Privacy

Who is responsible

FinancialMD is run by LuLu Ventures LLC. It decides what the service records and why.

What a request leaves behind

• Rate limits. Your IP address is used to count calls against the daily limits. The counters are held in the server's memory and are not written to a database. When you use the terminal or the MCP server, they pass your IP address to the API for this count.
• Usage records. For each call to a data route the API stores a record: the time, the host, the route, the company asked about, the status, the response time and whether the call was charged. It also holds an identifier derived from your IP address by a one-way hash or, for a call made with a key or a token, the identifier of that key or connection. We treat the hashed identifier as personal data, because a hash of an IP address can in principle be traced back. No automatic deletion period is set for usage records today.
• API logs. The API writes one log line per request: the method, the path without its query string, the status, the response time, the company asked about and the kind of caller (browser, AI agent, crawler or script). The kind is worked out from the User-Agent header. The header itself and your IP address are not written to this line.
• MCP logs. The MCP server writes one log line per request: the method, the name of the tool called, the kind of caller and, when a client connects, the name and version the client gives. Tool arguments, tokens and IP addresses are not written.
• Site logs. The site writes a log line when an AI crawler, an agent, a search crawler or a script fetches a page: the time, the host, the path without its query string and the kind of caller. Page views from ordinary browsers are not logged by the site.
• The hosting platform keeps these logs for 30 days. Its own platform logs can include IP addresses.

We use these records to enforce the limits, to find faults and to see which routes are used. We do not sell them or share them for advertising.

Keys, MCP connections and payment

• When an MCP client registers itself, we store what the client sends: its name, its redirect addresses and, if it gives one, the address of its metadata.
• When you approve a connection, we store a record of the approval and one-way hashes of the tokens, not the tokens themselves. An access token lasts one hour and a refresh token 30 days. The approval page asks for no name, email address or password.
• API keys are not issued to the public. A key we issue is stored as a one-way hash with a label for its holder, and calls made with it are recorded under that key.
• Nothing is charged, so no payment data is recorded. If per-call payment opens on agent.financial.md, the usage record of a paid call will hold its receipt: the paying wallet address, the transaction and the network. This page will change before that.

What stays in your browser

The terminal keeps your settings, watchlist, saved charts and notification choices in your browser's local storage. They are not sent to us. Clearing the site's data in your browser removes them.

What we do not collect

• No names, email addresses or passwords. There is no signup.
• No payment details. Nothing is sold.
• No cookies, tracking pixels or third-party analytics.

Where it runs and who else is involved

• The service runs on Microsoft Azure in the United States. Microsoft processes the data above as our hosting provider. If you use the service from another country, your requests are processed in the United States.
• A full-text search of filings is answered by the SEC's own search service. Our server sends your search words to sec.gov. The SEC sees our server, not your IP address.
• The interactive API explorer at api.financial.md/docs loads its script and style sheet from the jsDelivr network. Like any site your browser loads from, jsDelivr sees your IP address when you open that page.

Your choices

Because there are no accounts, we usually cannot tell which records are yours. A request to see or delete records needs the IP address and the dates of the calls, so that we can find them.

Changes

If the service starts to collect more, for example when API keys open, this page will change first. The date at the top shows the latest version.