Privacy Policy

• Account data. If you sign in with Google, we receive your email address, name, and profile identifier.
• Chat & usage.Messages you send to the AI, generated responses, and derived preferences (“memories”) for signed-in users. Anonymous chats are ephemeral and are not stored.
• Portfolio & broker data. Holdings and transactions you add, plus any Mero Share (BOID) or broker (TMS) login you choose to save. Saved passwords are encrypted at rest and are returned to you, on your own request.
• Anonymous identifiers. For not-logged-in users we set a signed cookie and store a one-way hash of your IP address to enforce usage limits and prevent abuse. We do not store raw IP addresses.
• Technical data. Standard logs needed to operate and secure the Service.

• provide, personalize, and improve the Service;
• generate AI responses and portfolio analytics;
• enforce usage limits and protect against abuse and fraud;
• send alerts and notifications you have enabled;
• comply with legal obligations.

To operate the Service we share the minimum necessary data with providers acting on our behalf, including AI/LLM providers (for generating responses), authentication (Google), and hosting/infrastructure. Market data is retrieved from NEPSE and related sources. We do not sell your personal data.

We use a signed, httpOnly cookie to identify anonymous sessions for usage-limit enforcement, and standard cookies/local storage to keep you signed in and remember preferences. Clearing cookies resets an anonymous session.

We keep account and content data while your account is active or as needed to provide the Service. Abuse-prevention identifiers (hashed IP, counters) expire automatically, typically within 30 days. Anonymous chats are not retained.

• review and delete what the assistant remembers about you from Settings;
• delete conversations and portfolio data you have added;
• request deletion of your account by contacting us.

We use reasonable technical and organizational measures to protect your data, including encryption of sensitive credentials at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The NepsezAI browser extension is optional. It runs only on your broker’s trading (TMS) login pages and on this site’s extension connect page, and it talks to no server other than NepsezAI.

• What it reads. The CAPTCHA image on the broker login page, and the username and password you type there — the latter only if you accept the prompt asking whether to save that login.
• What it sends. The CAPTCHA image, to solve it and fill the answer for you; and a broker login, only when you explicitly choose to save it. Nothing is sent in the background and nothing goes to third parties.
• What it stores on your device. Only the sign-in tokens for your NepsezAI account.
• How filling works. When you pick an account, the extension requests that one password from your own NepsezAI account, types it into the form, and discards it.
• Removing it. Uninstalling the extension, or disconnecting it from its popup, ends its access. Logins you saved remain in your NepsezAI account until you delete them there.

The Service is not directed to individuals under 18, and we do not knowingly collect their data.

We may update this policy from time to time.

Questions about your privacy, or a request to delete your data? Contact us at support@nepsezai.com.