Privacy Policy

1. Overview

CLOVERIA INC. ("Company," "we") operates the NextPick platform. This Privacy Policy explains what information we collect, why we collect it, and how you can manage it.

2. Information We Collect

• Account information: email address, name, password hash, language and theme preferences, OAuth provider IDs (Google, WeChat).
• Subscription information: plan tier, billing cadence, trial expiration, Stripe customer/subscription identifiers. Card numbers are never stored on our servers — they are handled by Stripe.
• Usage information: pages visited, features used, watchlists, portfolio positions you enter, AI bot interactions. Demo accounts have this data flagged and deleted on conversion.
• Device & log information: IP address, browser type, OS, request timestamps. Used for security, abuse prevention, and operational analytics.

3. How We Use Information

• To operate, secure, and improve the Service.
• To provision your subscription and process payments via Stripe.
• To send transactional and (with your consent) marketing email via Resend.
• To diagnose problems and protect against fraud and abuse.
• To comply with legal obligations.

We do not sell your personal information.

4. Third-Party Services

We share limited information with these processors strictly to operate the Service:

• Stripe — payment processing. See stripe.com/privacy.
• Google OAuth — sign-in. See policies.google.com/privacy.
• Tencent / WeChat OAuth — sign-in for Chinese users. WeChat's privacy terms apply.
• Resend — transactional email delivery.
• Cloudflare — DNS and edge security.

5. Cookies & Tracking

We use first-party cookies for session management (NextAuth) and to remember theme/language preferences. We do not use third-party advertising trackers.

6. Data Retention

• Account data is retained while your account is active.
• Demo trial data is retained during the 30-day trial and for 30 days after it ends; if you do not upgrade within that window, the trial data is permanently deleted while the account record itself is preserved.
• Closed-account data is deleted within 90 days, except where retention is required by law.
• Server logs are rotated within 30 days.

7. Your Rights

Depending on where you live, you have one or more of the following rights with respect to the personal information we hold about you:

• Access — request a copy of your personal data.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion (subject to legal-retention exceptions).
• Portability — receive your data in a machine-readable format.
• Restriction / Objection — limit or object to certain processing (GDPR).
• Withdraw consent — for any processing based on your consent.
• California (CCPA/CPRA) — right to know, delete, correct, opt out of sale or sharing (we do not sell or share), and non-discrimination for exercising these rights.

To exercise any of these rights, email privacy@getnextpick.com from the address associated with your account. We will respond within 30 days. If you are dissatisfied with our response, you may also have the right to lodge a complaint with your local data protection authority.

8. International Transfer

Our servers are located in the United States. By using the Service from outside the US, you consent to the transfer of your information to and processing in the US, which may have data protection laws different from those of your country.

9. Children

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.

10. Changes

We may update this Privacy Policy. Material changes will be communicated by email or in-product notice at least seven (7) days before they take effect.

11. Contact

Privacy questions: privacy@getnextpick.com.