and data incidents
We use proportionate technical and organisational safeguards, including authenticated access, database row-level controls for user-owned data, separation of privileged backend functions, rate limiting, logging, access controls, and payment-provider controls. No online service is perfectly secure. Protect your email account, device, passwords, and verification codes, and notify us promptly about suspected unauthorised access.
We investigate suspected breaches and notify affected people and regulators when required, including under POPIA, the GDPR, Canadian private-sector privacy laws, and applicable US state law. We keep breach records where the law requires them.
10. How long we keep information
| Information | Typical retention approach |
|---|---|
| Account, profile, learning, portfolio, watchlist, and saved content | While your account or the relevant feature remains active, then deleted or de-identified after a reasonable closure period, unless legal, fraud, security, backup, or dispute needs require longer. |
| FinBot requests and reports | Request data is used to produce the response; reports or conversations you save remain until you delete them or close the account. AI and infrastructure providers may retain limited operational records under their applicable terms. |
| Billing and transaction records | For the subscription relationship and afterwards for applicable tax, accounting, payment dispute, fraud-prevention, and legal periods. |
| Rate-limit and FinBot request-ledger records | Generally about 48 hours under current operational settings, unless a security investigation or legal duty requires longer. |
| Function event and diagnostic logs | Generally about 14 days under current operational settings, unless needed longer for security, reliability, audit, or legal reasons. |
| Optional Microsoft Clarity analytics | Session playback data is generally retained for 30 days. Click, heatmap, and labelled or favourited session data may be retained for up to 9 months, subject to Microsoft's current retention settings. |
| Local browser data | Until you clear it, the app replaces it, or the browser removes it. |
| Support, privacy, and complaint records | For as long as reasonably needed to resolve and document the matter and meet legal obligations. |
Backups may retain residual copies for a limited cycle before deletion. We delete, anonymise, or securely isolate information when the applicable retention period ends.
11. Your choices and privacy rights
Depending on where you live and subject to legal exceptions, you may ask us to confirm whether we process your information; access or receive a copy; correct it; delete it; restrict or object to processing; withdraw consent; receive portable data; opt out of direct marketing; or complain to a regulator. We will not discriminate against you for exercising a privacy right.
You can change or withdraw optional analytics consent in Settings under Privacy without losing core functionality. Withdrawal does not affect processing that was lawful before it. You can delete your account from the Account section in Settings. This removes the account and saved EZvest data, subject to transaction, legal, fraud-prevention, security, backup, and dispute records that we are required or permitted to retain. You may make any other request by emailing support@ezvest.co.za. Describe the request and the account email involved. We may verify your identity and an authorised agent's authority. We respond within the period required by applicable law, usually within one month for GDPR requests and within the applicable statutory period for US and Canadian requests. If we deny a request, we will explain why and provide any available appeal route.
12. South Africa
Under POPIA, you may request access, correction, deletion or destruction where available, object to certain processing, withdraw consent, and object at any time to direct marketing. You may complain to South Africa's Information Regulator. Prescribed forms and regulator contact details are available on its website. Nothing in this policy limits rights under POPIA or the Promotion of Access to Information Act.
13. European Economic Area and United Kingdom
If the GDPR or UK GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, objection to legitimate-interest or direct-marketing processing, withdrawal of consent, and safeguards relating to solely automated significant decisions. You may lodge a complaint with the data-protection authority where you live, work, or believe an infringement occurred. We do not currently conduct solely automated decision-making with legal or similarly significant effects through EZvest.
14. United States
Where a US state privacy law applies, you may have rights to know and access categories or specific pieces of information, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, or certain profiling, as well as a right to appeal and to be free from discrimination. Because EZvest does not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising, there is currently no such activity to opt out of. If those practices change, we will provide required notices and opt-out methods, including recognition of legally required preference signals.
For California residents, the categories collected in the preceding 12 months are reflected in section 3 and may include identifiers; internet or electronic-network activity; commercial and subscription information; user-provided financial or portfolio information; approximate geolocation inferred from IP address; and inferences used to provide requested learning or research features. We disclose these categories for the business purposes and to the service-provider categories described in sections 3 and 7. Authentication credentials and account-access information are used only for permitted service, security, and integrity purposes.
15. Canada
Where Canadian private-sector privacy law applies, you may request access and correction, withdraw consent subject to legal or contractual limits, challenge our compliance, and ask how service providers outside Canada handle your information. We use information only for purposes a reasonable person would consider appropriate and limit collection, use, disclosure, and retention accordingly.
If Quebec law applies, you may also have rights concerning portability, de-indexation where available, and information about profiling, automated decisions, and processing outside Quebec. EZvest's privacy lead can be reached at the support contact above.
16. Marketing communications
We send marketing only with the consent or other permission required by POPIA, the GDPR and ePrivacy rules, Canada's anti-spam law, and applicable US law. Marketing messages will identify the sender and include a working unsubscribe method. You may also opt out by contacting us. Account verification, security, billing, product-operation, and support messages are not marketing and may still be sent when necessary.
17. Children
EZvest is intended only for people aged 18 or older and is not directed to children. We do not knowingly collect personal information from children under 13 or knowingly permit minors to create accounts. If you believe a child submitted information, contact us so we can investigate and delete it where required.
18. Changes and contact
We may update this policy as EZvest, providers, or legal requirements change. We will post the revised version with a new date and provide prominent or direct notice before a material change where required. We will request consent again if a new purpose legally requires it.
Questions, privacy requests, complaints, account issues, and billing queries can be sent to support@ezvest.co.za.