Legal

Privacy Policy

Last updated: October 3, 2026

This policy explains what information AtlasVector ("we", "us") collects, how it is used, who processes it on our behalf, how long we keep it, and the rights and choices you have. We collect only what we need to run the Service, and we say so plainly.

1. What we collect

Account information — the email address and credentials you provide when you create an account (and, if you enable them, a phone number for one-time verification and an authenticator enrollment for two-factor security), used to authenticate you and secure your sessions, to check whether the free trial is available to you, and to keep it to one per person (section 7). Passwords are stored only in cryptographically hashed form.
Usage information — technical data such as pages viewed, features used, approximate region, device and browser type, and diagnostic logs, used to operate, secure, and improve the Service.
Content you enter — tickers you search, questions you ask, watchlists, notes, and preferences, used to return the results you request and remember your setup.
Waitlist and contact submissions — if you join a waitlist or ask to be notified about a feature, we store the email address supplied with the request, any name, organization, or notes you add, and the submitting connection's IP address and browser signature (used to reach you about what you asked for and to keep the form from being abused). These records are kept until the request is served or you ask us to delete them (section 8); once a request is marked served, a scheduled cleanup deletes the record.

The public portal can be browsed without an account. We do not ask for — and do not want — your brokerage credentials, government identifiers, or other sensitive personal data in order to browse the portal. The Service is not directed at children under 18, and we do not knowingly collect their data.

2. How we use it

To provide, maintain, and secure the Service and your account.
To personalize your experience (watchlists, recent searches, preferences).
To show who is on a shared desk. When you share a desk with other seats, they see the name on your account or, if you have not set one, the part of your email address before the @ — never the whole address — together with the screen you are viewing.
To monitor performance, detect and prevent abuse and fraud, and improve features.
To communicate with you about the Service — security notices, verification codes, and material changes. We do not send marketing email without your consent.
To comply with legal obligations.

3. What we do not do

We do not sell your personal information, and we do not share it with third parties for their own advertising.
We do not use your data to give you personalized investment advice — AtlasVector is a research platform and not an adviser.
We do not ask for or store real brokerage credentials.
We do not use your personal information, watchlists, portfolios, or activity to inform AtlasVector's own proprietary trading, to trade against you, or to front-run your interests. AtlasVector's proprietary strategies run on general market data and AtlasVector's own capital only — see the Disclaimer.

4. Who processes it

We share information only with the service providers that help us run AtlasVector — cloud hosting and infrastructure, content delivery, web-font delivery, identity/authentication, transactional email delivery, payment processing, and error/performance monitoring — and only as needed to operate the Service. These providers process data on our behalf under their own confidentiality and data-protection obligations. We may also disclose information with your consent, or where required by law, regulation, or valid legal process, or to protect the rights, safety, and integrity of the Service and its users. Questions you submit to AI features are processed by our AI infrastructure providers to generate the response; they are not used to build advertising profiles.

Payments. If you buy a subscription or start the free trial, checkout happens on our payment processor's own hosted page. The processor receives your email address and an internal account reference from us and, when you buy, the card details you enter there directly from you; the free trial asks for no payment details. It returns to us the subscription's status and dates, and its own references for you, for the checkout and for the subscription. Card numbers never touch our servers and we do not store them.

Fonts. The public site's typefaces are served by a web-font delivery provider. Your browser fetches the font files from that provider directly when a page first paints — before any consent prompt, because the page cannot render its text without them — so the provider sees your connection's IP address and browser signature for that request. It receives nothing else from us: no account, no page content, no identifier of yours.

The market-data sources behind the prices and fundamentals you see are not sub-processors: they send data to us and receive no personal information about you.

Sub-processor register and DPA. The current sub-processor register — each provider's role, the categories of personal data it processes, and where it processes them — and our data-processing agreement, which names each processor and the transfer mechanism executed with it, are available on request from [email protected]. Email the same address to be added to the change list: we give at least 30 days' notice before a new sub-processor begins processing personal data, so you have time to object.

5. International transfers

Our infrastructure providers may store or process data in countries other than your own. Where personal data leaves the EEA, the UK, or Switzerland, we transfer it only under a lawful transfer mechanism — an adequacy decision where one covers the destination, and otherwise the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. The mechanism that applies to each provider is named for that provider in the data-processing agreement described in section 4. By using the Service you acknowledge this processing.

6. Cookies & local storage

We use cookies and browser storage to keep you signed in, remember preferences, and understand aggregate usage. The public site keeps an anonymous per-tab identifier in session storage to count page views first-party; it is not tied to an account, is not sent when your browser signals Do Not Track or Global Privacy Control, and no IP address is stored with it. We keep that count on the basis of our legitimate interest in understanding aggregate use of the public site (GDPR Article 6(1)(f)); the balance rests on the facts just stated — no identifier tied to an account, no IP address, and no third party receives it. Each count carries the page path you opened (with the ticker in the link, where the link carried one) and, on the first page of a visit only, the host name of the site you came from — example.com, never the full address you were on, and only when that host is not the one you are reading. Nothing else about your browser is sent or kept. We do not run third-party advertising trackers. You can control cookies through your browser settings; disabling them may limit some features (for example, staying signed in).

7. Security & retention

We use reasonable technical and organizational measures to protect your information — encryption in transit, hashed credentials, scoped access, and audit logging. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

We keep each class of personal information only as long as we need it:

Account information and the content tied to your account — kept for as long as your account is open. When your account is deleted (on your request), the account record and sign-in identity are removed together with the records linked to it — sessions, verification codes, the subscription record, paper-trading accounts with their orders, positions and fills, watchlists, alerts, saved documents, chat threads, notebooks, strategies and backtests.
Operational records of your activity — some records your use produced, such as command history and agent working memory, are not removed by account deletion today. They are keyed to an internal account identifier that no longer resolves to your name or email once the account record is gone, and we delete them on request (section 8), except where we must keep a record to meet a legal obligation or resolve a dispute.
Free-trial record — when your free trial starts we keep a one-way keyed hash of your account's email address and, where the account has one, of its verified phone number, with the date the trial started (the day only, in UTC, not the time), used only to keep the trial to one per person. It is kept, linked to your account by an internal identifier, for as long as the account exists; if the account is deleted, it is kept without that link until 24 months from the day the trial started, and the same scheduled cleanup then deletes it.
Instructions to the payment processor — when the Service tells the payment processor to end a subscription or to stop it renewing (for example, a free trial replaced by a purchase), it keeps a record of that instruction, naming only the processor's reference for the subscription, so that a failed send can be retried. The same scheduled cleanup deletes the record 30 days after it is carried out, or 90 days after it was last made if it never can be.
Sign-in sessions — a session expires 30 days after sign-in and is destroyed as soon as you sign out. A scheduled cleanup also deletes expired session records from our systems.
Email and phone verification codes, and the emailed step-up code — 15 minutes, after which the code is no longer usable; the same scheduled cleanup deletes expired code records.
Page-view events on the public site — recorded with a per-tab identifier and the referring site, never an IP address or your name; kept 90 days, after which the same scheduled cleanup deletes them. Conversion records tied to an account (a checkout started, a seat opened) are account records and go with the account.
Usage and diagnostic logs — kept for the shortest period that still lets us investigate a security or reliability incident — we publish that criterion rather than a fixed number we do not yet enforce automatically.

8. Your rights & choices

You can access and update your account information in the app. You may also request a copy of your personal information, ask us to correct or delete it, or object to or restrict certain processing, subject to legal limits. While signed in you can download that copy yourself — Settings → Your data → Download my data — as one file holding every record keyed to your account (credential material and payment references are withheld and the file lists which columns were held back); a request by email is served from the same export. If your account predates mandatory two-factor security and has not yet enrolled an authenticator, we send a 6-digit code to the account's email address and ask you to enter it before releasing the copy — proof that the mailbox is still yours, so that a stolen password alone cannot take your data out. Depending on where you live (for example, the EU/EEA, UK, Australia, or California), you may have additional statutory rights, including the right to lodge a complaint with your local data-protection authority. To exercise any right, contact [email protected] — we will respond within the timeframe required by applicable law.

9. Changes

We may update this policy as the Service evolves. Material changes will be reflected on this page with an updated date, and where required by law we will notify you.

Contact

Privacy questions or requests: [email protected].