Primordia Co.
Effective Date: March 17, 2026
Last Updated: March 17, 2026

1. Introduction

Primordia Co. ("Primordia," "we," "us," or "our") is a Delaware corporation committed to protecting the privacy of individuals who visit our website at primordia.ai and use our AI-powered investment research and analysis platform (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you access or use the Service.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you register for an account, we collect your email address, password (stored in hashed/encrypted form), and optionally your display name.

• Organization Information: If you create or join an organization, we collect the organization name, description, and your role within the organization.

• User-Generated Content and Project Data: When you use the Service, we collect and store the content you provide. This includes ticker and company selections, documents you upload, financial model parameter adjustments, custom notes and annotations, Copilot chat interactions, and generated analyses (such as investment memos and scenario models). For Enterprise tier users, this also includes cross-case belief graphs and assumption linkages ("Case Mesh" data) within team workspaces.

• Payment Information: If you subscribe to a paid plan, payment processing is handled by our third-party payment processor, Stripe, Inc. We do not directly collect or store your credit card number or bank account details. We receive and store a Stripe customer identifier, subscription status, and billing period information.

• Communications: If you contact us directly, we may collect your name, email address, and the content of your correspondence.

2.2 Information Collected Automatically

• Session and Authentication Data: We use Firebase Authentication and Supabase Authentication to manage user sessions. These services may set cookies or use local storage tokens to maintain your authenticated session.

• Local Preferences: We store certain user interface preferences (such as theme selection, panel layout, and notification settings) in your browser's local storage. This data remains on your device and is not transmitted to our servers.

• Log Data: Our servers automatically record information about how you access and use the Service, including your IP address, browser type, operating system, referring URLs, pages visited, timestamps, and interaction patterns (clicks, feature usage).

• Product Analytics Data: We use PostHog to collect anonymized usage data to understand how the Service is used and identify areas for improvement. Analytics tools may collect your IP address, browser type, device type, and general geographic location.

2.3 Information from Third-Party Public Sources (Not User Data)

In the course of providing the Service, the platform ingests publicly available financial data to power our investment analysis features. This data is not personal information and is not collected from users. Sources include SEC filings (10-K, 10-Q, 8-K), earnings call transcripts, news articles, press releases, analyst commentary, and market data obtained from providers such as Intrinio.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and Maintaining the Service: To operate the platform, process research requests, generate investment analyses, run the AI Copilot, and maintain your workspaces.

• AI Processing: To process your inputs (including documents, research queries, and chat messages) through our AI orchestration system and third-party large language model providers in order to generate analyses and recommendations.

• Account Management: To create and manage your account, authenticate your identity, process subscriptions, and provide customer support.

• Organization and Collaboration: To facilitate organization creation, member invitations, and role-based access to shared projects.

• Security and Compliance: To detect, prevent, and address fraud, unauthorized access, cyberattacks, and other illegal activities, and to comply with applicable legal obligations.

• Service Improvement: To analyze usage patterns and improve the functionality, reliability, and performance of the Service.

3.1 What We Do NOT Do

To ensure absolute clarity regarding your data, Primordia explicitly does NOT:

• Sell personal data to third parties.

• Share your individual user analyses or investment research with other users (except intentionally within shared organization workspaces).

• Use your individual analyses to generate investment recommendations for users outside of your organization.

• Provide user data to advertisers.

• Access your personal brokerage accounts, bank accounts, or trading systems.

• Make automated investment decisions on your behalf.

4. How We Share Your Information

We do not sell your personal information. We may share your information only in the following specific circumstances:

4.1 Third-Party Service Providers

We engage third-party companies to facilitate and support the Service. These providers have access to your information only to perform specific tasks on our behalf and are contractually obligated to protect it:

• Authentication: Firebase and Supabase.

• Cloud Infrastructure: Google Cloud Platform (GCP).

• Payment Processing: Stripe, Inc.

• Product Analytics: PostHog (routed through Cloudflare via reverse proxy).

• AI Model Providers: OpenAI, Anthropic, Google, and Mistral (see Section 5 below).

• Financial Data Providers: Intrinio and similar market data vendors.

4.2 Other Sharing Scenarios

• Within Your Organization: If you are part of a team workspace, other members may have access to shared projects, documents, and research outputs in accordance with their assigned roles.

• Legal Requirements: We may disclose your information if required to do so by law, subpoena, or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights, or investigate fraud.

• Business Transfers: In the event of a merger, acquisition, reorganization, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership.

5. AI-Specific Privacy Considerations

Given the AI-powered nature of the Platform, the following specific disclosures apply:

• Third-Party AI Models: We use third-party large language models to process user interactions. We strictly select providers and enterprise configurations designed to prevent your data from being used to train their foundational models. These providers process data according to their respective enterprise data processing agreements, which prohibit the retention of your data for their own training purposes.

• Primordia Model Training: We do not use your personal information, proprietary research inputs, or uploaded documents to train our foundational reasoning models. We may use anonymized, aggregated telemetry data strictly to improve platform performance, routing, and user experience.

• No Automated Investment Decisions: The Platform generates analysis and research output but does not make automated investment decisions. You always retain full control over any investment decisions. The Platform does not execute trades or manage portfolios.

6. Cookies and Tracking Technologies

We use cookies and similar technologies primarily for essential functions:

• Authentication Cookies: Firebase and Supabase set cookies to maintain your login session and verify your identity.

• Payment Cookies: Stripe may set cookies during the checkout process to facilitate secure transactions.

• Product Analytics: We use PostHog to understand how users interact with the Service. PostHog respects the "Do Not Track" browser setting. To improve data reliability, we route PostHog events through a reverse proxy hosted on our subdomain (r.primordia.ai), operated by Cloudflare. Cloudflare's role is limited to routing data and does not include access to the analytics data for its own purposes.

You may clear local storage or block cookies through your browser settings, though doing so may prevent you from logging in or using the Service properly.

7. Data Retention

We retain your personal information for as long as it serves the purposes for which it was initially collected:

• Account Data, Generated Analyses, and Chat History: Retained for the duration of your active account. If you delete your account, we will delete or anonymize your personal information and workspace data within 30 days of your request.

• Payment Records: Retained as required by tax and financial regulations (typically 7 years).

• Technical Logs: Retained for 90 days for debugging and security purposes.

8. Data Security

We implement commercially reasonable technical and organizational measures designed to protect your information, including:

• Data encryption in transit (TLS/SSL) and at rest.

• Secure cloud infrastructure hosted on Google Cloud Platform.

• Payment data processed by a PCI-compliant third-party processor.

• Strict access controls and authentication safeguards.

While we strive to protect your personal information, no system is impenetrable, and we cannot guarantee the absolute security of any information you transmit to us. In the event of a data breach compromising your personal information, we will notify affected users as required by applicable law.

9. Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal information, as well as object to or restrict certain processing.

• Account Settings: You can update your display name and preferences at any time in your account settings.

• Data Deletion & Export: You may request the deletion or export of your account data by contacting us at info@primordia.ai.

• Email Communications: You may opt out of marketing emails by following the unsubscribe instructions included in those emails. You cannot opt out of essential transactional communications.

Notice to Nevada Residents: We do not sell your personal information. However, Nevada residents have the right to opt-out of the sale of certain personal information. You can exercise this right by contacting us at info@primordia.ai with the subject line "Nevada Do Not Sell Request."

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, provides you with the right to:

• Know what personal information we collect and how it is used.

• Delete your personal information.

• Correct inaccurate personal information.

• Opt out of the sale or sharing of your personal information. We do not sell or share your personal information for cross-context behavioral advertising.

• Non-discrimination for exercising your rights.

To exercise these rights, contact us at info@primordia.ai. We will verify your identity before processing your request.

11. European Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area ("EEA"), the UK, or Switzerland, we process your personal data based on contract performance, legitimate interests, legal obligations, and consent.

You have the right to request access, correction, deletion, restriction, and portability of your data, as well as the right to object to processing and withdraw consent. You also have the right to lodge a complaint with your local data protection supervisory authority.

To exercise your GDPR rights, contact us at info@primordia.ai. We will respond to your request within one month.

12. International Data Transfers

The Service is hosted and operated in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the U.S. By using the Service, you consent to this transfer. When we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

13. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

14. Third-Party Links

The Service may contain links to third-party websites or resources. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy here and revising the "Last Updated" date. We may also provide notice by email or through the Service. Your continued use of the Service constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Primordia Co.
Email: info@primordia.ai
Website: https://primordia.ai

Registered Agent: Corporation Service Company
Registered Office: Wilmington, New Castle County, Delaware

This Privacy Policy is provided for informational purposes and does not constitute legal advice. We recommend consulting with a qualified attorney to ensure compliance with all applicable privacy laws and regulations.