From the Risk Desk: what we keep, why we keep it, and who never sees it. Shorter than most, because we collect less than most. M.R.

1. What we store

To run your desk we store: your email address and authentication records (via Supabase); your watchlist; any positions you enter by hand; the briefs, transcripts, and Ask-the-Desk responses generated for you; and subscription status. Payments are handled by Stripe. We never see or store full card numbers. That is the complete list; we do not collect browsing history, contacts, location, or anything from a brokerage (there are no broker connections).

2. What we never do with it

Your data is never sold and never shared with advertisers or data brokers. Your positions and watchlist are treated as sensitive: they are not sent to analytics tools, do not appear in logs or error reports, and are readable only by your authenticated account (enforced with row-level security in the database) and by the server-side jobs that generate your brief.

3. Service providers

We use a small set of processors strictly to run the Service: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Resend (email delivery), OpenAI (which generates the desk’s commentary: its prompts include your watchlist symbols and position figures, since that is what the desk discusses, and we do not use your data to train models), and market-data vendors (which receive ticker symbols only, never your identity). Each receives only what its function requires.

4. Retention and deletion

We keep your data while your account exists. Delete your account (or email desk@thecrossdesk.com from your account address) and your personal data is deleted within 30 days: email, watchlist, positions, and per-account briefs. Records we must keep for tax, accounting, or legal compliance are the exception. The free Public Desk content contains no personal data and stays published.

5. Email

We send the brief you subscribed to and transactional messages (receipts, account notices). Every subscription email has an unsubscribe path, and a cancel link rides in the footer.

6. Your rights; contact

You can access, correct, export, or delete your data by using the app or emailing desk@thecrossdesk.com. If your jurisdiction grants additional rights (GDPR, CCPA and kin), we honor them on request through the same address. Material changes to this policy are posted here with a new effective date. See also the Terms and Risk Disclosures.