Privacy Policy

This policy explains what personal data Trading Agent collects, how we use it, and who we share it with. We try to keep it short and concrete — no “legalese for the sake of it.”

Trading Agent is operated by WU Capital Limited, a company incorporated in New Zealand. The “data controller” for the purpose of GDPR / CCPA is WU Capital Limited. Contact details at the bottom.

1. What we collect

• Account info — email and name you provide at signup.
• Authentication metadata — sign-in timestamps, IP for security checks (managed by Supabase).
• Consent records — which version of the Terms / Privacy / Disclaimer you agreed to at signup, plus the timestamp, IP, and user-agent of that consent (stored in our terms_acceptance table). When you buy a data licence, we also record which licence version you accepted and the SHA-256 of each document, with the time, IP and user-agent of the acceptance and the Stripe checkout it led to (our licence_acceptances table). This is evidence of the contract (GDPR Art. 6(1)(b) and (f)); it is kept after account deletion for the retention period below.
• Subscription state — plan tier, status, period end, customer + subscription IDs (mirrored from Stripe).
• Signup country — at signup we record the two-letter country your connection resolves to (derived from your IP by our host) so we can apply the correct regulatory disclaimers to your account and the emails we send you. We store only the country code, not your precise location or a full IP history.
• Watchlist, alerts, paper-trading positions — tickers, thresholds, hypothetical positions you save.
• Analysis log — analyses are no longer logged. Rows logged earlier stay in our predictions_log table; if you were signed in, your account id is stored with them, it is never published, and it is removed if you delete your account.
• Payment info — handled by Stripe directly; we never see card numbers. We retain only the customer / subscription identifiers Stripe issues us.
• Anonymous analytics — when you click “Accept” on our cookie banner, we send anonymous event data (pageviews, feature clicks) to PostHog. No PII; PostHog generates an anonymous distinct ID per browser. If you click “Reject” we don't initialise PostHog at all.
• Error reports — when something breaks we send the error stack trace to Sentry to debug. We strip query strings and don't capture form values; the report typically contains the URL, browser, and the error itself.
• Usage data — basic request logs from our hosting providers (Vercel and Render) for debugging and abuse prevention.

1a. Lawful basis for processing (EU / UK GDPR)

For users in the EU, UK, or EEA, we rely on these lawful bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)) — we process your account, authentication, subscription, watchlist, prediction history, and payment-state data because it is necessary to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — we process minimal request logs, error reports (Sentry), and abuse- prevention metadata to keep the service secure and operational. Our legitimate interest in running a reliable, secure service is balanced against your right to privacy by the safeguards described below (data minimisation, short retention, no profiling).
• Consent (Art. 6(1)(a)) — we set the PostHog analytics cookie only after you click “Accept” on the cookie banner. You may withdraw consent at any time by clearing the ta_consent entry from your browser storage or by emailing us; withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c)) — we retain certain billing and tax records as required by New Zealand revenue law and by Stripe's record-keeping requirements.

While our analytics are produced by automated processes, you retain full discretion over any investment decision. We do not produce automated decisions that have legal or similarly significant effects on you within the meaning of GDPR Article 22. We do not profile individuals; our models operate on public market data, not on personal characteristics.

2. How we use it

• To run the service: authentication, paywall, watchlist persistence, market analysis, paper trading.
• To bill you and process subscription state changes.
• To send transactional emails (account confirmation, trial reminders, plan changes, cancellations, opt-in daily digest).
• To investigate abuse, fraud, or security incidents.
• To understand which features matter and which marketing channels work (consent-gated PostHog only).
• To fix bugs when something breaks (Sentry).

We do not sell your data. We do not run ad networks on the site. We do not share data with marketing partners.

What we do sell is something different: licences to company financial data — the accounts companies filed with public registers — as Trading Agent Data. They are meant to be records about companies, not about people, and sole traders are excluded because their accounts are a person's finances (section 5a explains what happens if one is missed, or if a company's registered name is your own). About the company.

3. Who we share it with

The third-party services that act as data processors for Trading Agent (with links to each provider's public Data Processing Agreement):

• Supabase — database and authentication. Hosted in the region you select; default US. DPA
• Stripe — payment processing and subscription billing. Stripe is the controller of card data, not us. Stripe is certified to PCI-DSS Level 1 (the highest level); view Stripe's compliance attestation at stripe.com/legal/ssa. DPA. Payment authentication for EU / UK customers complies with PSD2 Strong Customer Authentication requirements, handled by Stripe.
• Brevo — transactional and digest email delivery (free tier). Brevo SAS is headquartered in Paris, France, and processes email data primarily within the EU. DPA
• Resend — the relay for the business emails we send from william@tradingagentapp.com (§5b). Resend, Inc. is based in the United States and stores email data there; it takes part in the EU–U.S. Data Privacy Framework. DPA
• PostHog — product analytics. Loaded only after you click “Accept” on the cookie banner. US or EU region depending on our project setup. DPA
• Sentry — error tracking. Captures stack traces when bugs happen. Sampled at 10%. DPA
• Vercel — frontend hosting. Edge servers globally. DPA
• Render — backend hosting (FastAPI service that runs the ML model).
• Cloudflare — traffic acceleration, and storage of Trading Agent Data files and delivery logs (R2). It also forwards email sent to our tradingagentapp.com addresses (contact@ and william@). Sees request metadata, and the files, logs and messages it stores or forwards.
• Google (Gmail) — hosts the mailbox we write and reply from, including the emails described in §5b and mail forwarded from our tradingagentapp.com addresses.

Each of these has its own privacy policy. Each processes data on our behalf under a standard data-processing agreement, except Google, whose standard account terms apply to our Gmail mailbox. We don't share your data with any other third parties for marketing purposes.

3a. Quebec (Law 25)

Residents of Quebec, Canada are afforded specific rights under An Act to modernize legislative provisions as regards the protection of personal information (Law 25):

• The right to be informed when your personal information is communicated outside Quebec, and to know the safeguards we apply (we transfer to our processors in the US and EU under Standard Contractual Clauses; see §8).
• The right to be informed of any automated processing used to make decisions about you. Our analytics are automated statistical output and do not produce decisions about you within the meaning of Article 22 GDPR.
• The right to data portability (machine-readable export).
• The right to lodge a complaint with the Commission d'accès à l'information du Québec.

We currently provide this policy in English only. A French-language version is available on request — email contact@tradingagentapp.com with subject “Quebec privacy policy” and we'll send a translated copy within 30 days.

4. Cookies + tracking

We use three categories of cookies / local storage:

• Essential — authentication sessions (Supabase), CSRF tokens, locale preference. Required for the site to function; no consent needed under GDPR.
• Analytics — PostHog distinct ID + event queue. Set only if you click Accept on the cookie banner. Click Reject and we don't set these at all.
• Consent state — your accept / reject choice itself is stored in your browser's localStorage under ta_consent so we don't re-prompt on every visit. This is “strictly necessary” under GDPR as it's required to honour your preference.

Service-worker cache is also active when you use the site — we cache API responses for offline / cold-start fallback. No personal data leaves your device through the cache.

5. Your rights

• Access — view your account info from /account.
• Delete — delete your account yourself, instantly, from /account (Account → Delete account → type DELETE); your account, personal data, and any active subscription are removed immediately. Or email us at contact@tradingagentapp.com and we'll do it within 30 days. See /delete-account for exactly what is deleted and what is retained. Subscription billing data may be retained to the extent required by Stripe and tax authorities.
• Export / data portability — email us and we'll send you a JSON export of your data within 30 days.
• Correct / rectify — update your profile from /account or email us.
• Restrict or object (EU/UK users) — you can ask us to restrict processing or object to legitimate-interest processing. Email us with details.
• Withdraw consent — for any processing based on consent (currently analytics only), you can withdraw at any time.
• Lodge a complaint with a supervisory authority — if you believe we have mishandled your personal data you have the right to complain to your local data-protection authority. Examples: the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), the Information Commissioner's Office in the UK (ico.org.uk), or your member state's DPA in the EU. We'd appreciate it if you raised the issue with us first so we can try to resolve it directly.

We respond to verified rights requests within 30 days for GDPR users, 45 days for CCPA/CPRA users (California), and as soon as reasonably practicable for everyone else.

5a. Company-register data we republish

Trading Agent Data republishes annual accounts that companies filed with public registers (the U.S. SEC, the National Bank of Belgium, INPI in France, the Danish Business Authority, Charities Services in New Zealand, and others listed on /fundamentals), under each register's reuse licence. They are intended to be records about legal entities only. We do not add directors, shareholders or any other personal data to them, and we do not allow searching by insolvency, sanction, or disqualification status.

Sole traders are excluded. A sole trader is a person, not a company, so their accounts are personal data. We remove French entrepreneurs individuels (identified by INSEE's legal category) and Danish entities that may be sole proprietorships, and we check new registrations before they are published. The reasons and the method are on the methodology page.

If a record relates to you as a person — you trade as a sole trader, or a company named after you is owned by you alone so that its accounts show your own finances — email contact@tradingagentapp.com with the registration number. We remove it within 30 days, whatever the register still publishes. You do not need to go to the register first. If the record is about a company that only shares your name, we will tell you within the same 30 days whether we remove it and why.

If a record about a person is in the data despite these checks, WU Capital Limited (contact below) is its controller. It came from the public register named in the record. We hold it only to publish historical company accounts, on the basis of our legitimate interest in providing accurate company data to researchers and investors (GDPR Art. 6(1)(f)). It may have been delivered to licensees in any country, including buyers of permanent snapshots. When we remove it, we send its identifier, without the reason, to licensees, who must delete it within 30 days. After removal we keep only the registration number, so that the record stays out of future updates. You may ask us for access to, or correction of, information about you (NZ Privacy Act 2020, IPPs 6 and 7). You may also complain to the NZ Privacy Commissioner or to your local data-protection authority.

We have not designated a representative in the EU or the UK under Article 27 of the GDPR or UK GDPR; contact us directly at the address below.

5b. People we write to about the dataset

Your right to object. Reply “no” to any message from us, or write to contact@tradingagentapp.com. It is free and needs no reason. We stop at once, and in any case within 5 working days, and we never write to you again.

Who we are. WU Capital Limited, a New Zealand company (company no. 9434075, NZBN 9429053731630), 17 Beltany Drive, Flat Bush, Auckland 2019, New Zealand, is the controller. Contact: contact@tradingagentapp.com. Our emails and contact-form messages come from william@tradingagentapp.com and are signed by our founder, William Wu; earlier ones came from tradingagentapp@gmail.com.

Whom we write to. We write, a few at a time and individually, to two groups: researchers whose published work suggests the dataset may be useful to them, and people at companies whose role relates to company data (for example data partnerships, credit or risk, compliance, or product), at an address their employer publishes on its own website. We also write to company or institution addresses such as partnerships@ or sales@, or use the contact form a company publishes on its own website. In the European Union and the United Kingdom we write only to such general addresses or contact forms, never to a named person's own address.

What we keep and where it came from. Your name, your professional email address, your institution or company and your title, the public page (or contact form) where we found the address (your institution's staff page or researcher directory, or your employer's website) and the date we saw it, the published work or the role our message refers to, and a record of what we sent and what you replied. The email we send names the page.

Why, and on what basis. Only to offer a researcher a dataset relevant to their published work, or to offer a company a licence to our company financial data, and to handle the reply. Our basis is legitimate interest (GDPR and UK GDPR Art. 6(1)(f)); in New Zealand, the Privacy Act 2020 allows collection from a publicly available source. This paragraph is also our published purpose of use under Article 21 of Japan's Act on the Protection of Personal Information. We do not buy lists, do not sell or share these details, do not use tracking pixels or tracked links, and make no automated decisions about you.

When we write. Only to an address, or through a company's own contact form, published in your professional capacity, by you or your employer, on a page that does not say it does not want unsolicited or sales messages, and only about matters relevant to your published work or your role. Every message is written and sent by hand; nothing is automated. If you do not reply to a first email we sent on or after 14 October 2026, we may send one follow-up, by hand, 5 to 7 business days later, and then nothing more; a message sent through a contact form gets no follow-up. Any reply from you, including “no”, means no follow-up. We never send a follow-up to anyone in South Korea, Denmark, Belgium, Germany or the Netherlands, and we do not follow up first emails sent before 14 October 2026. In the United Kingdom we write only to companies, not to sole traders or partnerships. We do not send unsolicited emails to addresses in countries where we treat prior consent as required (currently Belgium, Denmark, Germany, the Netherlands and South Korea) unless you have agreed or wrote to us first; to companies there we use only the partner or supplier forms they publish. If you are in one of those countries and received an email from us before 1 October 2026, we will not write to you again unless you reply.

Who else sees it, and where it is held. No one outside WU Capital Limited. Our mailbox is hosted by Google (Gmail), and mail sent to our tradingagentapp.com addresses is forwarded by Cloudflare; both may store or process messages outside New Zealand, including in the United States. The emails we send are relayed by Resend, Inc., which stores them in the United States. Google LLC, Cloudflare, Inc. and Resend, Inc. take part in the EU–U.S. Data Privacy Framework. We are in New Zealand, which the European Commission recognises as giving adequate protection to personal data (Decision 2013/65/EU).

How long. If you never reply, we delete everything six months after our last message. If you say no or object, we delete everything else and keep only your email address on a do-not-contact list, so that we never write to you again. If you reply and we correspond, we keep the correspondence for two years after it ends, or longer if it leads to a licence (see §6).

Your other rights. You can ask us for access to these details or a copy of them, and to correct, erase or restrict them or stop our use of them, by replying or writing to the address above. You can complain to the data-protection authority where you live or work, for example the CNIL in France (cnil.fr), the Information Commissioner's Office in the United Kingdom (ico.org.uk), the Data Protection Commission in Ireland (dataprotection.ie), the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or the Personal Information Protection Commission in Japan. We have not designated an EU or UK representative under Article 27; contact us directly.

5c. Trading Agent Data customers

If you request a data key, buy a data licence, sign an Order Form, or are named as an Authorised User or academic researcher, we collect:

• your name, work email, organisation and role;
• your API keys, and API usage logs (time, endpoint, query parameters, IP address, response size);
• billing records (Stripe identifiers and invoices; for bank transfers, the payer's name, bank and reference);
• licence acceptance records (document versions and SHA-256 hashes, time, IP address and browser details), and Order Forms;
• self-certification and audit records;
• if you subscribe, your email address for Deletions Feed notices; and
• if you are an end user or customer contact of one of our licensees, the records of the data you exported or received that the licensee gives us under its licence (who, when, which markets and entities).

We use them to provide and secure the service, to bill, to prove what was agreed, to enforce the licence, to pass on deletion and upstream-change notices, to answer a source register, public body or individual who asks who received particular data, and to meet tax law and other legal obligations. Our basis is contract (Art. 6(1)(b)) where you are the licensee. It is legitimate interests (Art. 6(1)(f)) for Authorised Users, signatories and researchers named by an organisation, and for usage logs. It is legal obligation (Art. 6(1)(c)) for tax records. The data is held with Supabase and in Cloudflare R2, and is processed by Stripe and Brevo. Records about end users and customer contacts may also be given to a source register, regulator or other public body, or to an individual who asks who received data about them, where the law allows; we give them to a body outside New Zealand only where information privacy principle 12 allows it or a law requires it. We keep licence and acceptance records, and signed Order Forms, for the life of the licence plus seven years, or until we stop trading if earlier (a Snapshot licence has no end date). We keep API request logs that include IP addresses for no more than 90 days, API usage events without IP addresses for no more than 12 months, and tax records for seven years. You may ask us for access to, and correction of, information about you (Privacy Act 2020, IPPs 6 and 7) at contact@tradingagentapp.com. We are WU Capital Limited, 17 Beltany Drive, Flat Bush, Auckland 2019, New Zealand. We tell affected customers without undue delay of a personal data breach, and transfer this information outside New Zealand, the EEA or the UK only with the safeguards the law requires. We have not designated a representative under Article 27 of the GDPR or the UK GDPR (Data Terms clause 12.6).

If you ask for an evaluation key, we also record your job title, your organisation's country and registration number (if you give it) and, when you sign the Evaluation Order Form, the box you ticked, the name you typed, the time, your IP address and browser details, and the Order Form as signed with its SHA-256 hash. We use them to prepare the Order Form, to prove what was signed, and to issue and administer the key. Once both parties have signed, we keep the signed Order Form for the life of the licence plus seven years (Data Terms clause 4.6). If no licence is formed — the link we email is never used, or the Order Form is not signed by both parties, for example because your organisation already has a key — we delete the request, with all of the above and the name, email address, organisation, intended use, IP address and browser details it holds, 30 days after the link expired.

5d. People who contact us through a data marketplace

We list Trading Agent Data on data marketplaces and directories: Datarade (operated by Monda Labs GmbH, Berlin), Neudata (London), Eagle Alpha (Dublin), Snowflake Marketplace, AWS Data Exchange and AWS Marketplace, and Hugging Face. If you ask about the data, buy it or download it there, the marketplace or directory may pass us your name, work email, company and country, and the text of your request.

We use these details only to answer your request and, if you buy, to run your licence. Our basis is taking steps at your request before a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)). Each marketplace or directory is a separate controller for what it collects itself, under its own privacy policy.

We keep enquiry details for 2 years after our last contact with you, or longer if the enquiry leads to a licence (see §6). We do not send you marketing emails, and we do not sell or share these details. You have the same rights, and can complain to the same authorities, as set out in §5b.

6. Data retention

Specific retention periods per data category (longer figures are legal-retention minimums, not internal preferences):

7. Security

Authentication is handled by Supabase using industry-standard hashing (Argon2id) and JWT sessions. Payment information is handled by Stripe and never touches our servers. All traffic is served over HTTPS with HSTS. Production secrets are stored in Vercel environment variables; access to the production database is restricted to a single service-role key held only on the server side. Two-factor authentication is available on every account via Account → Security.

In the event of a personal-data breach likely to result in a risk to your rights or freedoms, we will notify the appropriate supervisory authority (the NZ Office of the Privacy Commissioner, the EU member-state DPA, or the UK Information Commissioner's Office as applicable) within 72 hours of becoming aware of the breach, and notify you without undue delay where required. Our internal incident-response procedure is documented in INCIDENT_RESPONSE.md in the project repository.

8. International transfers

Our processors operate globally. By using Trading Agent you consent to your data being processed in the regions where these services run (primarily US and EU regions for Stripe / Brevo / Vercel; whichever region you select for Supabase and Render).

For transfers of EU / UK personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses (the 2021 modular SCCs, with the UK International Data Transfer Addendum where applicable) executed between Trading Agent and each sub-processor that requires them. Where a processor offers Data Processing Addenda based on those SCCs as part of their standard terms (Stripe, Brevo, Resend, Supabase, Vercel, Sentry, PostHog), we rely on those DPAs.

For Japan / South Korea users, data is transferred to our processors in the US and EU. We are not currently large enough to require a designated representative under APPI Art 75-3 (Japan) or PIPA Art 30-2 (South Korea). If we cross those thresholds we will appoint one and update this policy.

8a. U.S. state privacy rights

If you are a U.S. resident, your state may give you specific rights regarding your personal information. We honour these rights for all users globally, but they are guaranteed by statute for residents of the states listed below.

California (CCPA / CPRA). If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights regarding your personal information.

Other comprehensive state privacy laws. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Delaware (DPDPA), Tennessee (TIPA), Montana (MCDPA), Iowa (ICDPA), Indiana (INCDPA), New Jersey (NJDPA), New Hampshire (NHPA), Minnesota (MCDPA), Maryland (MODPA), and other states with comprehensive privacy laws are afforded substantially similar rights; the procedure to exercise them is the same as for California residents (email us — see below).

In the prior 12 months we have:

• Collected the categories of personal information listed in section 1 (identifiers, account credentials, commercial information, internet activity, inference data from product use). We do not collect the “sensitive personal information” categories defined in Cal. Civ. Code §1798.140(ae) other than account login credentials.
• Used personal information for the business purposes listed in section 2.
• Disclosed personal information only to the processors listed in section 3, under written processor agreements that restrict their use of the data to providing the service to us.
• Not sold and not shared personal information for cross-context behavioural advertising, monetary or other consideration. We do not have a “Do Not Sell or Share My Personal Information” link because there is no such selling or sharing to opt out of. If this ever changes, we will add the required link before any such activity begins.

California users have the right to:

• Know what personal information we have collected, used, and disclosed
• Delete personal information we hold about them (subject to legal-retention exceptions)
• Correct inaccurate personal information
• Opt out of sale or sharing (not applicable — we do neither)
• Limit our use of sensitive personal information (not applicable beyond credentials)
• Non-discrimination for exercising these rights

To exercise any of these rights, email contact@tradingagentapp.com with “CCPA request” in the subject. We will acknowledge within 10 business days and respond substantively within 45 calendar days (extendable once by 45 days with notice). We verify your identity by matching the email address on file with the account.

9. Changes to this policy

We'll update this page when our processors or practices change. The “last updated” date at the top reflects the latest version. Material changes will be communicated by email.

10. Contact

Questions about this policy? Email contact@tradingagentapp.com.