HayInsights Privacy Policy

Effective date: 9 October 2026 · Last updated: 9 October 2026

Finhay Pty Ltd ("HayInsights", "we", "us") operates HayInsights, a financial data platform. We respect your privacy and are committed to keeping your personal data secure in accordance with applicable law. This Privacy Policy forms part of any service agreement you enter into with us for HayInsights products and services.

Article 1. Scope

This Privacy Policy explains:

the types of personal data HayInsights collects and how we collect it;
how we process personal data, including recording, organising, storing, adjusting, retrieving, using, disclosing, combining, restricting, deleting or destroying it;
the third parties involved with your personal data;
how you can exercise your rights over your personal data.

It applies to the HayInsights website, web application, API, and the HayInsights MCP server when you connect it to an AI assistant (together, the "Services").

Article 2. Definitions

Applicable law means all laws, regulations and rules that bind HayInsights, including privacy and data protection laws.

Personal data means information in electronic form that relates to an identified or identifiable individual.

Processing means any operation performed on personal data, such as collecting, recording, analysing, storing, editing, combining, accessing, retrieving, encrypting, copying, sharing, transferring, deleting or destroying it.

Third party means an individual or organisation outside Finhay Pty Ltd that has a contract with us to provide products or services, including independent companies, organisations we own directly or indirectly, suppliers and partners.

AI Assistant means a third-party AI product, such as ChatGPT or Claude, that you choose to connect to HayInsights.

Article 3. Types of personal data we collect

We collect personal data to provide and manage the Services, comply with applicable law and internal policies, develop our products, and prevent fraud, unauthorised use or misuse of the Services. The categories below may vary depending on the Services you use and how you interact with us.

Basic personal data: name, email address, phone number (if provided), account identifiers, and other information you provide to us when you register for or use the Services.
Subscription and payment data: your plan, subscription and billing history, and payment transaction records. Payments are processed by third-party payment providers; we do not store full payment card numbers.
Data related to websites and applications: technical data (such as device type, operating system, browser type and settings, IP address, language settings, and dates and times of access), account name, login details, and data about how you use the Services, including requests made through our API or the HayInsights MCP server (see Article 5).
Analytics and cookie data: cookie data, clickstream data, and how you interact with our pages and features.
Communications: messages you send to our support team and any feedback you give us.

We do not intentionally collect sensitive personal data, such as government identification numbers, health information, biometric data or precise location data. HayInsights does not access any securities or brokerage account.

Article 4. Processing of personal data

4.1 Purposes of processing

HayInsights and the data processors we use may process personal data for one or more of the following purposes:

to create, verify and manage your account and authenticate you;
to provide the Services, including data, charts, the API and the HayInsights MCP server, according to your subscription plan;
to process payments, subscriptions and renewals;
to contact you about the Services, including service notices, security alerts and support, and, where permitted, information about our products;
to understand how the Services are used, and to improve, personalise and develop our products and services;
to detect, prevent and investigate fraud, security incidents, and unauthorised or abusive use of the Services;
to meet our reporting, financial, accounting and tax obligations, and for audit, risk management and compliance;
to establish, exercise or defend legal claims, and to respond to requests from competent authorities such as courts or regulators;
to notify you of changes to the Services or to our policies;
for any other purpose we tell you about when we collect your data, or that applicable law permits.

4.2 How we collect personal data

Directly from you: when you register, subscribe, contact us or otherwise interact with us.
From our websites and applications: when you visit or use them, we collect information about your device, browser and usage.
From the Services: when you sign in, use features, call our API, or use the HayInsights MCP server through an AI Assistant.
Through cookies and similar technologies.
From third parties: for example, from a sign-in provider if you choose to sign in with a third-party account, or from our payment providers about the status of your payments.
From competent authorities, where applicable law requires.

4.3 Processing period

Depending on the activity, we process personal data from the time it is provided or collected until the purpose of processing has been fulfilled, or until you ask us to delete the personal data you have provided.

4.4 Possible unwanted consequences and harm

Processing personal data carries a risk of data leakage or improper processing. We treat your personal data as a valuable asset that must be protected. We apply appropriate protective measures and regularly review and update our management and technical measures.

4.5 Notice of processing

By accepting this Privacy Policy, you confirm that you have been informed of, understand and agree to the processing described in this Article 4. We will therefore not need to notify you again before processing your personal data as described here.

4.6 Sharing of personal data

We do not sell or rent your personal data, and we do not share it with third parties in breach of this Privacy Policy without your consent. To carry out the purposes in Article 4.1, you agree that we may share your personal data:

with our staff and with service providers who help us operate the Services, such as hosting, payment processing, email delivery, customer support and analytics providers, under contracts that require them to protect it;
with companies in the Finhay group, where needed to provide or support the Services;
with the AI Assistant you choose to connect, limited to the results of the requests you make (see Article 5);
with competent authorities, or any person we are permitted or required to disclose to under applicable law;
with third parties you consent to or designate, or where we have another legal basis to share;
in other cases required by applicable law.

Apart from these cases, we will not share or disclose your personal data to anyone else.

Article 5. HayInsights MCP and AI Assistants

The HayInsights MCP server lets an AI Assistant retrieve financial market data from HayInsights on your behalf. It is read-only: it cannot change your account or take any action outside HayInsights.

Connection: you connect by signing in to HayInsights and approving access (OAuth). The AI Assistant never receives your HayInsights password.
What we receive: only the parameters of each data request the AI Assistant sends, such as ticker symbols, fund codes, currencies, countries, date ranges or search keywords, together with the authorisation that identifies your account. We do not receive your prompts, your conversation history or other content from the AI Assistant.
What we return: financial and economic market data, such as prices, indices, exchange rates, fund data, macroeconomic indicators and news. Results do not contain your personal data or other users' data.
How we use it: to answer the request according to your plan, and to operate, secure and troubleshoot the Services. Requests may be recorded in system logs for these purposes and are kept as described in Article 8.
The AI Assistant's own processing: results become part of your conversation with the AI Assistant, which is governed by that provider's privacy policy.
Disconnecting: you can disconnect HayInsights at any time in your AI Assistant's settings, or ask us to revoke access by emailing hayinsights@finhay.com.vn.

Article 6. Your rights and obligations

6.1 Right to be informed and to consent

We respect your right to know about and consent to the processing of your personal data. This Privacy Policy and related notices give you the information you need to consent clearly to our processing.

6.2 Right to access and correct

Unless applicable law provides otherwise, you may review, update, correct or delete the personal data we hold about you. You can update some information in your account settings, or contact us at hayinsights@finhay.com.vn. We will make reasonable efforts to handle a complete and valid request. We may ask for proof of identity or of the new data, and we may refuse access where we cannot verify your identity, where the data is commercially confidential, or where the request would breach data protection law.

6.3 Right to withdraw consent, delete, restrict and object

You may withdraw your consent to any or all processing, ask us to delete your personal data, restrict its processing, or object to it, by contacting us at hayinsights@finhay.com.vn. You may also cancel your subscription at any time in your account.

Depending on your request, we may no longer be able to provide some or all of the Services. Where the personal data is required to provide the Services, the request may be treated as a request to close your account. These requests do not affect the lawfulness of processing carried out before them.

6.4 Right to complain

If you believe your personal data has been processed in breach of this policy, you may complain to us at hayinsights@finhay.com.vn. We will review the complaint and, where it is justified, take timely measures to prevent or limit any disclosure of your personal data. You may also complain to the competent data protection authority.

6.5 Your obligations

We rely on the personal data you provide to deliver the Services. Please make sure it is true, accurate and complete, and update it promptly when it changes. You are responsible for keeping your account credentials, API keys and connected AI Assistants secure.

Article 7. Our commitments

We commit to the following principles when processing personal data:

personal data is processed lawfully, fairly and transparently, in line with applicable law;
personal data is collected for specific, clear and lawful purposes and is not processed beyond the purposes in this Privacy Policy;
personal data is kept accurate and up to date, and inaccurate data is corrected or deleted promptly;
we apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, destruction, loss or damage;
we require our partners and service providers to protect personal data through our contracts with them;
where applicable law allows processing without consent, we may process personal data as the law permits;
we comply with applicable data protection law, including the rights of individuals and the rules on cross-border data transfers.

Article 8. Storage and security of personal data

We keep personal data for as long as needed for the purposes of processing, unless applicable law or your request requires a longer period. When it is no longer needed, we delete or anonymise it. As permitted by law, we may store personal data in Australia or in other countries, including on cloud storage, in accordance with applicable law.

Article 9. Third-party services

The Services may link to websites or services of third parties, such as news sources, payment pages and the AI Assistants you connect. We do not control these third parties and are not responsible for their practices. Their own privacy policies and terms apply.

Article 10. Changes to this Privacy Policy

We may update this Privacy Policy at any time. We will post changes on this page with a new "Last updated" date and may also notify you by other means we consider appropriate. Please review this policy regularly. If you continue to use the Services after a change, you accept the updated Privacy Policy.

Article 11. Contact us

Finhay Pty Ltd, the data controller for HayInsights

Address: 1 Chifley Square, Sydney, New South Wales 2000, Australia
Email: hayinsights@finhay.com.vn