Privacy policy

Khan Terminal Ltd (company number 17390417), registered in England and Wales at 39 Sheffield Road, Slough SL1 3EF, United Kingdom, is the controller of your personal data. That means we decide what is collected and why, and we're accountable for it.

For anything about your data, whether a question, a request or a complaint, email hello@khanterminal.com. A person reads it.

• Your account. Email address and a password. The password is salted and hashed with scrypt. We never store it in a readable form and cannot recover it.
• What you create. Watchlists, portfolio holdings, saved research, notes, documents you upload, and your conversations with the AI.
• Billing. If you subscribe, your email and subscription status. Card details go straight to Stripe and never reach our servers.
• Contact and newsletter. If you write to us: your name, email and message. If you subscribe: your email address.
• Technical data. Your IP address and standard server logs, used to keep the service up and to rate-limit abuse of public forms.

If you agree to it, we run Vercel Web Analytics, which counts page views and referrers so we can see which parts of the terminal get used. We ask before it loads, and if you decline or haven't answered, the script is never requested. It sets no cookies and doesn't follow you across other sites. We run no advertising and no third-party tracking beyond that, and there is no profile of you being assembled here beyond what you deliberately put in.

We use several providers and fall back between them for availability. Today those are Groq, Google (Gemini), Cloudflare and Mistral AI. Each processes your content under its own terms in order to return a result.

We do not sell your data, and we do not train any model of our own on your content. We can't make promises on our providers' behalf about their own training practices, which is precisely why we're naming them here rather than hiding them behind “trusted partners”.

A document you upload is also stored, not just passed through: we split it into passages and keep them in a search index (Qdrant) so the assistant can find the right part later. Each passage is tagged with your account, and a search can only ever return your own. Deleting the document, or your account, removes them from the index as well.

Some analysis runs entirely on our own infrastructure and involves no third party at all. The valuation, screening, ESG, Sharia and stress engines are ordinary code, not model calls.

These are our processors. They act on our instructions, for the purposes below and nothing else. We will keep this list current as the product changes.

Some of these operate outside the UK. Where data is transferred abroad, we rely on the UK's adequacy regulations, or on standard contractual clauses and the UK Addendum as provided in those providers' terms.

Separately, the terminal fetches public data from sources such as SEC EDGAR, Companies House and market-data feeds. Those requests carry a company or ticker, never anything about you.

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct it if it's wrong.
• Delete it. You can delete your account yourself, which removes it and everything attached to it.
• Restrict or object to how we use it.
• Give you your data in a portable form.
• Stop sending you marketing. Instantly, via the unsubscribe link or your settings.

Email hello@khanterminal.com and we'll respond within one month. If you think we've got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We'd rather you told us first so we can fix it.

• Passwords are salted and hashed with scrypt. We never see or store the original.
• Sessions are opaque tokens in an HTTP-only cookie, not readable claims, and not reachable from JavaScript.
• Everything is encrypted in transit with TLS.
• You can turn on two-factor authentication, and we'd encourage it.
• Your research, documents and portfolio are scoped to your account.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If you find a vulnerability, please tell us at hello@khanterminal.com.

We set exactly one cookie, and it exists to keep you signed in. Our analytics are cookieless and only run if you agree to them. You can change that answer at any time on the cookie policy. We run no advertising and no cross-site tracking. The cookie policy explains it in full, and it's short.

Khan Terminal is not intended for anyone under 18, and we don't knowingly collect data from children. If you believe a child has given us personal data, tell us and we'll delete it.

If we change how we handle your data, whether a new processor or a new purpose, we'll update this page and change the date at the top. For anything significant, we'll tell you directly rather than hope you re-read the page.