Privacy Policy

This policy describes how Mano Maya LLC, a Wyoming limited liability company doing business as 100bps (“100bps,” “we”), handles personal information for the 100bps website (100bps.ai) and application (app.100bps.ai) (the “Service”). The Service is a professional tool for investment professionals, intended for users in the United States; it is not directed to consumers or children, and we do not knowingly collect information from anyone under 18.

1. What we collect

You provide:

• Account details: email address and password (your password is stored only as a hash by our authentication infrastructure — we never see or store it in plaintext).
• Professional verification (optional): your CRD number and firm details, used to verify professional identity against public regulatory records.
• Content you create in the app: saved playbooks, notes, and pipeline entries.
• Communications you send us (email, support requests).
• Payment: handled entirely by our payment processor. We receive confirmation of payment and subscription status — never your card number.

Collected automatically:

• Usage information: pages viewed, searches and filters used, features clicked, plans viewed, session identifiers, and referral parameters (including campaign codes from mailings). Our product analytics are in-house — usage events are stored in our own database, not sent to a third-party analytics network.
• Technical and security signals: IP address, browser type, error reports, and abuse-prevention signals (e.g., unusual access patterns), used to protect the Service.

2. How we use it

• To provide and secure the Service, including enforcing access tiers and preventing scraping and abuse.
• To verify professional identity when you submit a CRD (matched against public regulatory filings).
• To operate, understand, and improve the product (aggregate usage analytics).
• To communicate with you about your account and the Service (transactional email). Marketing email only with your consent, and every such email includes an opt-out.
• To comply with law.

3. What we do NOT do

• We do not sell or share your personal information (including as “sell” and “share” are defined under California law). Not your email, not your CRD, not your usage. To anyone. Because we do not sell or share, there is no sale to opt out of.
• We do not disclose who you are or what you research to other subscribers, competitors, plan sponsors, or data brokers. Your searches are yours.
• We do not use third-party advertising or marketing trackers on the Service.

4. Artificial intelligence

Certain data in the product — for example, fund lineups — is extracted from public filing attachments using a third-party AI provider (Anthropic). Only public filing content is sent for extraction; your personal information is never sent to an AI provider. Under our provider’s API terms, submitted content is not used to train its models. Extracted data is stored in our database like any other filing-derived data and carries the same accuracy disclaimers as the rest of the Service.

5. Service providers (sub-processors)

We use a small set of providers to run the Service, each receiving only what it needs for its function, under its own contractual confidentiality and security obligations:

• Supabase — database, storage, and authentication infrastructure
• Vercel — application hosting
• Netlify — marketing-site hosting
• Google Workspace — business and transactional email
• Sentry — error monitoring
• Anthropic — automated extraction from public filings (no personal information; see Section 4)
• Cloudflare Turnstile — bot protection at sign-up (when enabled)
• Our payment processor — payment processing (when payments are live; named here at launch)

We may also disclose information if required by law, to enforce our Terms, to protect the rights, safety, or property of 100bps or others, or in connection with a merger, acquisition, or sale of the business (with notice where required).

6. Data about advisors and firms shown in the product

The Service displays information about retirement plans, service providers, and investment-adviser firms derived from public federal and state filings (Form 5500 series and investment-adviser registration filings). This is public-record information published by government agencies. If you believe information about you or your firm derived from these records is inaccurate, contact us and we will review it against the underlying filing.

7. Retention and deletion

We retain account and usage information while your account is active and as needed for security, legal, and record-keeping purposes, then delete or de-identify it. You may request a copy or deletion of your personal information by emailing access@100bps.ai; we will verify and honor the request within the time required by applicable law, except where retention is required (e.g., payment records, abuse-prevention records). We do not discriminate against you for exercising privacy rights.

8. Security

Access to data is controlled server-side with role-based credentials, row-level security, encrypted transport and storage, rate limits, and monitored access patterns. The Service is designed so that data a user is not entitled to never reaches that user’s browser. No system is perfectly secure. More detail: our Security page.

9. Cookies

We use only cookies and similar storage that are strictly necessary to run the Service (authentication/session state and preferences). No third-party advertising cookies, no cross-site tracking.

10. Changes

We will post material changes here with a new effective date and, where appropriate, notify account holders by email or in-app. We review this policy at least every 12 months.

Contact

Mano Maya LLC (d/b/a 100bps) — access@100bps.ai