Privacy Policy

This Privacy Policy explains how Optiqal LLC, a Delaware limited liability company ("Optiqal," "we," "us"), collects, uses, discloses, and safeguards information when you use our website, applications, and services (the "Service"). Optiqal LLC is the controller of the personal information described here.

This policy forms part of our Terms of Service. By using the Service you acknowledge the practices described here. If you do not agree with them, do not use the Service.

Contact us about anything in this policy, including any privacy request, at info@optiqal.io.

Account information: your email address, username or display name, hashed password, authentication tokens and sign-in method, account status, and subscription tier.

Billing information: we do not receive or store full card numbers. Our payment processor (Stripe) processes payments and returns to us a customer and subscription identifier, plan, status, billing period, the last four digits and brand of your card, a card fingerprint used to enforce one-trial-per-payment-method, and refund, dispute, and discount records.

Trading and automation information: the venues you connect, your public wallet and execution addresses, your automation settings (stake size, price bounds, daily cap, open-position limit, model filters, armed or paused state), every order the Service attempts on your behalf and every skip with its reason, fills, exits, settlements, and profit and loss records.

Venue credentials: where you enroll one, an API key or the private key of a dedicated automation wallet. These are encrypted before storage using authenticated envelope encryption bound to your account, are never logged or echoed back, and are used only to carry out the instructions you configure. Where the Service supports it you can export the key to your device and request deletion of our copy.

Location information: your approximate location derived from your IP address and, where a venue restricts access by region, the result of an eligibility check performed from your own browser connection, stored with a country, region, and timestamp. See "Location Information" below.

Usage and device data: pages viewed, referrer, features used, timestamps, session and interaction events, approximate location from your IP, device type, browser, operating system, screen size, and language.

Communications and content: messages you send us, support and feedback submissions, survey responses, posts you make in community features such as the Trade Floor chat, and your mobile number if you opt in to SMS.

Referral and marketing data: referral links and codes you use or generate, attribution identifiers set by our referral provider (FirstPromoter), UTM campaign parameters, email engagement, and, if you link it, your Discord account identifier and username.

Directly from you, when you register, subscribe, configure automation, enroll a credential, post, contact us, or opt in to messages.

Automatically from your device and browser as you use the Service, including through cookies and similar technologies.

From service providers acting for us, including our payment processor, messaging provider, referral provider, hosting and analytics providers, and advertising platforms.

From public blockchains and third-party venues, including on-chain transactions, balances, and positions associated with addresses you connect. Blockchain data is public and permanent, and we do not control it.

To provide and operate the Service, including authenticating you, delivering model outputs, processing subscriptions, and carrying out the automation instructions you configure.

To place, monitor, reconcile, exit, and record orders and positions at venues you connect, and to prepare and maintain the wallets and approvals that make those operations possible.

To enforce eligibility, including age, subscription status, sanctions and restricted-party screening, and venue geographic restrictions.

To communicate with you about your account, transactions, security, service changes, and support, and to send marketing where permitted and you have not opted out.

To measure, secure, debug, and improve the Service, including analytics on how features are used and on the accuracy and calibration of our models.

To detect, investigate, and prevent fraud, abuse, referral manipulation, trial abuse, multi-accounting, security incidents, and violations of our Terms.

To advertise and grow, including measuring campaign performance and building audiences for advertising, as described under "Cookies, Analytics, and Advertising."

To comply with legal obligations, respond to lawful requests, establish or defend legal claims, and enforce our agreements.

We do not use your personal information to make decisions producing legal or similarly significant effects about you without human involvement, and we do not sell personal information for money.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on these bases: performance of our contract with you, for account, subscription, and automation functions you request; our legitimate interests, for security, fraud prevention, service improvement, analytics, and direct marketing to existing customers, balanced against your rights; your consent, for optional SMS messages, non-essential cookies, and advertising, which you may withdraw at any time; and compliance with legal obligations, for tax, accounting, sanctions, and lawful requests.

Where we rely on consent, withdrawing it does not affect processing carried out before withdrawal.

Wallet addresses you connect, and the addresses we provision for automation, are recorded against your account so we can place and reconcile your orders and show you your activity.

Transactions made from those addresses are recorded on public blockchains. Blockchain records are public, permanent, and outside our control: they cannot be edited, redacted, or deleted by us or by you, and anyone can inspect them. An address can be linked to you by third parties through analysis we do not perform and cannot prevent.

Encrypted venue credentials are accessible only to the systems that place, exit, and reconcile your orders. Access is limited to the personnel who operate those systems. We will never ask you for a seed phrase, and you should never provide us a credential with withdrawal authority or the key to your primary wallet.

You may revoke an enrolled credential at any time in your account settings, which deletes our stored copy and disarms that venue. Records of orders already placed are retained as described under "Data Retention."

We derive an approximate location (country and region) from your IP address for analytics, security, and eligibility purposes. We do not collect precise GPS location.

Where a trading venue restricts access by region, arming automation for that venue performs an eligibility check from your own browser connection. We record the result, the country and region reported, and the time of the check, and we re-require the check when it expires. This record exists so that we can decline to act where a venue would decline, and it is used for no other purpose.

We do not use location data to help you circumvent any venue restriction, and we do not assert a location on your behalf.

Essential cookies keep you signed in, secure the Service, remember your plan or offer selection, and prevent abuse. These cannot be turned off within the Service.

First-party analytics: we record pageviews on our own servers. To count returning visitors without identifying them, your IP address and user agent are combined with a secret and a date into a one-way hash that changes every day; the raw IP address is not stored, and full query strings are not stored. This data stays with us and our hosting provider.

Referral attribution: our referral provider (FirstPromoter) sets a cookie so a subscription can be credited to the promoter who referred you.

Advertising: where enabled, we use the Meta (Facebook) pixel to measure ad performance and to build audiences. The pixel sends Meta your IP address, browser and device information, the pages you view on our site, and conversion events such as starting a trial. Meta may combine that with information it already holds about you. This is a disclosure of personal information to an advertising partner for cross-context behavioral advertising.

Your controls: you can block or delete cookies in your browser, and use tracker-blocking extensions; essential cookies are required for the Service to function. WE HONOR THE GLOBAL PRIVACY CONTROL (GPC) SIGNAL: if your browser or extension transmits GPC, we do not load the advertising pixel for that session and treat it as an opt-out of sharing for cross-context behavioral advertising. You can also opt out by emailing info@optiqal.io, and you can adjust ad settings in your Meta account.

We do not sell your personal information for money, and we do not share your mobile number or SMS opt-in consent with anyone for their own marketing.

Service providers who process information on our behalf under contract and only on our instructions: hosting and databases, payment processing (Stripe), email delivery, SMS delivery (Twilio), referral tracking (FirstPromoter), error monitoring, and analytics.

Trading venues and blockchain networks, when you connect a venue or when automation acts for you. What reaches a venue is what it needs to accept your order under your own credential. Blockchain transactions are public by design.

Advertising partners, as described above, for measurement and audience building.

Community platforms, if you choose to link a Discord account or post in a community feature, in which case your display name and posts are visible to other participants.

Legal and safety: we may disclose information where required by law, subpoena, court order, or regulator request, or where we reasonably believe disclosure is necessary to investigate suspected fraud or abuse, protect the rights, property, or safety of Optiqal, our users, or others, enforce our Terms, comply with sanctions obligations, or establish or defend legal claims.

Corporate transactions: in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of the transaction, subject to this policy or a successor policy with materially equivalent protections.

Aggregated or de-identified information that cannot reasonably identify you may be shared for any purpose. We do not attempt to re-identify it.

This section applies to California residents under the California Consumer Privacy Act as amended by the CPRA.

Categories we have collected in the last twelve months: identifiers (email, username, IP address, account and device identifiers, wallet addresses); customer records and commercial information (subscription, billing, transaction, trading, and payout records); internet and network activity (pages viewed, features used, interactions); approximate geolocation; audio, electronic, and visual information in the sense of messages and posts you submit; inferences drawn for product and audience purposes; and, where you enroll one, a venue credential, which we treat as sensitive and encrypt at rest. We collect these for the business and commercial purposes described under "How We Use Information," from the sources described under "Where the Information Comes From," and retain them as described under "Data Retention."

We do not sell personal information for monetary consideration. We do share personal information for cross-context behavioral advertising, specifically the identifiers, device and network activity, and conversion events transmitted by the advertising pixel described above. We do not knowingly sell or share the personal information of anyone under 16.

Sensitive personal information: we use account credentials and enrolled venue credentials only to provide the Service and secure your account, which are purposes for which the right to limit use does not apply. We do not use sensitive personal information to infer characteristics about you.

Your rights: to know the categories and specific pieces of personal information we hold and how we use and disclose them; to delete personal information, subject to exceptions such as completing transactions, security, and legal compliance; to correct inaccurate personal information; to opt out of sharing for cross-context behavioral advertising; and to be free from discrimination for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

How to exercise them: email info@optiqal.io from the address on your account, or send us the details we need to verify you. To opt out of sharing for advertising, transmit a Global Privacy Control signal, which we honor, or email us. An authorized agent may submit a request on your behalf with written permission and proof of identity. We respond within the time the law allows, and you may appeal a refusal by replying to our response.

If you are a resident of a state with a comprehensive privacy law, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect, you have rights to confirm whether we process your personal data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling.

Exercise these rights by emailing info@optiqal.io, or by transmitting a Global Privacy Control signal to opt out of targeted advertising. We do not use your personal data for profiling that produces legal or similarly significant effects. Where your state provides an appeal process, you may appeal our decision by replying to our response, and you may contact your state attorney general if you are not satisfied.

If you are in the EEA, UK, or Switzerland you have rights to access, rectify, erase, restrict, and object to processing, to data portability, to withdraw consent, and to object to direct marketing at any time. Exercise them by emailing info@optiqal.io. You also have the right to lodge a complaint with your local supervisory authority.

Optiqal operates in the United States and your information is processed and stored there. The United States may not provide the same level of data protection as your country. Where we transfer personal information out of the EEA or UK we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum with our service providers, or on a derogation such as necessity for the performance of our contract with you.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy enquiries are handled at info@optiqal.io.

Account, subscription, and billing records: for the life of your account and then for as long as needed for tax, accounting, audit, and legal purposes, generally at least seven years for financial records.

Trading, order, exit, settlement, and skip records, and terms-assent records: retained after account closure as evidence of what was authorized and what happened, for as long as a related claim could be brought and any applicable limitation period runs.

Venue credentials: deleted when you revoke the credential, when your account is closed, or when you export a key to your device and confirm storage, whichever comes first.

Location eligibility checks: retained while valid and then as a historical record of the checks performed.

Analytics and pageview data: retained in identifiable-by-hash form for a limited period and thereafter kept only in aggregate. Daily-rotating visitor hashes cannot be reversed to an IP address.

Community posts: retained while the feature operates; deleted posts are soft-deleted and retained for moderation audit before removal.

Marketing and suppression records: retained until you unsubscribe, and thereafter a minimal record of your opt-out so we can continue to honor it.

We delete or de-identify information when it is no longer needed for these purposes.

We use industry-standard measures including TLS in transit, encryption at rest for venue credentials using authenticated envelope encryption with per-record keys under a master key held only in server environment configuration, hashed passwords, access controls, rate limiting, and audit logging of money-moving actions.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, devices, wallets, and keys, and for activity under your account.

If a breach affects your personal information we will notify you and any regulator as required by applicable law. Report a suspected security issue to info@optiqal.io.

Access and update your account information at any time in account settings, and request a copy of your personal data by emailing info@optiqal.io.

Request deletion of your account and associated data. Some data is retained where the law allows or requires, including transaction, tax, security, and dispute records as described under "Data Retention."

Opt out of marketing email using the unsubscribe link in any message. Service and transactional messages about your account, billing, and security are not marketing and continue while your account is open.

Turn off SMS Alerts in account settings or reply STOP to any message.

Disconnect Discord, revoke a venue credential, or disarm automation at any time in account settings.

If you opt in to our SMS text message program ("Optiqal Alerts"), we collect your mobile phone number and your consent to receive texts. We use them only to send the messages you opted in to receive, such as account notifications, verification codes, and prediction alerts.

We do not share your mobile number or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. We share your number only with our messaging provider (Twilio) solely to deliver these messages on our behalf.

You can opt out at any time by replying STOP to any message or by turning off SMS Alerts in your account settings. Message and data rates may apply, and message frequency varies.

Posts you make in community features such as the Trade Floor chat are visible to other participants and to our moderators, together with the display name shown with them. Do not post anything you consider private, and do not post other people's personal information.

We retain posts, including soft-deleted ones, for moderation and audit, and may remove content or restrict accounts as described in our Terms of Service.

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18.

If we learn that we have collected personal information from a person under 18, we will delete it and close the account promptly. If you believe a minor has provided us information, contact info@optiqal.io.

We may update this policy to reflect changes in our practices or for legal, operational, or regulatory reasons.

We will post the updated policy here and change the "Last updated" date, and will give additional notice through the Service or by email where the change is material. Your continued use after the change takes effect constitutes acceptance.

Optiqal LLC, a Delaware limited liability company. For any question or request about this policy or your personal information, including access, correction, deletion, portability, opt-out, or appeal, contact info@optiqal.io, or use the contact form on the website.

Please email from the address on your account, or include enough detail for us to verify you, so we can act on your request securely.