Privacy Policy

Mesodian is the data controller for the personal data we process in connection with the Mesodian Service, except where a different role applies under applicable law.

As a data controller, Mesodian determines the purposes and means of processing personal data for the purposes described in this Privacy Policy.

The Irish Data Protection Commission describes a data controller as the person or organisation that determines the purposes and means of processing personal data.

The information we collect depends on how you use Mesodian.

We may collect the following categories of personal data.

This information may be used to personalise the Mesodian experience.

If you use Mesodian's portfolio functionality, we may process information relating to your portfolio.

This may include:

• investments
• securities
• holdings
• quantities
• portfolio allocations
• transaction information
• account balances
• portfolio performance
• portfolio history
• investment strategies
• selected Portfolios
• selected Strategies
• rebalancing information
• investment-related preferences

This information may be obtained directly from you or from a connected third-party Brokerage Provider.

If you choose to connect a Brokerage Account to Mesodian, we may receive information made available through the relevant brokerage connectivity provider.

Depending on the Brokerage Provider, connection and permissions granted, this may include:

• brokerage account identifiers
• account balances
• holdings
• positions
• transactions
• orders
• securities
• portfolio information
• account status
• currency information
• other information made available through the connection

The exact information available to Mesodian depends on the Brokerage Provider and the permissions you grant. Mesodian does not request access to information that is not necessary for the functionality you have enabled, where technically and operationally practicable.

If you enable an Automated Portfolio, we may process information necessary to operate that functionality.

This may include:

• selected Portfolio
• selected Strategy
• target allocations
• current holdings
• rebalancing information
• transaction instructions
• transaction status
• connected Brokerage Account information
• information concerning the permissions you have granted

This information is processed to provide the automated portfolio functionality you have requested.

If you purchase a paid Mesodian subscription, payment information may be processed by our payment service providers.

Depending on the payment method, this may include:

• payment status
• transaction reference
• subscription information
• billing information
• limited payment-card information

Mesodian does not generally need to store complete payment-card details where these are handled directly by our payment provider. Payment providers process payment information under their own terms and privacy policies.

When you use Mesodian, we may automatically collect technical and usage information.

This may include:

• IP address
• browser type
• device type
• operating system
• device identifiers
• application version
• pages or screens accessed
• features used
• session information
• timestamps
• referring website
• error information
• performance information
• interactions with the Service

We use this information to operate, secure, maintain and improve Mesodian.

Mesodian may use cookies and similar technologies.

Cookies may be used for purposes including:

• authentication
• maintaining sessions
• security
• remembering preferences
• analytics
• understanding how users interact with the Service
• improving performance
• measuring website activity

Some cookies may be necessary for the Service to operate. Other cookies or similar technologies may require your consent depending on their purpose and applicable law. Where required, we will provide appropriate controls allowing you to manage non-essential cookies.

If you communicate with Mesodian, we may collect information contained in those communications.

This may include:

• emails
• support requests
• feedback
• survey responses
• product feedback
• bug reports
• other communications you send to us

We use this information to respond to you, provide support and improve the Service.

We may collect personal data:

• directly from you
• when you create an Account
• when you use the Service
• when you connect a Brokerage Account
• through third-party brokerage connectivity providers
• through payment providers
• through authentication providers
• through cookies and similar technologies
• through support communications
• through surveys and feedback
• from other service providers used to operate Mesodian

Where personal data is obtained from a third party rather than directly from you, we will provide the information required by applicable data protection law. The GDPR requires appropriate transparency where personal data is obtained from sources other than the individual.

We may process personal data for the following purposes.

Under GDPR, personal data must be processed on a lawful basis.

Depending on the processing activity, Mesodian may rely on one or more of the following legal bases.

Where you connect a Brokerage Account, information obtained through that connection is used to provide the functionality you have requested.

This may include:

• displaying your portfolio
• analysing your holdings
• calculating portfolio metrics
• displaying transactions
• calculating portfolio performance
• implementing an Automated Portfolio
• determining whether rebalancing may be required
• transmitting authorised transaction instructions
• maintaining portfolio history

We do not use Brokerage Account information to take ownership of your investments.

Mesodian may use third-party brokerage connectivity providers, including SnapTrade, to connect users with supported Brokerage Providers.

These providers may process information necessary to establish and maintain the connection between Mesodian and your Brokerage Account.

The relevant provider may process information under its own privacy policy and terms.

You should review the applicable third-party privacy policy before connecting a Brokerage Account.

We may share personal data with service providers where necessary to operate Mesodian.

These may include:

• cloud hosting providers
• database providers
• authentication providers
• payment processors
• brokerage connectivity providers
• Brokerage Providers
• market data providers
• analytics providers
• customer support providers
• email and communications providers
• security providers
• infrastructure providers
• professional advisers
• legal advisers
• accountants
• auditors

We only share information where there is an appropriate legal basis and where the disclosure is necessary for the relevant purpose.

If you choose to connect a Brokerage Account, information may be shared with or received from the relevant Brokerage Provider or brokerage connectivity provider as necessary to provide the requested functionality.

The information shared depends on:

• the Brokerage Provider
• the connectivity provider
• the permissions you grant
• the features you enable

Your Brokerage Provider may process your information independently under its own privacy policy.

Some companies provide services to Mesodian on our behalf.

Where a service provider acts as a processor of personal data for Mesodian, we will use appropriate contractual arrangements and require the processor to process personal data in accordance with applicable data protection requirements.

The Irish Data Protection Commission states that controllers engaging processors must have an appropriate legally binding data processing arrangement governing the processing.

If Mesodian is involved in:

• a merger
• acquisition
• restructuring
• financing
• sale of assets
• sale of the business
• insolvency or similar transaction

personal data may be transferred as part of that transaction where legally permitted. Any transfer will remain subject to applicable data protection requirements.

We may disclose personal data where necessary to:

• comply with applicable law
• comply with a court order
• respond to lawful requests from authorities
• protect our legal rights
• investigate fraud
• investigate security incidents
• protect users or third parties
• enforce our agreements

Some of our service providers may process personal data outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we will use an appropriate legal mechanism where required by GDPR.

Depending on the circumstances, this may include:

• an adequacy decision
• Standard Contractual Clauses
• another lawful transfer mechanism
• applicable safeguards recognised under GDPR

Where required, additional information concerning relevant transfer safeguards may be provided upon request.

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access
• unauthorised disclosure
• accidental loss
• destruction
• alteration
• misuse

No internet-based service can be guaranteed to be completely secure. The GDPR requires controllers to apply appropriate security measures and protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage.

If Mesodian becomes aware of a personal data breach, we will assess the breach and take appropriate action in accordance with applicable data protection law.

Where legally required, we will notify the Irish Data Protection Commission and affected individuals.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Different categories of information may be retained for different periods. For example:

We periodically review retained information and delete or anonymise information when it is no longer required, subject to applicable legal obligations. The GDPR includes a storage limitation principle requiring personal data not to be kept longer than necessary for its purpose.

Depending on the circumstances and applicable law, you may have the following rights.

You can exercise your data protection rights by contacting us using the contact details provided at the end of this Privacy Policy.

When making a request, we may need to verify your identity to ensure that personal data is not disclosed to the wrong person.

The Irish Data Protection Commission states that organisations may request additional information where they have reasonable doubts about an individual's identity.

We will generally respond to valid data protection requests within the timeframe required by applicable law.

If you believe that Mesodian has processed your personal data unlawfully or has not properly addressed your data protection rights, please contact us first so that we can investigate the matter.

You also have the right to lodge a complaint with the relevant supervisory authority.

For Mesodian's Irish operations, the relevant supervisory authority is:

Data Protection Commission — Website: dataprotection.ie. The Irish Data Protection Commission is responsible for supervising and enforcing data protection law in Ireland.

Mesodian is not intended for children who are below the minimum age required to use the Service under applicable law.

We do not knowingly collect personal data from children where such collection is prohibited.

If you believe that a child has provided personal data to Mesodian without appropriate permission, please contact us so that we can investigate and take appropriate action.

Mesodian may contain links to third-party websites.

This Privacy Policy does not apply to third-party websites.

You should review the privacy policy of any third-party website or service before providing personal information.

When you connect a Brokerage Account, the relevant Brokerage Provider remains responsible for its own processing of your personal data.

Your Brokerage Provider may have different privacy practices and may collect information directly from you.

You should review the Brokerage Provider's privacy policy and terms before connecting your account.

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to the Service
• new features
• new data processing activities
• changes to service providers
• changes in applicable law
• changes to our data protection practices

When we make material changes, we may notify you through the Service, by email or through another appropriate method. The "Last updated" date at the beginning of this Privacy Policy indicates when it was most recently updated. The Irish Data Protection Commission recommends that privacy policies remain dynamic documents and are regularly reviewed to reflect an organisation's actual processing activities.

Legal entity: Mesodian

Registered address: 15 Rockbarton Road, Ireland

Email: contact@mesodian.com

For privacy and data protection enquiries, you can contact us using the email address above.

This Privacy Policy is intended to explain Mesodian's processing of personal data in accordance with applicable data protection law, including the GDPR and applicable Irish data protection legislation.

Nothing in this Privacy Policy limits any rights you have under applicable data protection law.