Bullflow legal

Privacy Policy

Last updated July 29, 2026

This Privacy Policy explains how Bullflow (“Bullflow,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information when you visit bullflow.io, create an account, use our websites, applications, APIs, trading and brokerage features, AI features, subscriptions, alerts, or related services (collectively, the “Services”).

1. Information we collect

The information we collect depends on how you interact with the Services. We may collect the following categories:

Account and contact information

Email address, Firebase user ID, account status, and authentication information.
Communications with support and information submitted in privacy or account requests.
Discord identifiers or other community identifiers when you connect those services.

Subscription, transaction, and commercial information

Subscription plan, subscription and customer identifiers, status, billing interval, coupon or referral information, cancellation and renewal information, and transaction history.
Limited payment-method details returned by our payment processor, such as card brand, last four digits, and expiration date. Stripe processes full payment-card details on our behalf.

Brokerage and financial-account information

If you connect a supported brokerage such as Public, we may process brokerage account identifiers and connection status, authorization tokens, account type, balances, buying power, portfolio holdings, positions, orders, order status, transaction or trading history, and trade instructions you choose to submit. This information can be sensitive personal information under some laws.

User content and preferences

Watchlists, saved filters, alerts, tickers, dashboard settings, notification preferences, and other feature configuration.
AI prompts, questions, conversations, generated responses, saved research sessions, and related context.
Feedback, survey responses, support messages, and other content you submit.

Device, network, and usage information

IP address, approximate location derived from IP, browser type, operating system, device type, language, referring URLs, and timestamps.
Pages and features viewed, clicks, searches, named usage events, session activity, error logs, and interactions with emails, advertisements, and marketing campaigns.
Cookie identifiers, advertising identifiers, attribution identifiers, and device or push-notification tokens.

Sensitive personal information

Depending on the features you use, we may process information treated as sensitive under applicable law, including account authentication information, authorization tokens, and financial or brokerage account information. We use this information to provide the requested service, authenticate and secure accounts, prevent fraud, and comply with law. We do not use sensitive personal information to infer characteristics about you.

2. Sources of information

We collect personal information from:

You, when you create an account, configure features, connect an integration, trade, subscribe, contact us, or use an AI feature.
Your browser or device, through cookies, pixels, SDKs, logs, local storage, and similar technologies.
Payment and subscription providers, including Stripe and, where applicable, Apple, Google, and RevenueCat.
Connected services, including Public, Discord, and other services you choose to connect.
Analytics, advertising, attribution, and referral partners, including Google, Meta, Reddit, X, Microsoft/Bing, and Tolt.
Service providers and public sources, including infrastructure, security, communications, market-data, and AI providers.

3. How we use information

We may use personal information to:

Create, authenticate, maintain, and secure accounts.
Provide dashboards, market data, alerts, watchlists, APIs, community access, and other product functionality.
Process subscriptions, payments, coupons, renewals, cancellations, upgrades, and account entitlements.
Connect brokerage accounts, display brokerage information, and transmit user-authorized trade or order instructions.
Provide AI-generated research and conversation history.
Personalize the Services and remember preferences.
Send service messages, security alerts, support responses, product updates, and marketing communications.
Measure usage, troubleshoot errors, develop features, conduct research, and improve performance and reliability.
Attribute referrals, measure advertising, create audiences, and market the Services.
Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms.
Comply with legal obligations and establish, exercise, or defend legal claims.

4. Brokerage integrations

Brokerage connectivity is optional. If you connect Public or another supported brokerage, Bullflow and the brokerage exchange information necessary to authenticate the connection, identify the appropriate account, display portfolio and order information, verify eligible offers, and carry out actions you request.

Trade and order instructions are transmitted to the connected brokerage for execution. The brokerage independently processes information under its own privacy policy and customer agreements. Disconnecting an integration stops new account access but does not necessarily delete records we or the brokerage must retain for security, dispute resolution, or legal compliance.

5. AI features

When you use Bullflow AI features, we process your prompts, conversation history, selected ticker or market context, generated responses, feedback, and related technical information. We may send this information to AI model, infrastructure, and monitoring providers to generate responses, maintain the feature, prevent abuse, evaluate quality, and improve our Services.

Do not include financial credentials, payment-card numbers, government identifiers, or other information you do not want processed by an AI service in your prompts. AI responses may be inaccurate and are not investment, legal, tax, or financial advice.

6. How we disclose information

We may disclose personal information to:

Infrastructure and technology providers, such as Google/Firebase, Vercel, email delivery providers, and other hosting, database, authentication, storage, monitoring, security, communications, and customer-support providers.
Payment and subscription providers, including Stripe and applicable app-store or subscription platforms such as Apple, Google, and RevenueCat.
Connected services and business partners, including Public, Discord, referral partners, and integrations you direct us to use.
Market-data and AI providers, when necessary to deliver requested data, research, and AI functionality.
Analytics and advertising partners, as described below.
Professional advisers and authorities, where reasonably necessary for legal, accounting, compliance, security, or fraud-prevention purposes.
Transaction participants, in connection with a merger, financing, acquisition, reorganization, sale of assets, bankruptcy, or similar corporate event.

We may also disclose information at your direction or with your consent, and we may use or disclose aggregated or de-identified information where permitted by law.

7. Analytics, cookies, and advertising

We use necessary cookies, local storage, and similar technologies to operate the Services, maintain security, authenticate users, process subscriptions, remember settings, and save your privacy choices. These necessary technologies cannot be disabled through our consent manager.

Non-essential analytics and advertising technologies are off by default. We do not load them unless a saved privacy choice permits the applicable category. You can separately allow analytics and advertising or marketing technologies, reject all non-essential technologies, or change a previous choice at any time using the Privacy choices control displayed on Bullflow application pages.

When permitted, providers used on our website may include Google Analytics and Google Ads, Meta, Reddit, X, Microsoft/Bing, Tolt, and referral or attribution providers. These providers may receive identifiers, IP address, device and browser information, approximate location, pages viewed, interactions, referral information, and subscription or conversion events. They may combine information received from us with information from other services, subject to their own policies.

We do not sell personal information for money. Disclosures to advertising partners may be considered “sharing,” “targeted advertising,” or a “sale” under broad definitions in certain U.S. state privacy laws. You may submit an opt-out request using the methods in Your choices and rights.

We treat an enabled Global Privacy Control signal as a request to keep advertising and marketing technologies off, even if an older saved preference allowed them. If you turn off a category after previously allowing it, Bullflow applies the denial and reloads the page to remove tags already loaded in that browser session.

Browser controls can also block or delete cookies, but doing so may affect Service functionality. You may use industry opt-out tools provided by the Digital Advertising Alliance and Network Advertising Initiative.

8. How long we retain information

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including while your account is active and as needed to provide the Services, maintain security, resolve disputes, enforce agreements, satisfy tax, accounting, payment, or legal requirements, and maintain appropriate backups.

Retention periods vary based on the type and sensitivity of information, the feature involved, whether you have disconnected an integration or deleted your account, and applicable contractual and legal requirements. We delete or de-identify information when it is no longer reasonably necessary, unless continued retention is required or permitted by law.

9. How we protect information

We use administrative, technical, and organizational safeguards designed to protect personal information. These measures include authentication, access controls, encrypted network transport, service provider controls, logging, and monitoring where appropriate.

No system, transmission, or storage method is completely secure. We cannot guarantee absolute security, and you are responsible for protecting your account credentials and promptly notifying us of suspected unauthorized access.

10. Your choices and privacy rights

Depending on where you live, you may have rights to:

Know or access the personal information we process about you.
Correct inaccurate personal information.
Delete personal information, subject to legal exceptions.
Receive a portable copy of certain information.
Opt out of sale, sharing, targeted advertising, or certain profiling.
Limit certain uses or disclosures of sensitive personal information.
Withdraw consent where processing relies on consent.
Appeal our decision on a privacy request where applicable.
Receive equal service and pricing without unlawful discrimination for exercising your rights.

To exercise a privacy right, email support@bullflow.io or submit our privacy request form. To opt out of advertising-related sale or sharing, use the Privacy choices control on Bullflow application pages or use the email subject “Do Not Sell or Share My Personal Information.” We also honor an enabled Global Privacy Control signal by disabling advertising and marketing technologies in that browser.

We may need to verify your identity and request before responding. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and verification of the consumer. We will respond within the time required by applicable law.

You may unsubscribe from marketing emails using the link in the email. We may still send transactional, security, subscription, and other non-marketing messages.

11. California privacy disclosures

This section supplements the rest of this policy for California residents. The table describes categories of personal information we may have collected in the preceding 12 months. Whether a category applies to you depends on the features you used.

California category	Collected	Examples and business-purpose disclosures	Advertising sale or sharing
Identifiers	Yes	Email, user ID, IP address, account, device, cookie, advertising, brokerage, subscription, and customer identifiers. Disclosed to service providers and connected partners.	May be shared with analytics and advertising partners; not sold for money.
Customer records information	Yes	Contact, account, subscription, payment, and financial-account information. Disclosed to payment, infrastructure, security, and connected-service providers.	Not used for advertising sale or sharing except where an identifier or conversion event overlaps another listed category.
Protected classification characteristics	Not intentionally collected as a standalone category	May appear incidentally in user-submitted content or communications.	Not knowingly sold or shared for advertising.
Commercial information	Yes	Subscriptions, purchases, coupons, referral and conversion activity, products or features used. Disclosed to payment, attribution, support, and infrastructure providers.	Conversion or subscription events may be shared with advertising and attribution partners; not sold for money.
Biometric information	No	We do not intentionally collect biometric identifiers or templates.	No.
Internet or electronic activity	Yes	Browsing, clicks, searches, feature interactions, logs, and ad interactions. Disclosed to infrastructure, security, analytics, and advertising providers.	May be shared with analytics and advertising partners; not sold for money.
Geolocation data	Yes, approximate	Approximate location inferred from IP address. Disclosed to infrastructure, security, analytics, and advertising providers.	May be shared with analytics and advertising partners; not sold for money.
Sensory information	Not intentionally collected as a standalone category	May appear if a user voluntarily submits media or communications containing it.	Not knowingly sold or shared for advertising.
Professional, employment, or education information	Not intentionally collected as a standalone category	May appear incidentally in user content, support messages, or connected-service information.	Not knowingly sold or shared for advertising.
Inferences	Yes	Preferences, likely interests, product engagement, and audience or attribution information derived from activity.	May be shared with analytics and advertising partners; not sold for money.
Sensitive personal information	Yes, depending on features used	Account authentication or authorization data and financial or brokerage account information. Disclosed to service providers and connected brokerages to provide and secure requested services.	Not used or disclosed for cross-context behavioral advertising.

Categories of sources and purposes

We obtain the categories above from you, your browser or device, service providers, payment and subscription providers, connected services, analytics and advertising partners, referral partners, and public sources. We use them for the purposes described in How we use information.

Categories of recipients

We disclose personal information to infrastructure, authentication, database, security, communications, support, payment, subscription, brokerage, community, market-data, AI, analytics, advertising, attribution, referral, professional-adviser, government, and corporate transaction recipients as described in this policy.

California rights

California residents may have the rights to know, access, correct, delete, and obtain information about collection and disclosure; to opt out of sale or sharing; to limit certain uses and disclosures of sensitive personal information; and to be free from unlawful discrimination. Submit a request using the methods in Your choices and privacy rights.

12. Children’s privacy

The Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

13. International processing

Bullflow and many of our service providers operate in the United States. If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States and other countries whose laws may differ from those where you live. Where required, we use legally recognized safeguards for international transfers.

14. Changes to this policy

We may update this Privacy Policy to reflect changes to our Services, practices, providers, or legal obligations. We will post the updated policy and revise the “Last updated” date. If required by law, we will provide additional notice or request consent.

15. Contact us

For privacy questions or requests, contact Bullflow at support@bullflow.io or use our privacy request form.