Privacy Policy

1. Responsible company and scope

squaredQ LLC ("SquaredQ") is responsible for its processing described here. This covers the website, registration, portal, hosted My Algo and Reader, support, CRM and communications. Contact [email protected], phone +1 54 23826281, or 1007 N Orange St., 4th Floor 6166, Wilmington, DE 19801, United States. Brokers, social providers and independent services also process information under their own notices and responsibilities.

This is an information notice, not blanket consent. Agreement to Terms does not replace separate consent where required. Rights and legal bases apply to the extent the relevant law covers the person, activity and organization. This Policy does not remove an applicable right or claim that every privacy law applies to every user.

2. Information we collect

Account and contact information: email, names, country, phone, referral/seed-link code, account and authentication identifiers, signup and verification times, profile changes and communication preferences. The authentication provider handles passwords and optional social sign-in. The SquaredQ application does not persist plaintext account passwords; a social provider can supply the profile information you authorize.

Commercial and agreement information: selected systems, plans, license quantities/assignments, prices, order confirmations, subscription and cancellation state, deletion requests, and the version and time of accepted documents. We retain Stripe customer, payment, invoice and subscription references, billing status, test/live environment, paid-through dates, tax amounts and the limited billing information needed to administer your purchases. Stripe collects the billing address and any optional business tax ID supplied at checkout, and processes them for invoicing and applicable tax treatment. Stripe collects payment-card details on its hosted checkout; SquaredQ does not receive full card numbers or card security codes. Test orders can exist without collected payment.

Brokerage and operational information: broker/account identifiers, account type and state, account values and history, buying power and permissions, allocations, leverage and risk settings, positions, orders, fills, execution/reconciliation records, errors, logs, cloud-instance and remote-access state. Broker API keys, connection secrets and strategy credentials are processed where needed for connection and delivery. These can be sensitive financial or account-access information even when partly masked.

Website, support and communication information: IP, browser/device details, approximate location from IP or supplied country, cookies/local-storage identifiers, session/security events, pages or sections viewed, referrals, chat/support content, notices, and email delivery, click or engagement information where available. Do not send credentials or unrelated sensitive information through chat or email or place it on the cloud desktop.

3. Sources, purposes and legal bases

Sources include you, authentication/social providers, connected brokers and Readers, cloud and strategy providers, CRM/messaging systems, and website or communication activity. Purposes include authentication and security; provision, operation, recovery and support; licensed signal delivery and authorized trading instructions; status/performance display; order/subscription administration; support; fraud prevention; failure investigation; evidence preservation; and legal obligations.

Relevant contact, lifecycle and usage information also supports product research, service improvement, feature recommendations, inactivity/re-engagement messages and research marketing where lawful. An operational status or CRM segment is not a credit decision or personal investment recommendation. CRM profiles do not replace broker records.

Where law requires a basis, it depends on purpose: contract performance for requested operations; legal obligations; legitimate interests in appropriate security, support, fraud prevention and service administration/improvement, subject to applicable balancing and objection rights; and consent where required for particular marketing or tracking. Withdrawing consent does not invalidate earlier lawful processing. A contract is not a substitute for legally required consent.

4. Providers, CRM and authorized operational access

Recipients include authentication providers such as Supabase and Google if selected; Stripe for hosted payments, subscriptions, invoices, payment recovery and fraud prevention; hosting, cloud-desktop and infrastructure providers; connected brokers; strategy-delivery services; email providers including Resend; CRM/chat/support providers including HubSpot; and security, professional and technical providers, for information relevant to their function. Some act on our instructions; payment providers, brokers and some providers also process information independently under their own notices. Integration records can include the relevant identifiers and logs.

HubSpot CRM profile fields include contact/profile/referral information, user identifiers, signup/verification status, strategy names/counts, lifecycle, provisioning, broker-connection/trading status, activity and cancellation state where synchronized. Billing synchronization also includes test/live environment, billing status, plan names, monthly service total and paid-through date. These updates are asynchronous and can be delayed or retried without changing the payment itself. Completed portal account deletion queues an Account deleted lifecycle update; this is not deletion of the CRM contact, and immediate delivery is not guaranteed. Broker credentials, account numbers, positions, orders, NAV, VPS secrets, signal keys and diagnostic logs are not populated as CRM profile fields. Chat is separate: information typed into it can reach the provider. Never type those secrets in chat.

Authorized staff and contractors can access service records and, as needed for delivery, maintenance, support, security, recovery or legal purposes, hosted desktops and configurations. This can expose operational or brokerage information present there. The system is not customer-only or zero-knowledge. Access restrictions and confidentiality safeguards apply; do not assume administrators cannot access information on a hosted desktop.

Relevant information can be disclosed for lawful requests, abuse investigation, legal claims, protection of people/systems or a merger, financing, sale or restructuring, with applicable confidentiality and safeguards. Business transfers do not remove purpose limits or privacy rights imposed by law.

5. Cookies, page tracking and browser choices

Essential cookies and storage support authentication, security, sessions, saved choices and account operation. HubSpot chat and tracking load on sign-in and portal pages and can receive identifiers, page/section views and a signed-in email to associate activity and support conversations with a contact. The Service does not currently offer one in-portal switch controlling all third-party tracking. Applicable notice, consent and opt-out requirements still apply; acceptance of Terms does not replace them.

Browser controls can restrict cookies/storage, but sign-in, chat or saved settings may fail. Vendor-specific controls depend on the provider. Browser blocking, marketing unsubscribe and account deletion are different actions; none automatically erases every previously collected identifier. For applicable tracking, sale/sharing or targeted-advertising choices or troubleshooting, contact [email protected]. Where law requires recognition of a universal opt-out signal, exercising that signal-based right does not require an additional email request.

We do not sell broker credentials or account-level positions, orders or NAV, or give unrelated marketers access to trade in accounts. Website/CRM disclosures may nevertheless be a sale, sharing or targeted-advertising activity under some laws without monetary payment; the preceding statement is not a blanket denial of those legal definitions. Applicable opt-out rights remain available. A Do Not Track header lacks one uniform industry response and is distinct from legally required universal opt-out signals.

6. Marketing and essential messages

Account creation currently enrolls an account in SquaredQ product/research marketing preferences; this does not mean separate express opt-in was collected in every jurisdiction. Sending remains subject to applicable marketing and consent laws. Messages may include research/monthly reports, recommendations and inactivity or re-engagement communications. Marketing includes an unsubscribe path; contact us to object or withdraw consent where applicable.

The SquaredQ unsubscribe updates the application marketing preference and stops or cancels applicable application marketing sends. It is not account deletion, paid-service cancellation, browser tracking opt-out or an automatic change to every independent provider's settings. If another communication continues, send its details so we can process the relevant request. Necessary and lawful security, purchase, readiness, cancellation and requested broker-reminder messages can continue. Promotional content does not become essential merely by being called a service message.

7. Retention, cancellation and deletion

Retention depends on purpose and record type, not one universal period. Active account, license, connection and configuration records support the relationship. Logs, telemetry, execution records and backups follow configured schedules. Agreement/acceptance evidence, commercial records and material security, abuse, dispute or legal-obligation records may remain for the relevant obligation or limitation period. Continued necessity and applicable deletion duties govern rather than a promise that all records expire together.

Service cancellation is not erasure of every record. Before account deletion, paid renewals must be cancelled in Billing; the deletion process checks that prerequisite and expires open unpaid checkout links. It then removes the authentication login and requests associated service termination, but termination is asynchronous and operational, legal and transaction records can remain where justified. It does not instantly purge broker/provider data, backups or CRM records. The queued CRM lifecycle update records Account deleted without itself erasing the CRM contact. Request applicable privacy erasure or provider-specific correction separately; we assess the request and lawful exceptions under relevant law.

Backups are not ordinarily edited item by item; restricted copies can remain until rotation or a lawful hold ends. Restoration does not permit disregard of a valid deletion or suppression request. Brokers and independent controllers retain their own records under their obligations. Information that is anonymized to the applicable legal standard and cannot reasonably identify you can be retained separately.

8. Security and sensitive information

We use reasonable administrative and technical safeguards appropriate to the information, including access controls, credential separation and encryption where implemented. Hosted Readers process broker secrets and authorized operators maintain the environment; this is not a promise of end-to-end encryption, zero operator access, perfect security or immunity from breach. Protect your devices and credentials and report suspected compromise to us and the relevant broker.

Do not send health information, government identity numbers or unrelated sensitive data through support chat. If verification is necessary, use the instructed channel, not an unsolicited credential request. Sensitive account data serves relevant service, security and legal purposes; applicable rights to limit particular uses remain. No contract removes mandatory security or breach-notice obligations.

9. Your choices and rights

Use My Account for available profile/password controls, Billing for cancellation and email unsubscribe for application marketing. Send privacy requests to [email protected] with the request and relevant account email. Do not include passwords, broker secrets or full identity documents initially. We may seek proportionate identity/agent verification and explain any applicable refusal or limitation.

Applicable rights may include confirmation of processing, access/copy, correction, deletion, portability, restriction, objection to legitimate-interest processing or direct marketing, consent withdrawal, opt-out of sale/sharing, targeted advertising or certain profiling, and limitation of sensitive-data uses. Appeal a denied request by replying with Appeal and its reference. We respond within applicable statutory periods, explain permitted extensions and do not unlawfully discriminate for exercising rights. Legal retention, others' rights, security and statutory exceptions may limit requests.

California residents can request applicable category/specific-information disclosures and exercise covered CCPA/CPRA rights, including sale/sharing and sensitive-information choices where those laws apply. EEA, UK and other residents can exercise applicable rights and complain to a competent data-protection authority. Contact us for the request route or an explanation of applicability. This notice does not claim a legal exemption or waive rights.

10. International processing, third parties and age limits

SquaredQ and providers can process information in the United States and other operating countries. Protection and government-access rules can differ. Transfers requiring a lawful mechanism must rely on an applicable mechanism; this notice is not itself that mechanism or a transfer certification. Contact us for information about relevant arrangements and legally available safeguard details.

Linked sites, connected brokers, social providers and independent third parties have their own information practices. Review their notices and permissions; this Policy does not control independent processing. We do not knowingly offer accounts to anyone under 18 or seek children's information. Report suspected information from a minor so we can investigate and take appropriate action.

11. Changes and contact

We publish an updated effective date and provide additional notice or consent where law requires. Posting or continued use is not consent to a materially different use when a separate affirmative choice is required. Legal acceptance does not extinguish privacy rights or a valid later withdrawal of consent.

Privacy questions, rights requests and appeals: [email protected]; phone +1 54 23826281. squaredQ LLC, 1007 N Orange St., 4th Floor 6166, Wilmington, DE 19801, United States.