Privacy Policy

Dawo is operated by Dawo Software, a business established in the Netherlands ("we", "us", or "our"). Dawo Software is the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, store, and share information about you when you use Dawo, including through a connected assistant.

For privacy questions, contact us at contact@dawo.ai.

Account information

When you create an account we collect your email address and, if you sign in through a third-party provider (Google or Apple), a profile identifier from that provider. We do not store your password — authentication is managed by Supabase.

Portfolio data

We store portfolio data you provide: position snapshots (ticker, quantity, average cost, market value), transaction lots (symbol, action, quantity, price, date), and any CSV files you upload. This data is scoped to your user account and never shared with other users.

Broker connection data

Brokerage accounts connect through SnapTrade, read-only. Dawo receives positions, balances and transactions. It never receives your broker password, and it can never place a trade or move money. We store the encrypted connection tokens, account identifiers, institution names, and the synced positions and transactions. Tokens are encrypted at rest using AES-128-CBC (Fernet) and deleted when you disconnect the broker or delete your account.

Usage and log data

We collect standard server logs including IP addresses, request paths, HTTP status codes, and timestamps. These are used for security monitoring, debugging, and abuse prevention. Logs are retained for 30 days.

We process your data under the following legal bases as defined by Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)) — Processing necessary to provide the Dawo service you signed up for, including portfolio analysis, AI chat, sourced research reads, and user-directed scenario or tax-cost calculations.
• Legitimate interest (Art. 6(1)(f)) — Security monitoring, fraud prevention, service improvement through anonymized usage analytics.
• Consent (Art. 6(1)(a)) — Marketing communications, optional data sharing, and any processing beyond core service delivery.

International data transfers

We are established in the Netherlands, and your data may be transferred to and processed in the United States by our sub-processors (Supabase, Neon, Fly.io, Vercel, OpenAI, Anthropic). These transfers are protected by Standard Contractual Clauses approved by the European Commission or, where the recipient is certified, the EU-US Data Privacy Framework.

• Provide the service — display your portfolio, compute performance metrics, and generate AI-powered analysis.
• Sync broker data — fetch positions and transactions from connected brokers on your behalf.
• Improve accuracy — use aggregate, anonymized usage patterns to improve screener models and AI prompts. We do not train AI models on your personal portfolio data.
• Security — detect and prevent unauthorized access or abuse.
• Communication — send transactional emails (password reset, email confirmation) via Supabase. We do not send marketing email without your explicit consent.

We rely on the following sub-processors to operate the service:

Each sub-processor is bound by their own privacy policy and data processing agreements. Note on AI providers: when you ask Dawo a question or run analysis on a holding, the question text and portfolio context (symbols, holdings, analysis history) are sent to Anthropic and/or OpenAI to generate a response. We do not transmit your email, auth tokens, or payment information to AI providers. Both providers contractually limit retention to abuse-monitoring windows (typically 30 days).

You can let an assistant use Dawo on your behalf through Dawo's connector. The connection is authorised through our sign-in provider (Supabase Auth, OAuth 2.1) on a consent screen that names the application and lists what it can do. Nothing is shared until you approve.

What a connected assistant can read and record

• Your holdings and their weights, and which have a read or a recorded view.
• The read on any name you hold: its single-driver valuation stresses, the last print, the trend, and the evidence with its sources.
• What cutting a position would cost, lot by lot; the watches on a name; the public read ledger.
• A view you state in the conversation, recorded in your own words as yours.

What it can never do

• Trade, move money, or change anything at a broker; the connector has no such tool.
• Recommend a stock or a stance; every figure carries its date and source, and the view is yours.
• See your broker credentials, your email address beyond the sign-in, or your payment details.

Where the data goes

What a tool returns is shown inside the assistant's conversation, so the assistant's provider (Anthropic or OpenAI) receives it under their own retention terms. Dawo sends nothing to them outside the tools you invoke.

Ending the connection

Disconnect in the assistant, or revoke the connection in Dawo under Settings, Broker Connections, Connected apps. Revoking ends the connection at once; views already recorded stay in your record.

Dawo is research, not advice: nothing is executed and nothing is recommended through a connector, and a view recorded through one is yours, kept exactly as any view you record in the app.

We do not sell, rent, or trade your personal information. We share data only as described in Section 4 (sub-processors), or when required by law (e.g., valid court order or regulatory request), or to protect the rights and safety of our users and the public.

• Account data: retained until you delete your account.
• Portfolio positions and lots: retained until you delete them or your account.
• Broker connections and tokens: deleted when you disconnect the broker or delete your account.
• Connector grants (assistants you let use Dawo): ended the moment you revoke them, in the assistant or in Settings; views recorded through a connector are kept with your account like any other.
• Server logs: 30 days.
• Deleted accounts: residual data purged within 30 days of account deletion.

We apply industry-standard security measures including TLS in transit, encrypted storage for OAuth tokens, bcrypt-hashed credentials at the auth provider level, and strict user-scoped data access at the database layer. No internet transmission is 100% secure; we cannot guarantee absolute security.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, email us at contact@dawo.ai. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority; ours is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and you may also contact the authority in the country where you live.

Strictly necessary (always on): Dawo uses browser local storage to cache your authentication session token (managed by Supabase). We do not set third-party advertising cookies or tracking pixels.

Analytics (consent required in EU/UK): we use PostHog for product analytics (which pages you visit, which features you use) and Sentry for error monitoring. In the EU and UK, these only run after you grant consent via the cookie banner; elsewhere they default to on. You can change your choice anytime from the “Cookie preferences” link in the footer.

PostHog and Sentry are configured to scrub personally identifying fields (email, auth tokens, broker IDs) before transmission.

Dawo is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

We may update this Privacy Policy. When we do, we will update the effective date at the top and, for material changes, notify you by email or in-app notice. Continued use of Dawo after changes constitutes acceptance.

Dawo Software, the Netherlands. Questions or requests: contact@dawo.ai