Privacy Policy

The controller responsible for the processing described in this Privacy Policy is:

Operator of WealthPath

regulatory@wealthpath.ch

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and other applicable laws. Where the EU General Data Protection Regulation (GDPR), the UK GDPR, or another data-protection law applies to particular processing, we also respect the rights and requirements provided by that law.

"Personal data" means information relating to an identified or identifiable individual.

The data we collect depends on how you interact with WealthPath. You can read public pages without creating an account or completing the financial questionnaire.

Regulatory assessments and client records

Depending on the financial service provided, applicable regulations require us to understand your circumstances, assess appropriateness or suitability, and maintain client records. To support these obligations and our eligibility checks, the current onboarding process requires:

• your full name and date of birth;
• your contact email;
• your tax residence;
• your investment knowledge and experience;
• your risk-tolerance answers and investment preferences;
• your investment objectives and investment horizon; and
• your ESG preference.

These fields support our compliance and service processes.

If you sign in using an external identity provider, we also receive account information made available through the sign-in process, such as your email address, name, profile information, provider identifiers, and authentication metadata. Your identity provider processes the sign-in under its own privacy terms. We process account identifiers, login and session information, account status, access entitlements, and security events to operate and protect your account.

Financial situation, assets, and liabilities

We collect information about your financial situation, assets, and liabilities through the onboarding questionnaire and advisory interactions. This information helps us assess your capacity to bear losses, meet the assessment obligations applicable to the advisory service, and tailor analysis or advice to your circumstances.

We also process portfolio records and assessment results, including calculated risk classifications, suitability or policy flags, adviser notes, selected assets, saved holdings and weights, calculation inputs and results, and market-data requests. These records support the portfolio tools and advice you request.

Website, app, and usage analytics

When you use the website or app, whether signed in or signed out, our systems, hosting providers, and analytics providers may automatically process:

• IP address, approximate location derived from IP, browser and device details;
• request timestamps, pages or resources requested, referring page, and diagnostic or security logs;
• cookie or similar identifiers, session information, pages and screens viewed, feature interactions, navigation paths, and usage or performance events; and
• consent or preference information, where applicable.

We use analytics across the website and app to understand usage, identify problems, measure performance, and improve our services. The data collected depends on the features used and your applicable privacy choices. Analytics is separate from the financial information you submit to receive our services.

Optional portfolio uploads and document processing

Portfolio import is optional. If you choose to use it, we process the broker statements, PDFs, screenshots, images, or CSV files you choose to upload. These files may contain holdings, quantities, prices, account values, broker details, statement dates, names, account numbers, addresses, transaction information, and any other content included in the file.

The uploaded content is sent to external AI and document-processing providers to extract portfolio information. These providers may receive the whole file, including information that is not needed for the extraction. Before uploading, remove unrelated pages and obscure unnecessary personal details where practical.

Where supported by the provider and processing method, we enforce ephemeral processing of uploaded content, meaning it is processed temporarily for extraction rather than retained for ongoing use. This does not guarantee zero retention by every provider or processing step, and legally required retention may still apply.

Conversations, feedback, and service communications

Sending chat messages, submitting feedback, and contacting us are optional. When you use these features, we process the information needed to respond to your request. This includes messages you send to the AI assistant and the responses generated for you. To make an answer relevant, an assistant request may include information from your WealthPath financial profile, questionnaire responses, policy assessments, saved portfolio, and the Platform screen you are viewing, even if you do not repeat that information in the message.

We may also process feedback messages, the page from which feedback was submitted, browser user-agent information, contact details submitted when you request information or service availability updates, support emails, regulatory disclosure delivery records, agreements, and other communications.

We receive personal data:

• directly from you;
• from documents and files you upload and the information extracted from them;
• from an identity provider when you use it to sign in;
• from your use of the Platform and devices;
• from service providers that help us operate, secure, or troubleshoot the Platform.

We process personal data to:

• authenticate users, maintain sessions, and administer accounts and access;
• collect the information needed to understand your financial circumstances, objectives, experience, and risk tolerance;
• provide Platform features, calculations, portfolio tools, AI-assisted conversations, documents, and requested services;
• extract and match holdings from uploaded documents and create portfolio records for your review;
• perform suitability or appropriateness assessments and provide personal investment advice where separately agreed;
• personalize and improve the relevance of displayed information;
• respond to feedback, support requests, rights requests, and complaints;
• send service, security, contractual, and regulatory communications;
• respond to requests for information and service availability updates;
• measure website and app usage, feature interactions, and performance to improve our services;
• prevent fraud, misuse, and security incidents and maintain logs and backups;
• test, troubleshoot, maintain, and improve the Platform; and
• comply with legal, regulatory, accounting, tax, recordkeeping, and dispute-resolution obligations.

We do not sell personal data or show ads.

Where applicable law requires a legal basis for processing personal data, we rely on one or more of the following grounds:

• contract or steps before contract: to create and administer your account, provide requested Platform features, and perform an advisory or other agreement;
• legal obligation: to meet financial-services, data-protection, accounting, tax, sanctions, dispute, and regulatory requirements;
• legitimate interests: to operate, secure, support, and improve the Platform; communicate with users; prevent misuse; establish or defend legal claims; and understand service performance, provided those interests are not overridden by your rights;
• consent: where we ask for consent for a particular activity, such as optional communications or non-essential tracking; and
• establishment, exercise, or defense of legal claims or another permitted basis: where sensitive data is involved and applicable law requires an additional condition.

You may withdraw consent at any time for future processing, but withdrawal does not affect processing already carried out lawfully or processing based on another valid ground.

We use automated calculations and rules to produce risk scores, experience classifications, policy flags, portfolio illustrations, and asset-eligibility or suitability-related outputs. We also use AI models to generate conversational responses.

These tools may influence the information or options shown to you. Where an automated assessment significantly affects a service provided to you, you may contact us to express your view, obtain an explanation, correct relevant input data, and request review by a person.

AI requests are transmitted to service providers that route the request and generate a response. Depending on the configured model and provider settings, those providers may process message content and the contextual financial information included with the request. We configure and select services with privacy in mind, but you should avoid entering secrets or unrelated sensitive information in chat.

We disclose personal data only where reasonably necessary for the purposes described above. Current categories of recipients include:

• identity and authentication providers: account sign-in and authentication;
• hosting, database, and infrastructure providers: application hosting, data storage, delivery, and operational logs;
• AI, model, and document-processing providers: processing assistant requests, reading uploaded files, extracting holdings, and generating responses;
• analytics providers: measuring website and app usage, feature interactions, and performance;
• email delivery providers: delivery of service, contractual, or regulatory emails;
• market-data and infrastructure providers: obtaining and processing market information and running portfolio calculations;
• professional advisers and insurers: legal, compliance, accounting, audit, security, and insurance support where needed; and
• public authorities, courts, regulators, ombudsman services, or other parties: where required by law, necessary to protect rights and safety, or needed to establish, exercise, or defend legal claims.

Providers process data under their applicable contracts, instructions, and privacy terms. An up-to-date AI model provider may vary according to the model configured when a request is made.

We are based in Switzerland. Our primary database is hosted in Ireland, within the European Economic Area.

The primary database location does not mean that all processing takes place in Ireland. Hosting and delivery systems, authentication, email, analytics, AI and document-processing services, support operations, and their subprocessors may process data in Switzerland, other countries in the European Economic Area, the United Kingdom, the United States, and other countries in which they operate. The destination for an AI request or uploaded document can depend on the selected provider.

Where the destination does not provide a legally recognized adequate level of data protection, we use safeguards required by applicable law, such as recognized standard contractual clauses with Swiss adaptations where appropriate, or rely on a permitted exception. You may contact us for more information about relevant destinations and safeguards for a particular processing activity.

The website and app use cookies and similar browser storage for essential functions, including to:

• complete sign-in and maintain an authenticated session;
• protect accounts and support security features;
• remember limited interface or session state, such as the active conversation; and
• operate requested functionality.

These technologies may contain identifiers and technical session data. You can remove them through your browser settings, but doing so may sign you out or prevent parts of the Platform from working.

We also use analytics cookies, tags, or similar technologies across the website and app to measure usage, interactions, and performance. These may distinguish visits or sessions using identifiers and transmit usage information to analytics providers. They are not all necessary for the basic operation of the service.

Where applicable law requires consent or an opportunity to refuse non-essential analytics, we obtain that consent or provide that choice before activating the relevant technologies. You can also block or delete cookies through your browser, although browser controls may not prevent every type of analytics measurement.

We do not show ads or use analytics for advertising personalization or remarketing.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, security, accounting, and dispute-resolution requirements. Retention depends on the type of data and the context:

• account, profile, questionnaire, portfolio, and chat data is generally kept while your account or service relationship remains active and for a reasonable period afterward;
• support and feedback records are kept for as long as needed to resolve and learn from the matter;
• security and operational logs are generally retained for shorter periods determined by operational and provider requirements; and
• contracts, regulatory disclosures, suitability and advisory documentation, communications, invoices, and related records may be retained for up to 10 years after the relevant relationship or transaction, or longer where required for an ongoing claim or legal obligation.

When data is no longer needed, we delete it or anonymize it. Deletion from backups and provider systems may take additional time. We may retain limited information needed to document a deletion request, enforce a restriction, prevent fraud, or comply with law.

We use reasonable technical and organizational measures intended to protect personal data, including access controls, authenticated access, encrypted transmission, provider security controls, and database row-level access restrictions.

No internet service or storage system is completely secure.

Subject to applicable law and any permitted limitations, you may have the right to:

• ask whether we process personal data about you and obtain access to it;
• request correction of inaccurate or incomplete data;
• request deletion or destruction of data;
• object to or request restriction of particular processing;
• withdraw consent for future processing;
• receive certain data in a portable format where applicable;
• request information about international transfers and safeguards; and
• request human review of a qualifying automated individual decision.

To exercise a right, email regulatory@wealthpath.ch. Please describe your request and the account or email address involved. We may request information needed to verify your identity and protect your data. We will respond within the period required by applicable law.

Some rights are not absolute. We may need to retain or continue processing information to comply with financial-services recordkeeping duties, protect other people, establish or defend legal claims, or meet another legal requirement. If we cannot fulfill a request in full, we will explain why where required.

You may contact us to resolve a concern.

You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) through edoeb.admin.ch. If the GDPR, UK GDPR, or another law applies, you may also have the right to complain to the competent supervisory authority where you live or work or where the alleged infringement occurred.

We may send messages needed to operate your account or service, including security, contractual, regulatory, and material service notices. You generally cannot opt out of essential messages while the relevant account or service remains active.

We do not knowingly collect personal data from children through account-based services. If you believe a person under 18 has provided personal data through an account, contact us so we can investigate and take appropriate action.

The Platform may link to third-party websites or services. Their processing is governed by their own privacy notices, not this Privacy Policy. We encourage you to review those notices before providing personal data.

We may update this Privacy Policy when the Platform, providers, legal requirements, or our practices change. The version and last-updated date appear above.

If a change is material, we will provide notice through the Platform, by email, or through another appropriate channel before the change takes effect where required. Earlier versions may be requested by contacting us.