Privacy Policy

1. Information We Collect

1.1. Information You Provide

• Account information: name, email address, password (stored only as a hash), and optional profile details such as a display name, avatar and time zone.
• Two-factor authentication: if you enable it, an encrypted authenticator secret and hashed recovery codes.
• Bots and watchlists: the strategies, component settings, risk limits and symbol lists you save.
• Forward tests: for each forward test you start, a copy of the bot as it was at the start, the symbols, timeframe, data provider and settings you chose, and its latest simulated result. For some forward tests we also store the price bars the test has used (Section 5).
• Export records: which bot you exported, to which target and version, and when. We do not keep a copy of the exported file.
• API keys you choose to store: keys for market-data providers and AI model providers, stored encrypted (Section 3).
• Billing: your plan, subscription status and a Stripe customer reference, and the token packs you buy. Card details are collected and held by Stripe, not by us. If you cancel, any reason you choose to give.
• Communications: messages you send through the contact form or to support.

1.2. Information Collected Automatically

• Product analytics: pages visited, the kind of referrer (direct, search, social or other) and which features are used. Our analytics are first-party. Visits are grouped by a session identifier derived from your IP address and browser with a salt that changes daily; the raw IP address and browser string are not stored for analytics.
• Sign-up source: if you allowed analytics cookies and arrived from a link carrying campaign tags (such as an advertisement), we keep those tags, the page you first landed on and the name of the referring website, and store them with your account when you sign up. We use them to tell which campaigns bring people who go on to use the Platform. We do not use advertising pixels or share this with advertising networks.
• Security logs: sign-in attempts and other account security events, including the IP address and browser string used.
• Agreement records: which version of each legal document you accepted, when, and the IP address and browser used, so there is a record of what you agreed to.
• Server logs: request logs, error reports and performance metrics.
• Browser storage: the Platform stores your session, unsaved builder drafts, dashboard layout and preferences in your browser. See the Cookie Policy.

1.3. What We Do Not Collect

• Brokerage or exchange credentials, balances, positions or order history.
• The results of your own trading with exported code, which runs outside the Platform.

2. How We Use Your Information

• Providing the Platform: saving your bots, running backtests and producing exports.
• Fetching the market data a backtest or forward test needs, from the provider you choose for it. We do not switch to a different provider without telling you.
• Authenticating you and protecting your account.
• Processing payments and managing your subscription.
• Sending account, security and service emails.
• Providing support and responding to messages.
• Detecting and preventing fraud, abuse and security threats.
• Understanding how the Platform is used, in aggregate, so we can improve it.
• Complying with legal obligations.

3. How We Protect Your Information

• Stored API keys: encrypted at rest with authenticated encryption (Fernet: AES-128 in CBC mode, authenticated with HMAC-SHA256). Keys are decrypted only in memory when fetching data or calling the provider you chose, and are never logged or returned to your browser after saving.
• Passwords: stored only as salted hashes.
• Data in transit: encrypted with TLS.
• Access controls: access to production systems is restricted to people who need it.

4. Information Sharing and Disclosure

We share information only in these circumstances:

• Service providers: companies that operate parts of the Platform for us, under confidentiality obligations: cloud hosting, payment processing (Stripe) and email delivery.
• Providers you choose: when you run a backtest or a forward test, the symbols and dates it needs are sent to the market-data provider you chose for it, with your key if it needs one. When a feature you use calls an AI model with a key you stored, your request is sent to that provider.
• Neural Core and Neuro_Core: both run on our model account and are paid for in Neural tokens. Your messages, and for Neuro_Core a summary of the bot on your canvas, pass through our servers to our AI provider (Anthropic) to be answered. We do not store the messages; we keep a record of the tokens each one used, which is how your balance is calculated. Neither feature asks for or keeps an AI key of yours.
• Legal requirements: when required by law, subpoena, court order or governmental request, or to protect our rights and users.
• Business transfers: in connection with a merger, acquisition or sale of assets.
• With your consent.

5. Data Retention

6. Your Rights

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and personal information, subject to legal retention requirements. You can delete your account yourself from Settings → Profile; it takes effect immediately.
• Port your data in a machine-readable format.
• Opt out of non-essential communications.

To exercise any of these rights, contact: privacy@argixlabs.com

7. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information is collected, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those laws define it, and we will not discriminate against you for exercising your rights.

8. Children’s Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

9. International Data Transfers

If you are located outside the United States, your information may be transferred to and processed in the United States and in other countries where our service providers operate.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notification at least 30 days before they take effect for existing accounts.

11. Contact

For privacy-related inquiries: privacy@argixlabs.com