Privacy Policy

Pantile Investments Inc. ("Pantile," "we," "us," or "our") is a Delaware C corporation registered with FINRA and operating as a registered investment adviser in Colorado and other states as required. We are committed to protecting the privacy of our clients, prospective clients, and visitors to our website and platform. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at pantileinvestments.com and use our client platform (collectively, the "Services").

As a financial services firm, we are subject to Regulation S-P ("Reg SP") under the Securities and Exchange Commission, which governs the treatment of nonpublic personal information. This policy is designed to meet or exceed those regulatory requirements.

1. Information We Collect

Personal Information You Provide

When you create an account, request our services, or communicate with us, we may collect:

• Full name, date of birth, and Social Security Number
• Mailing address, email address, and phone number
• Employment and income information
• Investment objectives, risk tolerance, and financial goals
• Account numbers and financial account information
• Tax identification information
• Government-issued identification documents

Information Collected Automatically

When you access our website or platform, certain technical information is collected. We split this between two distinct purposes: website security and audit (collected and stored by Pantile) and product analytics (transmitted to our analytics provider with significant privacy controls applied).

For website security and audit (collected by Pantile):

• IP address (logged in our authentication audit trail for fraud detection, account takeover prevention, and SEC Regulation S-P recordkeeping)
• Browser type, device, and operating system
• Pages visited, time spent, and referring URL
• Time of access

For product analytics (transmitted to PostHog):

• Anonymous behavioral events (pageviews, button clicks identified by position, scroll depth, time on page)
• Aggregate browser family, operating system family, and device type
• Mouse movement coordinates for aggregate heatmap visualization, with no per-user playback
• Page performance metrics
• A daily-rotating anonymous browser identifier

The following are NOT received by our analytics provider: IP address, geographic location (city, postal code, region, country, latitude, longitude), raw browser user agent string, form values, keystrokes, or any link to your Pantile account. These are discarded at ingest or never collected at all.

Cookies and Analytics

We use cookies and similar tracking technologies to analyze site usage and improve your experience. With your consent, we use PostHog, a product analytics platform, to understand how visitors interact with our website and platform. PostHog receives anonymous behavioral events (pageviews, button clicks identified by position, scroll depth, and session duration) and aggregate technical information (browser family, operating system family, device type).

We have configured PostHog with the following privacy controls: client IP addresses are discarded at PostHog's ingest layer; geographic enrichment (city, postal code, region, country, latitude, longitude) is disabled at the project level via a paused GeoIP transformation and a property filter that strips any geo fields; the raw browser user agent string is stripped at ingest before storage; URLs sent to PostHog have any personal record identifiers (such as document IDs and account IDs) removed before transmission; and your analytics identifier is never linked to your Pantile account in any way. We have a signed Data Processing Agreement with PostHog that characterizes PostHog as our Service Provider under California Consumer Privacy Act section 1798.140(ag), not as a third party.

When you first visit our site, you will be asked whether you consent to analytics tracking. Analytics are only activated if you click "Accept." You can change your preference at any time by clearing your browser's local storage for our site, which will prompt the consent banner to appear again. You can also control cookies through your browser settings.

We honor your browser's privacy signals. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of analytics tracking in accordance with the California Consumer Privacy Act (CCPA). We also respect the Do Not Track (DNT) browser setting. When either signal is active, no analytics data is collected or transmitted to our analytics provider.

PostHog processes analytics data on our behalf. For more information about how PostHog handles data, please refer to PostHog's privacy policy at posthog.com/privacy.

Device Recognition

When you log in with multi-factor authentication, you may choose to "Remember this device." If you opt in, we store a small, randomly generated identifier as a cookie on your browser. This cookie contains no personal information. It allows our system to recognize your browser and skip the multi-factor authentication step on future logins for up to 30 days.

This cookie is:

• Only set when you explicitly check "Remember this device"
• Automatically deleted after 30 days
• Immediately invalidated if you change or reset your password
• Limited to the same browser type and operating system where it was created
• Not used for tracking, analytics, or advertising

You can remove this cookie at any time by clearing your browser's cookies, which will require multi-factor authentication on your next login.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our wealth management and financial advisory services
• Open and manage your investment accounts at Charles Schwab and Altruist
• Execute investment transactions and manage your portfolio
• Communicate with you about your account, performance, and financial planning
• Operate our client platform, including the dashboard, document management, and AI-powered tools
• Comply with legal, regulatory, and compliance obligations
• Detect and prevent fraud or unauthorized access
• Respond to your inquiries and provide customer support

3. How We Share Your Information

We do not sell your personal information. We may share your information only in the following limited circumstances:

Custodians (Charles Schwab and Altruist)

Your investment accounts are held at one or more third-party custodians: Charles Schwab & Co., Inc. and Altruist Financial LLC. We share necessary account and identity information with the custodian holding your account to open, maintain, and execute transactions in that account. Each custodian has its own privacy policy governing the information it receives.

PostHog (Analytics)

With your consent, we transmit anonymized usage data to PostHog, Inc., our analytics provider, to help us understand how visitors use our website and platform. PostHog acts as our Service Provider under California Consumer Privacy Act section 1798.140(ag) per a signed Data Processing Agreement, not as a third party. PostHog does not receive your name, contact information, financial information, IP address, geographic location, raw browser user agent, or any nonpublic personal information governed by SEC Regulation S-P. Analytics is opt-in: it only initializes if you accept on our cookie consent banner, and it does not initialize at all for users detected as California residents or for browsers sending the Global Privacy Control signal.

GoHighLevel (CRM)

We use GoHighLevel as our customer relationship management (CRM) platform to manage prospect and client communications, track inquiries, and coordinate outreach. Information such as your name, email address, phone number, and communication history may be stored in GoHighLevel. GoHighLevel processes this data on our behalf and is contractually obligated to protect it in accordance with applicable privacy standards.

Advisor Jetpack (Lead Generation)

We work with Advisor Jetpack, a lead generation service, to connect with individuals who have expressed interest in financial advisory services. When you submit your information through an Advisor Jetpack campaign or form, that information (including your name, email address, and phone number) is shared with Pantile Investments so that we may contact you about our services. By submitting your information through these campaigns, you consent to being contacted by Pantile Investments.

Legal and Regulatory Requirements

We may disclose your information when required by law, regulation, legal process, or governmental request, including to comply with SEC, FINRA, or state regulatory requirements.

With Your Consent

We may share your information with other third parties when you have given us explicit consent to do so, such as when connecting you with estate attorneys or CPAs through our Partner Network.

4. Data Security

We take the security of your personal information seriously. All client data stored in our systems is protected with end-to-end encryption. Our security practices are designed to comply with Regulation S-P and industry best practices, including:

• End-to-end encryption for all client data at rest and in transit
• Secure authentication with JWT-based session management
• Access controls limiting data access to authorized personnel
• Regular security assessments and monitoring

While we implement robust security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information using commercially reasonable safeguards.

5. Communications

We may communicate with you via email regarding your account, our services, and important updates. Email communications are opt-in services. We will only contact you if you have provided your consent.

Email

You may opt out of non-essential email communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us directly. Even if you opt out of marketing communications, we may still send you transactional messages related to your account, such as trade confirmations, regulatory notices, and security alerts.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We also retain information as necessary to comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. Financial records are retained in accordance with SEC and FINRA record-keeping requirements.

For analytics data collected through PostHog, we apply the following retention periods:

• Analytics data: retained for 1 year
• Session replay data: retained for 30 days

If analytics data is fully anonymized, these retention limits no longer apply.

7. Your Rights

Depending on your state of residence, you may have certain rights regarding your personal information, including:

• The right to access the personal information we hold about you
• The right to request correction of inaccurate information
• The right to request deletion of your information, subject to regulatory retention requirements
• The right to opt out of certain data sharing practices
• The right to opt out of analytics tracking via Global Privacy Control (GPC) or Do Not Track (DNT) browser signals, which we automatically honor

To exercise any of these rights, please contact us using the information below. We will respond to your request within the timeframe required by applicable law.

8. Children's Privacy

Our Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us and we will promptly delete such information.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by updating the "Last updated" date at the top of this policy and, where appropriate, provide additional notice through email or our platform.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: