NeuroTrader Privacy Policy

For the purposes of applicable data protection laws (in particular, the General Data Protection Regulation (EU) 2016/679 ("GDPR")), your data will be controlled by Arileus Intelligence Systems, LLC, which provides the Platform to you as a Controller of your personal data.

Arileus Intelligence Systems, LLC operates NeuroTrader, an AI-driven cryptocurrency trading platform that provides paper (simulated) trading and controlled live-trading tools. The Platform enables users to connect their own supported exchange accounts on a trade-only basis and to execute user-approved trades. NeuroTrader does not custody customer assets.

• Registered name: Arileus Intelligence Systems, LLC
• Registered address: United States (Florida)
• General contact address: https://app.neurotraderai.com/support
• Privacy support: privacy@neurotraderai.com
• Data Protection Officer (DPO): not appointed, as one is not required for our processing activities — contact privacy@neurotraderai.com for all privacy matters
• EU/EEA representative (Article 27 GDPR): not applicable — the Services are not offered to, and accounts cannot be registered from, the European Economic Area

Please read this Privacy Policy and our Terms and Conditions carefully before using the Services. If you do not agree with the Terms, you should not use the Services.

If we are required by law to collect personal data, or if it is necessary to process your requests or fulfill a contract with you, and you do not provide the requested data, we may be unable to carry out your instructions or meet our contractual obligations. In such cases, we may need to terminate our engagement or the contract, but we will inform you of this decision at that time.

If you have any questions about how we protect or use your data, please email us at privacy@neurotraderai.com.

As a controller, we obtain personal data from the following sources:

• Directly from you — for example, when you register a User account, complete your profile, connect your own supported exchange account on a trade-only basis, set your trading preferences, purchase a subscription, contact our customer support, or exercise your data subject rights
• Automatically through your use of our Services — for example, through cookies and analytics that record information about your use of the Website and App, as well as device and browser information, IP address, and login history
• Third-party sources — market-data providers, public blockchain data, and open-source market data. This information is primarily non-personal market data; where it includes identifiers such as public wallet addresses that can be linked to you, it may constitute personal data. Our payment and other service providers may also return limited confirmation data (for example, payment status) in connection with your subscription

We process personal data for the following purposes:

• Account management & authentication — to register, facilitate, and manage your User account and to authenticate you
• Service delivery — to provide the Services, including paper (simulated) trading and controlled live trading, to enable connection of your own supported exchange account on a trade-only basis, and to execute trades that you have approved
• Billing & subscription management — to manage subscriptions and process payments via third-party payment providers
• Communication (service-related) — to contact you about Service matters, including availability, security, payment processing, and changes to this Privacy Policy
• Customer & user support — to respond to your queries or issues, provide support, and help you exercise your rights
• Security — to ensure the security, access control, and integrity of the Platform
• Fraud prevention — to detect, prevent, and respond to fraudulent, unauthorized, or unlawful activity
• Platform monitoring — to monitor the availability, performance, and proper functioning of the Platform
• Product improvement & development — to understand how the Services are used and to measure and improve their performance and functionality
• Marketing communications (opt-in) — to send you limited marketing, onboarding, and user-engagement communications where you have opted in; we do not carry out behavioural advertising based on sensitive personal information
• Compliance with legal and regulatory requirements — such as maintaining accurate records for accounting or tax purposes, responding to lawful requests from authorities, and consent management
• Defending or resolving legal claims — to establish, exercise, or defend legal claims, and to resolve disputes, investigations, or regulatory inquiries

We do not sell personal data under any circumstances. Personal information collected is used solely for the purposes described in this Policy and in accordance with applicable data protection laws. Any sharing of personal data with third parties occurs only where necessary to provide our Services, comply with legal obligations, or with your explicit consent.

We may collect and process the following categories of personal data about you:

• Account data — first name, last name, email address, and an automatically assigned User ID (contract performance, Art. 6(1)(b) GDPR)
• Authentication data — your password, stored only as an irreversible salted hash; we cannot read or recover your plaintext password (contract performance)
• Exchange connection data — exchange API credentials that you connect on a trade-only basis, stored in encrypted form; these credentials do not permit withdrawals (contract performance; legitimate interests for security)
• Trading activity data — trading preferences, paper-trading activity, and records of user-approved trades and related decision history (contract performance)
• Financial data — subscription and billing information; payment card details are handled by our third-party payment provider (contract performance; legal obligation)
• Technical data — IP address, device and browser information, cookie identifiers, login history, and logs (legitimate interests; consent for non-essential cookies)
• Aggregated analytics — statistical information about Website and Platform usage, feature usage, interaction counts, and performance metrics (legitimate interests)
• Support communications data — the type and content of your request and any files you attach (contract performance)
• Marketing data — email address and marketing preferences, used for opt-in marketing and engagement communications (consent, Art. 6(1)(a) GDPR)
• Compliance information — consent records, data subject request records, and tax or accounting records (legal obligation, Art. 6(1)(c) GDPR)
• Legal and administrative records — correspondence related to disputes, claim details, and internal investigation notes (legitimate interests, Art. 6(1)(f) GDPR)

NeuroTrader uses "cookies" — small text files stored on your computer or mobile device by our website's server — and other limited tracking technologies to ensure the Platform functions properly and to enhance your user experience.

Certain cookies and similar technologies are essential to enable performance of the Platform and are processed on the legal basis of contract performance and legitimate interests (Article 6(1)(b) and Article 6(1)(f) GDPR). Other cookies and tracking tools, including analytics cookies, are used based on your consent (Article 6(1)(a) GDPR).

You should read our Cookie Policy at https://app.neurotraderai.com/legal/cookies to understand what cookies are, the types of cookies we use, the information we collect using cookies and how it is used, and how to control your cookie preferences.

According to Article 22 of the GDPR, the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

The Platform provides AI-generated market analysis and risk-governance tools, and offers three operating modes that determine how live orders are transmitted: (a) AI Auto — you review and approve a Trading Policy in advance, after which individual orders within that policy may be transmitted to your connected exchange without separate per-order approval; (b) AI Assist — each individual order requires your explicit approval before it is transmitted; and (c) AI Manual — no orders are transmitted by the Platform.

In every mode, automation operates only within the limits, assets, and risk parameters that you have configured and approved, you can suspend it at any time (including via kill-switch controls), and you remain in control of your account and trading activity. NeuroTrader does NOT make any decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them within the meaning of Article 22 GDPR; any automated order transmission occurs only under a Trading Policy that you have expressly reviewed and approved.

Personal data may be shared in the following circumstances:

• Corporate transaction — in the event of a potential or actual merger, acquisition, reorganization, sale of assets, or insolvency proceeding, only to the extent necessary and subject to appropriate confidentiality and data protection safeguards
• Compliance with the laws — where necessary to comply with legal obligations, including tax reporting, investigating illegal activity or fraud, and responding to valid legal requests such as court orders or subpoenas
• To establish or exercise our legal rights — to defend against legal claims
• Protection and safety — where necessary to protect vital interests, including emergency situations
• Connected exchanges — where you connect your own supported exchange account and approve a trade (or a Trading Policy in AI Auto mode), the relevant trade instruction is transmitted to that exchange so it can be executed; the exchange acts as an independent controller under its own terms and privacy policy
• Service providers — Stripe (payment processing); SendGrid (transactional and email communications); Amazon Web Services (cloud hosting and storage); Cloudflare (content delivery and security); OpenAI (AI-assisted features); Google Analytics 4 (usage analytics — configured for first-party measurement only, with Google Signals and ads personalization disabled); 1Password (credential management)
• With your consent — where you explicitly consent, we may share your personal data with third parties of your choosing

NeuroTrader is a global business. We may transfer personal data to countries other than the one in which you reside, which may not have the same data protection level. In particular, to provide the Services we may transfer personal data to the United States, where the Company is established, and to other locations where our service providers operate.

Where we transfer personal data originating from jurisdictions with transfer restrictions to countries not deemed adequate under applicable data protection laws, we deploy appropriate safeguards, including adequacy decisions (such as the EU–US Data Privacy Framework), Standard Contractual Clauses supported by transfer impact assessments where required, or specific derogations under applicable law. Please contact us if you want further information on the specific mechanism used.

NeuroTrader implements data deletion and retention procedures to respect user privacy and comply with applicable data protection regulations, including the right to erasure. Users may delete their accounts at any time and may opt out of marketing communications.

We will retain personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. We will store your account-related data for 3 (three) years from your last use of the Services. Even if you close your account, we will retain certain data to meet our legal, security, and fraud-prevention obligations. Specific retention periods:

• Account data — retained for the duration of your account activity
• Authentication data — retained for the duration of your account activity
• Exchange connection data — retained for the duration of your account activity, or until you disconnect the exchange
• Trading activity data — retained for 5 (five) years from the relevant trade or decision (decision history may be retained for the same period for security and audit purposes)
• Financial data — retained for the duration of the purpose and 7 (seven) years to comply with tax, accounting, and auditing requirements
• Technical data — depending on the type of cookie, retention periods may vary up to 12–24 months, after which the data is anonymized or deleted (see our Cookie Policy)
• Aggregated analytics — retained for up to 14 (fourteen) months for performance monitoring and improvement
• Support communications data — retained as long as necessary to provide support or to defend against legal claims
• Marketing data — retained until you withdraw consent or unsubscribe, and in any event no longer than 12 (twelve) months after your last interaction with our marketing communications
• Compliance information — retained as long as necessary to fulfill legal obligations
• Legal and administrative records — 5 (five) years, or such longer period as is relevant to establish, exercise, or defend legal claims within applicable limitation periods

We implement a set of technical and organizational security measures to ensure the confidentiality, integrity, and availability of personal data, including:

• Encryption in transit and at rest — personal data is encrypted in transit and at rest; passwords are stored only as irreversible salted hashes; exchange API credentials are stored in encrypted form
• Trade-only exchange API keys — exchange connections are limited to trade-only permissions and do not allow withdrawals
• Secure credential storage — credentials are stored securely with limited exposure, applying data minimization
• Multi-factor authentication — available where supported
• Role-based access control — access is restricted according to roles and responsibilities
• Audit logging and monitoring — access and administrative actions are logged, and the Platform is monitored for security and availability
• Operational safeguards — decision history and risk-governance controls (the Risk Governor) support the safe operation of the Platform
• Security testing — we carry out security assessments and independent security testing

If any of the personal data that you have provided to us changes — for example, if you change your email address, or if you become aware that we have any inaccurate personal data about you — please let us know by sending an email to privacy@neurotraderai.com. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient, or incomplete personal data that you provide to us.

The Services are intended for adults only. The minimum age to use the Platform is 18 (eighteen) years old, and NeuroTrader does not knowingly collect any personal data from persons under 18 years of age. If you believe we have inadvertently collected such information, please contact us so we can promptly remove it. If we learn that we have received information from a person under 18, we will use that information only to respond directly to that person (or their parent or legal guardian) to inform them that they cannot use the Services, and we will subsequently delete that information.

Under applicable data protection law, you may request that we take the following actions in relation to the personal data we hold about you:

• Opt-out — opt out of processing based on your consent, including marketing communications, at any time
• Access — obtain details about how we process your personal information and access to it
• Portability — receive your personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transferred to another controller
• Correct — update or correct any inaccuracies in your personal data
• Delete — request the deletion of your personal data, subject to legal exceptions such as compliance with legal obligations or the defense of legal claims
• Restrict — request the restriction of processing in certain situations
• Object — object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing

We reserve the right to update and change this Policy to reflect changes to the way we process your personal data or changing legal requirements. We will notify you of changes by posting the new Privacy Policy on this page, let you know prior to the change becoming effective, and update the "Last updated" date at the top of this Privacy Policy.

• Controller: Arileus Intelligence Systems, LLC
• Email: privacy@neurotraderai.com
• General contact address: https://app.neurotraderai.com/support
• Data Protection Officer (DPO): not appointed — contact privacy@neurotraderai.com for all privacy matters
• EU/EEA representative: not applicable — the Services are not offered in the European Economic Area

This Addendum supplements the Policy and applies exclusively to California residents ("consumers") within the meaning of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the "CCPA"). In the event of a conflict between this Addendum and the main Policy, this Addendum prevails with respect to California consumers.

Notice at collection — we collect, and have collected in the preceding 12 months, the following categories of personal information: identifiers (name, email address, IP address, User ID); customer records and commercial information (subscription and billing information, trading preferences, paper-trading activity, records of user-approved trades); internet or other electronic network activity information (device and browser information, login history, cookie identifiers, usage and analytics data); and sensitive personal information (account log-in credentials and exchange API credentials).

Sensitive personal information — we collect and use sensitive personal information solely to provide the Services you request, in particular authentication and the execution of user-approved trades, and to maintain security and prevent fraud. We do not use it to infer characteristics about you, and accordingly do not offer a "Limit the Use of My Sensitive Personal Information" link.

No sale or sharing — we do not sell personal information and have not sold personal information in the preceding 12 months. We do not "share" personal information with third parties for cross-context behavioural advertising. Our analytics tool (Google Analytics 4) is configured for first-party measurement only: Google Signals and ads-personalization features are disabled, and no advertising cookies or pixels are used on the Platform. If this changes, we will provide the required notice, a "Do Not Sell or Share My Personal Information" link, and honour opt-out preference signals (e.g., Global Privacy Control) before any such sharing begins.

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it
• Right to delete — request deletion of your personal information, subject to statutory exceptions; we will also direct our service providers to delete it
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale or sharing — we do not sell or share personal information; if this changes, we will provide the required notice and opt-out mechanism first
• Right to limit the use of sensitive personal information — see the sensitive-personal-information paragraph above
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights

You may submit a verifiable consumer request by emailing privacy@neurotraderai.com or through our support page at https://app.neurotraderai.com/support. We may need to request specific information to verify your identity; we will use it only for verification. You may designate an authorized agent. We will respond free of charge within 45 days (extendable once by a further 45 days with notice). We do not offer financial incentives in exchange for personal information. The CCPA is enforced by the California Privacy Protection Agency and the California Attorney General.