Investipal Inc. (“Investipal,” “we,” “us,” or “our”) provides software for financial advisory firms. This policy explains how we collect, use, share, retain, and protect information when you visit our website or use our services.
Questions about this policy can be sent to info@investipal.co.
1. Information we collect
Information you provide. Depending on how you use Investipal, we may collect your name, contact details, account information, billing details, information you submit through forms, and information you enter or upload while using our services.
Payment information. Payment information needed to process a purchase may be handled by our payment processor.
Information collected automatically. When you visit our website or use our services, we may collect device and browser information, IP address, referring pages, usage activity, and similar technical information. We use this information to operate and secure our services and to understand how they are used.
Information from connected services. If you choose to connect a third-party service, we receive information needed to provide the features you authorize. Our handling of information obtained from Google is described specifically in Section 5.
2. How we use information
We use information to:
- Create and manage accounts and provide the services you request.
- Support client and firm workflows within Investipal.
- Respond to questions and provide support.
- Send service and administrative communications.
- Process purchases and manage billing.
- Protect our services, investigate misuse, and maintain security.
- Analyze how our website and services are used so we can improve them.
- Send marketing communications where permitted. You can opt out of marketing emails at any time.
We do not use information received from Google APIs for advertising. The uses of Google information are limited further in Section 5.
3. How we share information
We may share information with service providers that help us operate Investipal, such as hosting, payment, support, analytics, and AI-processing providers. We share information as needed for the service they provide and subject to applicable contractual protections.
We may also disclose information when you direct us to do so, when needed to provide an authorized feature, or when required by applicable law. We do not sell Google user data or transfer it to advertising platforms or data brokers.
The specific parties that receive Google user data, and how that data is protected, are described in Section 5.
5. Google user data
If you connect your Google account, Investipal accesses the following information for the features you choose to use:
- Gmail messages, attachments, and labels: to display client correspondence in Investipal; send mail you compose; apply the read, starred, archived, and label changes you make; and generate summaries and draft replies at your request.
- Events on your primary Google Calendar: to associate meetings with the appropriate client and create or update meetings you schedule in Investipal.
- Transcripts of Google Meet meetings you hosted: to generate meeting summaries and follow-up tasks.
- Your Google account email address: to identify the connected mailbox.
We use Google user data, whether raw or in aggregated or anonymized form, only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell it, and we do not transfer it to advertising platforms, data brokers, or information resellers. We do not use Google user data to develop, improve, or train any artificial intelligence or machine-learning models, including our own.
AI processing. Investipal uses the following AI providers to deliver the features described above:
- Anthropic: to generate summaries, extractions, meeting preparation, and draft replies, the content of the relevant email messages, calendar event details, and meeting transcripts is sent to Anthropic.
- OpenAI: to make synced correspondence and meetings searchable within Investipal, summaries of that content are sent to OpenAI to create search indexes (embeddings).
- TypeSafe: if your firm has turned on compliance review of outgoing messages, the subject and body of messages you send are checked by TypeSafe before sending.
These providers process this content only to return results to Investipal. None of them uses it to train their AI models.
Who we share Google user data with. We share Google user data only as needed to provide the features described above, and only with: (1) our cloud hosting provider, Microsoft Azure, which stores and processes data on our behalf; (2) the AI providers named above; and (3) the authorized users at your advisory firm who can access the client records the data is linked to. We do not share Google user data with any other party unless you direct us to or the law requires it.
How we protect Google user data. Investipal is SOC 2 Type II certified. Google user data is protected with bank-level 256-bit encryption at rest and is encrypted in transit using TLS. The credentials that connect your Google account are additionally encrypted at the field level. Access within Investipal is restricted by role and by firm, so users at other firms cannot see your data. Investipal staff cannot sign in to customer accounts and do not read Google user data. Access to our production systems is limited to a small number of authorized engineers, and only to operate and secure the service or where required by law.
Disconnecting your Google account. You can disconnect your Google account through Investipal’s integration settings. Disconnecting revokes Investipal's access at Google and deletes the stored connection credentials.
Content already incorporated into client records. Email, calendar, and meeting content already synced into client records remains after you disconnect. Investipal is used by regulated financial advisory firms, and that content may form part of records the firms must retain. We retain it for applicable recordkeeping obligations and delete it when the required retention period ends, subject to other applicable legal obligations. If a firm cancels its Investipal subscription, the firm's data, including Google-sourced content, remains available for the firm to retrieve for 30 days and is then permanently deleted from our application, file storage, databases, and backups.
Deletion requests. To request deletion of Google-sourced content, email info@investipal.co. We will complete eligible deletions within 30 days, except where a legal recordkeeping obligation requires retention. Where retention applies, we will explain which content is affected and when it can be deleted.
Limited Use. Investipal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
6. Retention and security
We retain information for as long as needed to provide our services and meet applicable contractual, legal, security, and recordkeeping obligations. Different types of information may have different retention periods. The treatment of Google-sourced content after disconnection is described in Section 5.
Investipal is SOC 2 Type II certified. We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, and misuse, including bank-level 256-bit encryption at rest, encryption in transit using TLS, and role-based access controls. Additional protections for Google user data are described in Section 5. No system can guarantee absolute security.
7. Your choices and privacy rights
You can update certain account information through your account settings or contact us for assistance. Depending on applicable law and your relationship with Investipal or an advisory firm using it, you may have rights to access, correct, or request deletion of personal information.
To make a request, email info@investipal.co. Some information may need to be retained to meet legal or regulatory obligations. If you receive marketing emails from us, you can unsubscribe using the link in those emails; we may still send necessary service communications.
If you are in the EEA or UK and believe your information has been processed unlawfully, you may also contact your local data protection authority.
8. Changes to this policy
We may update this policy as our services or legal obligations change. We will post the revised policy with an updated date. Where a change to our use of Google user data requires additional notice or consent, we will provide it before using the data for the new purpose.
9. Contact us
For questions about this policy or requests concerning your information, email info@investipal.co.
Investipal Inc.