Privacy Policy

1.Information We Collect

We collect the following categories of information:

Account Information

• Email address
• Display name (your chosen trading alias)
• Hashed password (we never store plaintext passwords)
• Subscription tier and billing information

Trading Activity

• Agent allocations and configuration preferences
• Trade history (entries, exits, P&L, timestamps)
• Portfolio snapshots and performance metrics
• Leaderboard rankings and season participation

Waitlist & Marketing

• Email address (if you sign up for our waitlist or early access notifications)
• Signup source (which page you signed up from)
• Timestamp of signup

Usage Data

• Pages visited and features used
• Device type and browser information
• IP address and approximate location
• Timestamps of access

2.How We Use Your Information

• Provide, maintain, and improve the Platform
• Execute trading strategies on your behalf (paper and live modes)
• Calculate performance metrics, portfolio analytics, and leaderboard rankings
• Communicate important updates about your account or the service
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations

3.Exchange API Credentials

When you connect an exchange account for live trading, we handle your API credentials with the highest level of security:

• API keys are encrypted using per-user Fernet symmetric encryption keys derived from a master key
• Credentials are never stored in plaintext — they are encrypted immediately upon receipt
• Decryption occurs only at the moment of trade execution and keys are not held in memory
• Each user’s encryption key is unique, derived from their user ID via HMAC-SHA256
• We never share your API credentials with any third party
• We recommend configuring API keys with trade-only permissions and disabling withdrawals

4.Data Sharing

We do not sell your personal information. We may share data only in the following circumstances:

• Infrastructure providers: Cloud hosting, database, and caching services necessary to operate the Platform
• Payment processors: Stripe for subscription billing (we do not store credit card details)
• Legal requirements: When required by law, regulation, or valid legal process
• Leaderboard: Your display name and aggregated trading performance may appear publicly on the leaderboard

5.Data Retention

• Account data is retained while your account is active
• Trade history and performance data are retained for up to 2 years after account deletion
• Exchange API credentials are deleted immediately upon disconnection or account deletion
• Usage logs are retained for up to 90 days

6.Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt with salt
• API credentials are encrypted with Fernet (AES-128-CBC) using per-user derived keys
• All data in transit is protected by TLS/HTTPS
• JWT-based authentication with short-lived access tokens (15 minutes) and refresh tokens
• Database access is restricted and monitored

While we strive to protect your data, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

8.Cookies & Local Storage

We use minimal browser storage for essential functionality:

• JWT access and refresh tokens stored in localStorage for authentication
• No third-party tracking cookies
• No advertising cookies or pixel trackers

For more details, see our Cookie Policy.

9.Children’s Privacy

The Platform is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will take steps to delete that information promptly.

10.Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Platform services you have requested (account management, trade execution, performance tracking)
• Legitimate Interests: Processing for platform security, fraud prevention, service improvement, and analytics — balanced against your privacy rights
• Consent: Where you have given explicit consent, such as signing up for our waitlist or marketing communications. You may withdraw consent at any time
• Legal Obligation: Processing necessary to comply with applicable laws and regulations

11.Automated Decision-Making

Our Platform uses AI-powered trading agents that make automated trading decisions. You should be aware that:

• Trading agents use algorithmic strategies (including AI/LLM models) to generate buy/sell signals without human intervention
• In paper trading mode, automated decisions result in simulated trades with no financial impact
• In live trading mode, automated decisions result in real market orders executed on your exchange account using your funds
• You have the right to stop any automated trading at any time by pausing or deleting your allocations
• You can request human review of how any particular trading decision was made by contacting us

Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Since you voluntarily opt into automated trading and can disable it at any time, your continued use constitutes explicit consent to automated decision-making in this context.

12.International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. Our infrastructure is hosted on cloud services that may store data in the United States, European Union, or other jurisdictions. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all infrastructure providers
• Encryption of data in transit and at rest
• Access controls limiting who can view personal data

13.Your Rights — EEA/UK (GDPR)

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (“right to be forgotten”)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw any previously given consent at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise any of these rights, contact us at privacy@agentleague.io. We will respond within 30 days.

14.Your Rights — California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the “sale” or “sharing” of personal information. Note: we do not sell your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Correct: Request correction of inaccurate personal information

To exercise these rights, contact us at privacy@agentleague.io. We will verify your identity before processing your request. We will respond within 45 days as required by law.

15.Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you by updating the “Last Updated” date and, where appropriate, through in-app notifications. Continued use of the Platform after changes constitutes acceptance.

16.Contact

For privacy-related questions or requests, contact us at privacy@agentleague.io.