Privacy Notice

1. Who we are

AlsaTitan — the website at www.alsaquant.com, including the signed-in app — is provided by Alsatronix Solutions DMCC (licence no. JLT-66355), Unit UT-11-CO-23, DMCC Business Centre, Level 11, Uptown Tower, Dubai, United Arab Emirates.

We are the controller of your personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR). This notice explains what we collect, why, who receives it, how long we keep it and what rights you have.

For questions or requests about your data, email [email protected].

2. In short

• We use your data to run your account and AlsaTitan's tools, to take payments and to keep the service secure.
• If you choose to answer the optional questions about yourself, we use them to understand who uses AlsaTitan and to shape our offers. We email you offers only if you tick the box for them (section 3.16).
• We do not sell your personal data, and we use no advertising cookies.
• What you type or say to an AI feature goes to the AI provider that answers it. We do not keep it in our activity log.
• You can delete your account in Settings at any time (see section 10).
• Paper trading in AlsaTitan is simulated: no real orders are placed. Nothing in AlsaTitan is financial advice.

3. What we collect and why

This section lists what we collect, activity by activity. Section 4 gives the legal reason for each use, and section 8 how long we keep it.

3.1 Your account

If you sign up with an email code, we collect your name, email address and password. We store your password only as a bcrypt hash, which cannot be turned back into the password.

While you enter the code we emailed you, your name and a bcrypt hash of your password are held in our server's memory. Your password itself is hashed before the code is sent. They are discarded as soon as your account is created, and in any case 30 minutes after the last code we sent you.

An account created with an email code is stored in our database, like every other account, until you delete it. If you sign up again with an address that already has an account, we do not create a second one.

If you use Continue with Google, Google gives us your name, your email address and a link to your Google profile picture. We ask Google only to confirm who you are, and we keep no Google access key for signing in.

You can change your name and phone number in Settings → Edit Profile. To correct the email address of your account, contact us. An administrator can change it: we email a link to the new address, and we tell the current address, with a link to cancel the change. The change takes effect 24 hours after it was requested, once the new address has confirmed it and if no one has cancelled it. You are then signed out everywhere and sign in with the new address.

3.2 Payments

When you subscribe, you give us your name, email address and billing address and, if you choose, your phone number. We give Stripe, our payment provider, which runs the checkout page, your email address. You type your card details on Stripe's page; they never reach us.

Until your purchase is set up, we keep your name, billing address and phone number on our server, encrypted and tied to that one checkout and to a hash of your email address (a one-way scrambled form of it, from which the address cannot be read back), so that deleting your account deletes them too. When the payment succeeds, we copy them into your account, except any your account already holds, and delete the encrypted copy. If you do not finish, we stop using them after 24 hours, and our cleanup, which runs every 30 minutes, deletes them within half an hour after that.

When your payment goes through, Stripe creates a customer record with your email address and what you typed on its page. When a payment succeeds, we create your AlsaTitan account from your details, if you do not have one, and email you a link to set your password if your account has none. Before 21 October 2026, Stripe created a customer record with your email address and name as soon as you selected Continue to Payment, even if you did not then pay. Before 21 October 2026, we also gave Stripe, with each checkout, the billing address and, if you gave them, the phone number and company you typed on our form. Stripe keeps those checkout records in our Stripe account; deleting your account does not remove them (section 10).

To switch between monthly and annual billing, or to cancel, email [email protected] and we will confirm by email; there is no self-service screen for it.

We keep your plan, the status and dates of your subscription, the amounts you paid, your billing address and phone number, and the identifiers Stripe gives your customer record and subscription.

3.3 Signing in and security

When you sign in, we set a session cookie that lasts up to 7 days. If your account has a password, the session is tied to it: changing or resetting your password ends every session signed in with the old one, and Sign Out of All Devices in Settings ends them all.

When you sign out, we keep a record so that the session cannot be used again. A record for one session holds only that session's random code and expires when the session would have (at most 7 days). A record that ends all your sessions — after Sign Out of All Devices, a password change or deleting your account — holds a hash of your email address (see section 3.2), not the address itself, and expires after 90 days. Expired records are deleted when we next clean up these records.

After you sign in with a password, we set a __Host-signin_device cookie for 90 days. It holds a random code, the time it was issued and a signature — not your email address. It only lets us count this browser's sign-in attempts separately from other people's attempts on your address.

To stop password guessing, we count sign-in attempts in our server's memory, per internet address and per email address, for up to an hour. A refused password sign-in is answered no sooner than half a second after we start checking it, to make it harder to learn from the timing whether an account exists.

We use Cloudflare Turnstile, a check that tells people from automated programs, on sign-up, code resend, password reset and the newsletter form, and on sign-in when we see unusual load. Your browser loads it from challenges.cloudflare.com, and Cloudflare collects technical information from your browser to run the check (see Cloudflare's privacy policy). We then send Cloudflare the result of the check and, when we know it, your IP address. On our public pages, the newsletter's check loads only when you start using the form.

3.4 AI features

When you use an AI feature, what you type or say is sent to the AI provider that answers it, together with the conversation so far, the market data the answer needs and, when a tool needs them, your watchlist or paper-trading positions. Section 5 lists the providers.

When you talk to a voice assistant, the audio goes from your browser straight to Google Gemini Live or OpenAI Realtime, using a short-lived key from our server. GOAT Mode and the Titan copilot, whether you type or speak, are told your name, email address and watchlist, the balance and open positions of your paper-trading account and, if you answered the setup questions, how you trade: your experience, trading styles, markets, goals, how you handle a losing trade, how you want answers worded and the guide you chose. They are not told your answers about yourself (section 3.16). When you dictate, or when the voice provider does not write out what you said, the recording passes through our server to Google Gemini or OpenAI to be written out; our server does not keep the recording. We never store the audio of a voice conversation. What you say to the Titan copilot and what it answers are kept as text in your own Titan chat history, together with what you type, so the same conversation is there when you sign in again on any device. You can delete a conversation at any time: "Delete this conversation" in the Titan voice box, or the delete button in your saved chats. Some other assistants keep recent conversations in your browser (section 7).

When you ask the Titan copilot to remember something about you ("remember that I only trade US stocks", "from now on keep answers short"), it keeps your own words as a short note in your account: at most 50 notes of up to 200 characters, each with the time you said or typed it. It keeps a note only when you ask, never on its own, and it does not keep passwords, keys, codes, card or account numbers, contact details or notes about other people. Your notes are given to the Titan copilot, spoken and typed, in every conversation (and to the reasoning model it hands a hard question to), so it can answer the way you asked. You can see, edit and delete each note, or all of them, in Memory (the Titan voice box's menu, or Settings → Voice), or by saying "forget …". Support staff who open your account to help you can neither see nor change your notes in Memory. What you said or typed to Titan, including what you asked it to remember, also stays in your Titan conversation, which support staff can read when they open your account to help you; saying "forget …" deletes the note, not the conversation, which you can delete yourself ("Delete this conversation"). Your notes are deleted with your account.

During a voice session with GOAT Mode or the Titan copilot, when you ask about something on your screen ("what is this?"), the assistant reads the item under your mouse pointer: its visible text or label, the title of the section it is in and, on a chart, the symbol, the timeframe and the prices and indicator values at the pointer. Only that description is sent, never an image of your screen: to the voice provider and, when the assistant hands a hard question to a reasoning model, to the AI provider that answers it (section 5). It is not stored. It never includes what is in a field you type into or your own messages in our AI chats, parts of a page marked private, or anything on the administration, settings, connections, sign-in and payment pages, and email addresses and keys in the text are masked.

When the voice assistant hands a hard question to a reasoning model, that model's AI provider receives your question, the last few turns of the conversation, the list of windows you have open (their titles, symbols and timeframes) and, only if you pointed at something, the description above (section 5). To answer, the reasoning model looks up market data and the positions and watchlist of your demo account itself. Our server keeps none of it once the answer is sent.

We keep the chats and work you save in AI features — AI Assistant and Playground conversations (with the Titan copilot, what you said by voice too, as text), persona chats, Labs sessions, AI debates, your custom personas and backtest results — until you delete your account. You can delete a single Titan conversation or persona chat from its history list, the Titan conversation you are in from its voice box, and a custom persona from the Playground, sooner. So that the Titan copilot can pick up where you left off, we also keep, with your account, a short summary of each of your recent Titan conversations: the symbols it was about, your last question, the decisions you stated in your own words and what the copilot did. It is made from the conversation itself, without an AI provider, is given to the copilot with the conversation, and is deleted when you delete the conversation.

We do not use your data to train AI models. Each AI provider's own terms govern what it does with the data we send it.

Our records of AI usage and cost hold no message text.

Our administrators can read the prompts you send to Titan AI features (such as Titan chat, the AI Assistant, the Playground, persona chats, Labs and AI debates) to check the quality of the answers and to stop abuse. They see the last 30 days only, and only after confirming it is them again, for example by entering their password. Each look is recorded under the administrator's name: who looked, whose prompts, how many and when. We keep that record for 1 year, like the records in section 3.13. Email addresses, phone numbers, card and bank account numbers and access keys that we recognise in your prompts are hidden from that view.

3.5 Paper trading and your tools

Paper trading in AlsaTitan uses simulated money. We keep your demo accounts and their orders, fills, positions and history. No real orders are ever placed.

We also keep what you set up in the app: terminal boards, your watchlist, price alerts, saved screens, saved chart scripts, saved chart layouts (with the drawings on their symbols), analyst runs, Playground tools, daily-brief settings, and your answers to the setup questions with your getting-started checklist and, if you give them, your answers about yourself (section 3.16). A chart layout you choose to share can be opened, read-only, by anyone signed in to AlsaTitan who has its link, with your profile name (never your email); turning sharing off or deleting the layout stops the link.

If you publish a script to the community, other users see its name, its description, its code (unless you lock it; even then, its code is sent to their browser when they run it) and an author label such as “Trader 3FA2C1”, which is not your name or email address.

If you share a script with someone directly, you type their full email address. We do not tell you whether that address has an AlsaTitan account, we send them no email, and only you see the list of people you shared it with.

If someone you shared a script with deletes their AlsaTitan account, their address is removed from the list of people you shared it with.

When you like a script, we record the like against your account; other users see only how many likes it has.

3.6 Connected services

If you connect a Google service (Drive, Gmail, Calendar, Sheets, Slides or Docs), we store the access Google gives us, encrypted. We use it only for the features you use with that service, including ones you schedule, such as the daily brief. What it reads may be sent to the AI provider answering you. With Gmail connected, the assistant can read and search your mail, and send mail from your account when you ask it to. When you ask the assistant to put a chart in a document it saves to your Google Drive (including a Google Docs document or an HTML file) or in a Slides deck, we send the chart's data to QuickChart (quickchart.io), which draws it as an image (section 5).

Disconnecting one Google service stops AlsaTitan using it at once, but Google keeps listing AlsaTitan's access. When you choose Disconnect Google, or disconnect your last Google service, we ask Google to remove AlsaTitan's access and delete the keys we hold. Deleting your account does the same. Google says this might take some time to take effect.

If you connect an exchange or broker account (Binance, Bybit or Alpaca), we store its API key and secret encrypted. For a live account we use them only to read your balances and positions: AlsaTitan has no code that places orders on one. For a paper, demo or testnet account we also use them to place the orders you confirm. When you connect or test a key we ask the exchange, where it answers, what the key is allowed to do, and keep that answer with the key. We do not save a live key the exchange says can withdraw funds. Disconnecting deletes them from AlsaTitan. Give a live key read-only permission when you create it, and delete it at the exchange too when you stop using it.

3.7 Activity log

When you are signed in, we keep an activity log to help you when something goes wrong and to keep AlsaTitan secure. It records the pages you open, the buttons you press, the commands you give a voice assistant (the action and the symbol), errors in your browser and your paper-trading orders, with the time, your email address, a random code for the browser tab, your IP address (for IPv6, only the network part), your country, and your browser's identification string (its user agent).

It also records server events about your account, such as sign-ins, failed sign-ins, AI usage and errors. When anyone tries to sign in, we record the address typed, the IP address and the browser, also when it is not an AlsaTitan account.

Our activity log does not record what you type into AI tools or search boxes — only that you sent something and how long it was. The words you type into a search box travel inside the request, not in the web address it asks for. Only a symbol goes into the web address a request asks for: one you pick from the results, or what you type in capitals in a ticker's shape — up to five letters and digits, or a name with a short ending such as .B, -USD or =X — such as NVDA or BRK.B. A word typed that way counts as a ticker even when it is not one, such as LOAN or LAWYER.US; and the Flow Screener's Ticker filter changes what you type there to capitals first, so a short word such as loan becomes LOAN in its address. Our web server's access log leaves out the part of a web address after a question mark; its error log keeps the full address of a request it reports an error for, for up to 14 days; and Cloudflare, which carries our traffic, receives the full address (section 3.9).

Some pages keep your search in their own web address, so that a link you copy shows the same results. They keep it after a # sign: your browser shows it and keeps it in its history, but never sends it to us or to Cloudflare. A link saved before this change can still carry search words after a question mark: opening it sends them once, as described above, and the page then moves them after the #.

Our support staff can read this log. They can also open your account to see it as you do, for at most 30 minutes at a time; what they do then is recorded in the activity log under the staff member's name. When they look up your account or your activity, your email address and the words they search for travel inside the request, not in the web address.

We keep the log for 14 days in our database, then for 365 days in compressed archives, and then delete it.

3.8 Emails

We send account emails: sign-up codes, password and security messages, your welcome email, reminders about a free trial and billing emails. They have no unsubscribe link, because you need them to use your account.

Price alerts and the daily brief are emailed only if you set them up. Each email has a one-click unsubscribe link, and you can also turn them off in Settings → Email. The link works for a year after the email was sent; after that, use Settings → Email.

Reports, strategies and trade lists you ask the assistant to email are sent only to your own address.

We send our emails through Google Workspace.

If you sign up for our newsletter on the website, your address is emailed to our support mailbox ([email protected]). We may send you occasional product updates and market notes. We keep your address until you ask us to stop: email [email protected].

We email you offers and product news only if you tick the box for them under About you (section 3.16). To stop them, untick it in Settings → About you, or email [email protected].

3.9 Visiting our website

When you open any page, our web server and Cloudflare, which carries our traffic, receive your IP address, the web address you ask for and your browser's details. Our web server keeps them in its access log for up to 14 days, without the part of the address after a question mark; its error log, kept as long, holds the full address of a request it reports an error for. Cloudflare also adds its Web Analytics script to our pages to count visits and measure how fast they load.

Our pages load their fonts from Google Fonts, so your browser contacts Google's servers. Charts come from TradingView, and the logos and flags shown next to instruments from other websites; your browser fetches them directly, so those websites receive your IP address and browser details. The home page shows images from Unsplash, and tools you build in the Playground load code libraries from public code hosts (CDNs); your browser contacts them directly too. When you are signed in, live prices for a crypto symbol on Alsa Charts may stream to your browser straight from Binance or, when Binance cannot be reached, Coinbase, which then receive your IP address, your browser's details and the symbol. Live US-stock and forex prices from Finnhub come through our own server, so Finnhub learns which symbols are being watched, not who is watching them. Smart Money pages show portraits from Wikipedia (Wikimedia), which your browser loads directly.

3.10 People in public filings

Our Smart Money pages show the names, roles and trades of company insiders, fund managers and members of the US Congress, taken from public filings. We did not collect this from them directly. If you are one of them, you can use your rights in section 9 by contacting us.

3.11 Contacting our support team

If you email [email protected], we keep your messages in our support mailbox to answer you.

If you send a help request in the app, or ask for a person in the support chat, we keep the request: its subject, category and messages (with the chat so far, when it started there), your account and email address, your plan when you sent it, and the rating you give it. When it has a reply, we email you only its number and a link to it. The support chat is kept in your browser tab, and our server keeps it only when you ask for a person; the help centre's instant answers are not kept.

Our support staff read your requests. An agent sees the requests in the categories they handle and those assigned to them or to no one; a lead or an administrator sees every request. Next to a request, staff see a summary of your account: your email address with most of it hidden, your plan, how long you have had your account, how many times you have signed in, how much of your AI allowance you have used, the error codes you met in the last 24 hours and your open requests. The summary does not include the text of your AI chats, your IP address or your device. Only a lead or an administrator can show your full email address, and we record each time they do. Support agents and leads cannot read your AI prompts; an administrator can, only in the way section 3.4 describes.

Titan Support AI answers the support chat, the help centre's questions and many requests first, and support staff can ask it to draft a reply. It reads what you wrote (for a request, its messages) and, to answer, facts about your account: your plan and billing status, your AI usage and credits, how old your account is, whether your email is verified, when you last signed in, the error codes you met in the last 24 hours and how many requests you have open. These go to the AI provider of the model we use for support (section 5). We do not send it your email address, and email addresses and long numbers in your messages are hidden before they are sent. Its answers are kept with your request.

3.12 Sign-in history

Each time someone tries to sign in to AlsaTitan, we record what happened. This covers sign-in with a password, with Google, with an email code, by setting a password from a link we emailed, and when someone already signed in confirms it is them before a sensitive change. For each attempt we record:

• the time;
• the account, when the attempt matched one. For an address with no account, we keep a code worked out from the address with a secret key, not the address itself;
• the IP address (for IPv6, only the network part);
• the approximate place that address belongs to (country, region and city) and the network it belongs to;
• the browser, operating system and kind of device, read from the browser's identification string;
• how the sign-in was made, and whether it worked and, if not, why (for example, a wrong password);
• for a sign-in that worked, a code for the session that can't be turned back into the session.

We work out the approximate place on our own server, using a database file from DB-IP (IP to City Lite and IP to ASN Lite, under the Creative Commons Attribution 4.0 licence). Your IP address is not sent to anyone for this. The place is approximate, usually where your internet provider's equipment is, and can be wrong. We don't record map coordinates.

We use these records to keep accounts safe and to prevent fraud: to notice sign-ins from unusual places, repeated failed attempts and stolen passwords. This is our legitimate interest (Article 6(1)(f) GDPR). You can see your own recent sign-ins, and sign a device out, in Settings. Our administrators see them when they look after your account or investigate misuse. If you are an administrator, we email you when your account is signed in to from a country it hasn't been used from in the last 90 days.

On your account itself we keep only the time of your most recent successful sign-in, replaced each time you sign in, so that you and our staff can see when the account was last used. When the full sign-in records above are switched off on our servers, the recent sign-ins in Settings are read from our activity log (section 3.7), which records sign-ins as that section describes.

We delete each record 90 days after it is made, and at once when you delete your account.

3.13 Changes our staff make to your account

When one of our administrators changes your account (for example your name, email address, plan, free trial, AI message allowance, or whether the account is active), or exports the list of accounts or the marketing list (section 3.16), we record which administrator did it, when, and what changed. For your name and phone number we record only that they changed. For an email address we record a shortened form such as d•••@example.com. We keep these records for 1 year, including after your account is deleted, so that we can account for every change our staff made. After a deletion they hold only the shortened address and a random account number. This is our legitimate interest in the security of accounts and in being able to account for what our staff do, and in establishing or defending legal claims.

3.14 Free trial

When you create an account, you may get the paid plan free for 7 days. We don't ask for a card and nothing is charged. When the trial ends, your account goes back to the free version unless you subscribe. To give each person one trial, we keep a code worked out with a secret key from your email address (and, if you use Google, from your Google account's identifier). We keep it for 12 months after the trial ends or the account is deleted. It can't be turned back into your address. We may refuse a trial to temporary email addresses, to forwarding (“hide my email”) addresses, and to too many new accounts from one network in a day. To count those, we keep a code worked out with a secret key from your network (never your full IP address) for one day. This is our legitimate interest in preventing abuse of the free trial.

3.15 If an administrator invites you

If an administrator of AlsaTitan invites you, we create an account with your email address and the name they entered, and email you a link to choose your own password. The link works for 72 hours. Until you choose a password, the account can't be signed in to. If you don't use the link, nothing further happens.

3.16 About you (optional)

After the setup questions, we ask a few questions about you. Every answer is optional, you can skip the whole step, and you can use all of AlsaTitan without answering. We ask:

• your date of birth: we keep it only if it says you are 18 or older, and never store a date that says you are younger;
• where you trade: the brokers or exchanges you use, or that you have none yet;
• who sent you our way;
• the country you trade from, which we suggest from your browser's time zone or language and keep only if you save. It puts your country's brokers first in the list;
• whether you want emails from us with offers and product news. This is a separate box, unticked until you tick it, and we record when you last changed the answer.

We use these answers to understand who uses AlsaTitan and to shape our offers, and we email you offers only if you ticked the box (section 3.8). They also do two things for you in the app. On your birthday, your guide shows you a one-line birthday greeting: your browser works out the day from your saved date of birth, and remembers in its own storage that you closed the greeting (section 7). And where you trade lets us offer a link to your broker on our Compare Brokers page or, if you have none yet, a way to find one that fits you. Titan's AI is not given them (section 3.4 lists what it is told).

This rests on your consent. You can change or clear any answer, or untick the offers box, at any time in Settings → About you; clearing your answers withdraws your consent, and does not affect what we did before. We keep the answers until you clear them or delete your account (section 10).

Only the owner of AlsaTitan can download these answers, as a list that also holds your email address, your name and the day you joined, and only after confirming who they are again. The list can be limited to the people who ticked the offers box. Each download is recorded with the changes our staff make (section 3.13).

4. Our legal reasons

Why we use your data, and the legal basis for each use

5. Who receives your data

The companies that receive personal data from AlsaTitan

IP geolocation data © DB-IP.com, CC BY 4.0. IP Geolocation by DB-IP. DB-IP is not a recipient of your data: we use a database file from them on our own server, and send them no personal data.

We do not sell personal data.

6. Transfers outside your country

We store and process your data on servers in the United States, run for us by InterServer. The other providers in section 5 may process it in the United States, the European Union and other countries. Where the law requires it, these transfers, including to our hosting provider, rely on the providers' data protection terms, such as standard contractual clauses, or on another lawful safeguard.

7. Cookies and storage in your browser

We set only cookies that AlsaTitan needs to work and to stay secure, and no advertising cookies.

Cookies AlsaTitan sets

Cookies other companies may set

Older versions of AlsaTitan also set cookies named user_email, user_id, user_auth and demo_auth, and cookies named session, admin_return, signin_device and g_oauth_state without the __Host- prefix. We no longer set or read any of them. An old session cookie is ended and removed the next time your browser opens AlsaTitan. An old admin_return cookie (staff only) is ended and removed the next time that browser starts or ends a support view, and otherwise expires within 7 days of being set. The others expire on their own: user_email, user_id, user_auth and demo_auth within 7 days of the last time you signed in before this update (signing out removes them sooner), signin_device within 90 days of being set, and g_oauth_state within 10 minutes.

AlsaTitan also keeps your settings in your browser's storage and, for some features, your own content — for example AI assistant and voice assistant conversations, the copilot's feed, spoken replies, GOAT Mode history and memory, chart drawings and alerts, board and screener layouts, notes, scripts, your paper-trading journal and a copy of your watchlist. It stays there until you clear it, except that signing out, or someone else signing in on the same browser, removes the copies of your watchlist and your terminal boards. Signing out does not remove the rest, so on a shared computer use a private window. The names of the copies of your watchlist and boards contain a short label made from your email address. Deleting your account clears all of it in the browser you delete from. AlsaTerminal keeps its pages and panes (each pane's function, security and settings), the securities you opened there, your saved layouts and your keyboard shortcuts for your account, both in this browser and with your account; signing out, or another account signing in on this browser, removes this browser's copy of them. The terminal's display preferences, and what a screen shares with the AlsaTitan page it shows (the screener's last screen, for example), stay in this browser like your other settings.

8. How long we keep your data

How long we keep each kind of data

9. Your rights

Depending on where you live, you have the right to:

• see the personal data we hold about you and get a copy, including in a format you can take elsewhere;
• have it corrected: you can change your name and phone number yourself in Settings; to correct your email address, contact us and we will help (section 3.1);
• have it deleted: delete your account in Settings, or ask us (section 10);
• object to how we use it, or ask us to restrict it;
• withdraw your consent where we rely on it, such as for the newsletter or your answers about yourself, at any time; this does not affect what we did before;
• complain to a data protection authority: in the UAE, the UAE Data Office; in the EU or the UK, the authority where you live or work.

To use these rights, email [email protected]. We may first ask you to confirm who you are, for example by writing from the email address of your account. We reply within 30 days. If the law allows more time for a complex request and we need it, we will tell you why within those 30 days.

10. Deleting your account

You can delete your account in Settings → Delete Account: type DELETE, then confirm with your password or, if your account has no password, with a code we email you. This permanently deletes your AlsaTitan account. It can't be undone. What happens:

• Deleting your account ends any paid plan straight away; the rest of the period is not refunded. We delete your customer record at Stripe, our payment processor, which removes your saved card details. Stripe keeps a record of the deleted customer, and records of your past checkouts and payments stay in our Stripe account, with the billing details they hold; some older checkouts also hold the phone number and company you gave.
• We delete your profile and sign-in details, AI chats, Labs sessions, debates, custom personas, backtests, paper-trading accounts and their history, boards, watchlist, price alerts, saved screens, saved chart scripts, daily-brief settings, published and shared scripts, the Google and exchange keys you connected, and the billing details of a checkout you have not finished.
• If you connected a Google service, we ask Google to remove AlsaTitan's access to your Google account.
• We delete your activity-log entries now. Copies in our log archives, and mentions of your address in other log entries, are removed within 24 hours.
• We clear the data AlsaTitan keeps in this browser. Other browsers and devices keep theirs until you clear them.

What stays:

• Copies of your scripts that other people already made.
• API keys you created at an exchange: delete them there too.
• Emails you sent us, and your newsletter sign-up: ask us to delete them too.
• What we sent to AI providers, Stripe, Google and Cloudflare, which they keep under their own terms.
• Records of your past checkouts and payments in our Stripe account.
• If you once had admin access: records of the changes you made to other people's paper-trading money, which name your email address.
• Our web server's technical logs, deleted within 14 days, and security records that don't contain your address, deleted within 90 days.
• Counts our server keeps to stop abuse, for up to an hour — such as sign-in, password-reset and email-code attempts — and how many emails we sent you, for 24 hours without your address, until they expire.
• Copies in our daily database backups, deleted within 7 days.
• Records of changes our staff made to your account, for up to a year, with only a shortened form of your address.
• A keyed code of your email address that stops a second free trial, for 12 months.

An account with admin access must have it removed first. If you cannot sign in, email us and we will delete your account for you.

11. How we protect your data

• Connections to AlsaTitan are encrypted (HTTPS), and browsers are told to use only encrypted connections.
• Passwords are stored only as bcrypt hashes.
• The keys for services you connect are encrypted (AES-256-GCM).
• Sessions are signed, tied to your current password if you have one, and can be ended on every device.
• Browsers cannot read our database; only our server can.
• Sign-up, sign-in and other forms are protected by security checks and limits. Requests from your browser that change your data must come from our own pages, and a request for your data that another website's page makes your browser send is refused when the browser marks it as coming from another site, as current browsers do. Requests from elsewhere that can change your data must carry proof we check: Stripe's payment notices carry Stripe's signature, Google's return from its sign-in and consent pages carries a signed code tied to your browser, and the one-click unsubscribe your mailbox sends carries the sealed code in the unsubscribe link.
• Every time our staff open your account, it is recorded.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities where the law requires.

12. Children

AlsaTitan is for adults. You must be 18 or older; we ask you to confirm this when you create an account. If you believe someone under 18 has given us personal data, contact us and we will delete it.

13. Automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects on you. AI answers are information, and paper-trading bots trade only with simulated money.

14. Changes to this notice

When we change this notice, we post the new version here with a new date. If a change is significant, we will email account holders before it takes effect.

15. Contact us