Privacy Policy

1. Who we are

BullBear AI is operated by MOIQ Digital Limited. This policy explains what personal data we collect through the Service, how we use it, and the choices you have. We process personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and, where applicable to users in the European Economic Area or United Kingdom, the GDPR / UK GDPR.

2. Data we collect

Account data. When you sign up we collect your email address and, if you sign in with Google, your name and profile identifier as provided by Google.

Usage content. The topics you submit, the reports and podcasts generated for you, watchlists, and saved items are stored so the Service can function.

Payment data. Payments are processed by Stripe. We receive subscription status and limited card metadata for support purposes; we never store full card numbers.

Technical data. Log data (IP address, browser type, timestamps), device information, and analytics events collected via Google Analytics.

3. How we use data

We use personal data to: provide and secure the Service; generate the analyses you request; manage subscriptions and billing; respond to support requests; monitor performance and abuse; and improve features. We may use aggregated, de-identified usage statistics that do not identify you.

4. Legal bases

Where GDPR applies, we rely on: performance of a contract (providing the Service you signed up for), legitimate interests (security, product improvement, analytics), and consent where required (e.g., marketing emails, which you can withdraw at any time).

5. Sharing and processors

We do not sell your personal data. We share data only with processors needed to run the Service: Google Firebase / Google Cloud (hosting, authentication, database, storage), Stripe (payments), Google (Gemini API, for generating analyses from your submitted topics), and Google Analytics (usage analytics). Each processor handles data under its own security and data-processing terms. We may disclose data if required by law or to protect our rights.

6. Retention

Account and usage content are retained while your account is active. If you delete your account, we delete or de-identify your personal data within 30 days, except records we must keep for legal, billing, or security purposes.

7. Security

Data is encrypted in transit (TLS) and at rest on Google Cloud infrastructure. Access to production data is restricted. No system is perfectly secure; we will notify affected users of a data breach where required by law.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request a portable copy. To exercise any of these rights, contact us at the address below. Where GDPR applies you may also lodge a complaint with your local supervisory authority; in Hong Kong, with the Privacy Commissioner for Personal Data (PCPD).

9. Cookies and local storage

We use strictly necessary cookies/local storage for authentication and session state, and analytics cookies (Google Analytics) to understand usage. You can control cookies through your browser settings; the Service may not function fully without the strictly necessary ones.

10. International transfers

Our processors operate on global infrastructure (primarily Google Cloud in the United States). Where data is transferred out of your jurisdiction, we rely on our processors' standard contractual protections.

11. Children

The Service is not directed to persons under 18, and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the Service or by email, with the effective date updated above.

13. Contact

MOIQ Digital Limited · moiqhk@moiq.digital