Privacy Policy

At Strategiz ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Information We Collect

Account Information: When you create an account, we collect your email address, name, and authentication credentials (or OAuth tokens from third-party providers like Google or Facebook).

Profile Information: Any additional information you choose to provide, such as profile picture, bio, or preferences.

Connected Account Data: When you connect brokerage accounts (e.g., Alpaca, Robinhood, Coinbase), we access read-only portfolio information including holdings, positions, and account balances. We do NOT store your brokerage passwords.

Trading Strategies: Information about trading strategies you create, including code, configurations, backtesting results, and deployment settings.

Usage Data: We collect information about how you interact with our platform, including pages visited, features used, and performance metrics.

Device Information: IP address, browser type, operating system, and device identifiers.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Create and manage your account
• Execute your trading strategies and provide backtesting services
• Sync data from connected brokerage accounts
• Communicate with you about updates, security alerts, and support
• Analyze usage patterns to improve our platform
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

3. How We Share Your Information

We do NOT sell your personal information. We may share your information only in the following circumstances:

Service Providers: We use third-party services including Hetzner (infrastructure), secure authentication and database services, HashiCorp Vault (secret management), and third-party AI providers to operate our platform. These providers are contractually obligated to protect your data.

Brokerage APIs: When you connect brokerage accounts, we communicate with their APIs (Alpaca, Robinhood, Coinbase, etc.) to retrieve portfolio data on your behalf.

Legal Requirements: We may disclose information if required by law, subpoena, or to protect our rights or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4. Data Security

We implement industry-standard security measures to protect your information:

• All data in transit is encrypted using TLS 1.3
• Data at rest is encrypted using AES-256
• API credentials stored in HashiCorp Vault with encryption
• Multi-factor authentication support (TOTP, SMS, passkeys)
• Regular security audits and vulnerability assessments
• Access controls and authentication on all services

5. Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information (subject to legal obligations)
• Portability: Request a copy of your data in a machine-readable format
• Opt-Out: Opt out of certain data processing activities
• Withdraw Consent: Withdraw consent for data processing where applicable

To exercise these rights, contact us at privacy@strategiz.ai

6. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication and session management
• Remembering your preferences
• Analytics to understand usage patterns
• Security and fraud prevention

You can control cookies through your browser settings, but disabling certain cookies may limit platform functionality.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When you delete your account, we delete your personal information within 30 days, except where required by law or legitimate business purposes (e.g., fraud prevention, legal compliance).

8. International Data Transfers

Our services are hosted on Hetzner infrastructure, which may process data in multiple regions. If you are located in the European Economic Area (EEA) or other regions with data transfer restrictions, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

9. Children's Privacy

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our platform. Your continued use of our services after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: