Privacy Policy

Account information: name, email address, sign-in method, plan, and role.

Firm and fund data you provide: firm profile details, monthly return series, holdings and allocations, logos, descriptions, disclosure text, templates, and the snapshots and disclosure runs generated from them.

Contact form submissions: name, email, organization, and your message.

Usage data: basic logs and product analytics (pages viewed, actions taken, device and browser type) used to operate and improve the Service.

The Service is designed for fund-level data. Please do not upload personal information about your clients or account numbers.

To provide the Service (calculating metrics, generating fact sheets, disclosures, and methodology exports), to keep the snapshot history you rely on, to administer accounts and access, to respond to inquiries, to secure and improve the Service, and to meet legal obligations. We do not sell your information, and we do not use your fund data to market to anyone else.

To classify holdings into risk categories and draft optional fund descriptions, security tickers and names and limited fund details may be sent to third-party AI model providers acting on our behalf.

Each user's funds, templates, and history are private to that user and to anyone they explicitly share a fund with. Access rules are enforced on every request. A limited number of Graff & Fogo developers can access records when needed to operate, support, or secure the Service.

We rely on vendors for hosting and database services, email delivery, authentication, analytics, and AI processing. They may process information only to provide services to us.

We keep account and fund data, including snapshots, for as long as your account is active so that historical fact sheets remain reproducible. You can ask us to delete your account and data; we will do so within a reasonable time unless we must keep certain records for legal or security reasons. You are responsible for keeping your own copies of anything you need for your firm's recordkeeping obligations.

We use access controls, encrypted connections, and server-side validation to protect your information. No system is perfectly secure, and we will notify affected users of a breach as required by law.

You can view and update your account and firm information in the app, and you can contact us to access, correct, export, or delete your information. Depending on where you live, you may have additional rights under applicable law.

We may update this policy as the Service develops. We'll post the new version here and update the date above.

Questions about privacy: please use our contact page.