Legal

PRIVACY POLICY

Last updated October 19, 2026

This privacy notice explains how the operator of MarketAI (“we,” “us,” or “our”), collects, stores, uses, and shares (“process”) your personal information when you use our services (“Services”), such as when you:

• Visit our website at https://app.marketai.trade/, or any website of ours that links to this privacy notice
• Redeem an invitation, hold an account with us, and use the member area, including your bots and the feeds they follow
• Write rules, build feeds from them, and try them in the playground
• Run the MarketAI connector, which connects to the Services with your bot’s token
• Receive emails from us, or write to us

Who is responsible. We are the controller of the personal information described in this notice, under the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 on data protection (LOPDGDD). MarketAI is a trade name, not a company: the controller is the operator of MarketAI, a self-employed person established in Spain. You can reach the controller at privacy@marketai.trade. Words such as “bot,” “feed,” “ruleset,” and “connector” have the meanings given in our Terms and Conditions.

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you have any questions or concerns, please contact us at privacy@marketai.trade.

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? Your email address and password (which we store only in a form we cannot read back), the record of your acceptance of our Terms, your bots and their settings, your rulesets, feeds, and plans, and technical information such as IP addresses. We collect nothing about your exchange or broker account. Learn more about the information we collect.

Do we process any sensitive personal information? We do not process special categories of information, such as health or biometric information. We do process your sign-in credentials, which some laws treat as sensitive. We use them only to provide the Services. Learn more about sensitive information.

Do we receive any information from third parties? No. We never access your exchange or broker account, and we receive nothing about it from anyone. Learn more about your exchange or broker account.

How do we process your information? To provide, secure, and administer our Services, to keep a record of our contract, to communicate with you, and to comply with law. We do not use your information for advertising, and we do not use analytics services. Learn more about how we process your information.

With whom do we share personal information? With the service providers that host our Services and send and receive our email, and in the specific situations described in this notice. We do not sell your personal information. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information, including encrypted connections, and passwords and bot tokens stored only as hashes. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? You have the rights the GDPR gives you, wherever you live: to access, correct, and delete your information, and more. You can also complain to the Spanish Data Protection Agency or to the authority where you live. Learn more about your privacy rights.

How do you exercise your rights? By emailing us at privacy@marketai.trade. We will answer within one month.

Want to learn more about what we do with any information we collect? Review the privacy notice in full.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you provide to us when you redeem an invitation, set up and use your account, accept our Terms, create bots, write rules, or write to us. It includes:

• Your email address. It identifies your account and is the address you sign in with. Accounts opened before invitations may also have a separate username.
• Your password. We store it only as a salted hash, a form from which it cannot be read back.
• Your invitation. The invitation code you redeem, and when you redeemed it. When we create an invitation code, we may add a note saying whom it is for, which may include your name.
• Your acceptance of our Terms. When you tick the boxes to accept our Terms and Conditions and to confirm that you are 18 or older, we record which version of the Terms you accepted, which version of this notice you were shown, when, your email address, and the IP address you accepted from.
• Your bots. The names you give your bots, the feed, leverage, and other settings you choose for each (such as the most one market may hold, a stop-loss and take-profit, and a price limit), and whether it is active or paused. A bot’s token is stored only as a hash, together with its first few characters so that you can tell tokens apart.
• Your rulesets, feeds, and plans. The rules you write or copy, the names you give them, the markets your feeds follow, and the plans you save in the playground, with the amounts and settings you try there. These are figures you choose, not information about your account.
• Your messages to us. If you write to us, your email address, the content of your message, and anything you include with it.

Sensitive Information. We do not process special categories of personal information, such as information about health, racial or ethnic origin, religious beliefs, sexual orientation, or biometric or genetic data. Some laws treat as sensitive an account log-in combined with the password that gives access to it, and financial account information combined with the credentials that give access to the account. We process such information (your email address and password) only to provide the Services, and never to infer characteristics about you. We never ask for, or hold, any credential for your exchange or broker account.

Past payments. The Services are free, and we collect no payment information. If you paid us for access to the Services in the past, Stripe processed that payment and keeps its own records of it under its privacy notice; we removed old Stripe identifiers from our active systems in September 2026.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Your exchange or broker account

In Short: We never access your exchange or broker account, and we collect no information about it.

Your bot trades through the MarketAI connector, which you run on your own computer or server, with your own credentials for your exchange or broker account. We never receive those credentials. We do not ask for or accept any key to your account, read-only or otherwise, and we do not read or store its balance, deposits and withdrawals, orders, trades, fees, or positions. The connector does not report them to us either: see “Information automatically collected” for what it sends.

Information created when you use the Services

In Short: Our systems record how your account and bots are set up, their history, and the targets we send your bots.

• Account records: when your account was opened, when you last signed in, when you confirmed your email address, whether your account is approved for trading, the number of bots you may have, and whether your account is active.
• Bot records: when each bot was created, when its token was last issued, when its connector was last seen, and its trading state (for example, active or paused), with a history of each change of that state, which we keep after a bot is deleted.
• Your bots’ paper portfolios and targets: for a bot on one of your own feeds, the simulated portfolio we run with its settings, and each target portfolio we send it. They are worked out from market data and your bot’s settings, never from your account.
• Activity records: our systems record some actions with your account’s internal number, for example that an account was opened, that a password was chosen, or that a bot was deleted. Actions taken in our administration pages are recorded too.

Information automatically collected

In Short: Some information, such as your Internet Protocol (IP) address and browser characteristics, is collected automatically when you visit our Services or your connector connects to them.

When you visit, use, or navigate the Services, and when your connector connects to them, our servers receive your IP address and information your browser or connector sends with each request, such as its type and version. This information is needed to deliver the Services, to keep them secure, and to diagnose problems. It includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, browser type and settings, the date and time of a request, the pages and interfaces requested, and error reports.
• Security counters. We use your IP address, and the email address or account involved, to limit repeated attempts, such as wrong invitation codes, failed passwords, and requests for private links or password resets. These counters are kept in temporary storage and expire on their own after ten minutes to one hour.
• Connector connections. Your connector sends us only your bot’s token, to receive the bot’s settings, signals, and targets; it sends nothing about your exchange or broker account. When it connects, and about once a minute after that, we check the token and record when the bot was last seen. Like any request, its connection comes from the IP address of the computer it runs on, which we treat as the log data above.

We do not collect your precise location, and we do not use your IP address to work out where you are.

We use only cookies that are strictly necessary for the Services to work. You can find out more about this in our Cookie Policy: https://app.marketai.trade/cookies/.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, secure, and administer our Services, to keep a record of our contract, to communicate with you, and to comply with law.

We process your personal information for the following purposes:

• To create your account and let you sign in. This includes redeeming your invitation, sending you the private link that confirms your email address, letting you choose and reset your password, and keeping you signed in.
• To provide the Services. This includes showing you feeds and their results, storing and running your rules and feeds, replaying them on past market data, running your bots and their paper portfolios, sending your bots’ signals and targets to your connector, and showing you the state of your bots.
• To support you. Our staff can see your bots, rulesets, and feeds, to help you with them and to check that the Services work.
• To keep a record of our contract. We record your acceptance of our Terms, as evidence of what you agreed to and when.
• To communicate with you. We send you the emails the Services need: your invitation and private link, a copy of the Terms you accept, password resets, and notice of changes to the Services or to our terms. We reply to your messages. We do not send marketing emails.
• To protect our Services. We process information to keep our Services safe and secure, including limiting repeated attempts, preventing fraud and abuse, and investigating security incidents.
• To operate and fix the Services. We use logs and error reports to find and fix problems. We do not use your personal information to train our prediction models; they are trained on market data.
• To request feedback. We may contact you to ask about your use of our Services.
• To comply with law and enforce our terms. We may process your information to comply with legal obligations, to respond to lawful requests, to enforce our Terms and Conditions, and to establish, exercise, or defend legal claims.
• To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

Automated decisions. Some things in the Services happen automatically, by fixed rules: for example, a bot stops receiving signals when its feed is withdrawn or stops running, and repeated wrong attempts are refused for a while. They are necessary to provide the Services under our contract with you. You can ask us to have a person review any of them by contacting us.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we have a valid legal reason (a legal basis) to do so under the GDPR: to perform our contract with you, to comply with the law, for our legitimate interests, or to protect someone’s vital interests.

The GDPR requires us to explain the legal bases we rely on to process your personal information. They are:

• Performance of a Contract. We process your personal information when it is necessary to perform our contract with you (our Terms and Conditions), or at your request before entering into it. This covers your account and sign-in, your bots, their signals and targets, your rulesets and feeds, and the emails the Services need.
• Legal Obligations. We process information where the law requires it, such as to answer lawful requests from courts and authorities.
• Legitimate Interests. We process your information when it is reasonably necessary for our legitimate interests and those interests are not overridden by your interests and fundamental rights and freedoms. We do so in order to:
  • Keep the Services secure, limit repeated attempts, and prevent fraud and abuse
  • Diagnose and fix problems, and keep backups
  • Keep the history of each bot’s trading state, including after the bot is deleted, so that we can answer questions about it later
  • Keep evidence of our contract, including the record of your acceptance of our Terms and the IP address you accepted from, and establish, exercise, or defend legal claims
  • Record whom we invited
• Vital Interests. We may process your information where it is necessary to protect your vital interests or the vital interests of another person, such as situations involving potential threats to the safety of any person.
• Consent. We do not rely on your consent for any of the processing in this notice, and we do not need it for cookies, because we use only strictly necessary ones. If we ever ask for your consent for a specific purpose, you can withdraw it at any time. Learn more about withdrawing your consent.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers listed in this section, and in the specific situations described below. We do not sell your personal information.

Service providers. We use the following service providers, which process personal information for us:

We also use Google Cloud to store the software images our servers run and the files of our prediction models. We do not store personal information there.

Content delivery networks. The pages you see after you sign in load some open-source software libraries (for example, for charts and icons) from public content delivery networks, jsDelivr (cdn.jsdelivr.net) and the jQuery CDN (code.jquery.com), and a font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser loads them, it sends those networks your IP address and information about your browser, as with any web request. We do not send them any other information, and they do not set cookies. Our public pages, including the sign-in, invitation, and legal pages, load nothing from third parties.

Your exchange or broker. We never contact your exchange or broker about you, and we share nothing with them.

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, a transfer of MarketAI, in whole or in part, to another person or business.
• Legal Requirements. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, or where necessary to protect our rights, our users, or others.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use only cookies that are strictly necessary for the Services to work. We do not use analytics, advertising, or tracking technologies.

We use three first-party cookies that are strictly necessary: one that keeps you signed in, one that protects our forms against cross-site request forgery, and one that carries a one-time notice to the next page you see. We do not use analytics or advertising cookies, third-party cookies, web beacons, or tracking pixels. Details of each cookie are set out in our Cookie Policy: https://app.marketai.trade/cookies/.

Until September 26, 2026, our website also loaded a third-party analytics service, an advertising tag, and a consent tool. We removed them that day.

6. IS YOUR INFORMATION TRANSFERRED OUTSIDE THE EUROPEAN UNION?

In Short: We store your information in Finland, in the European Union. Some of our service providers are in the United States, and we protect those transfers as the GDPR requires.

We store the personal information we hold on servers in Finland, in the European Union. We work from Spain, and backup copies of our database are kept on our server and on a computer under our control in Spain.

Some of our service providers are in the United States or process information there: Resend, Namecheap, Google, and the content delivery networks described in section 4, which operate worldwide. We protect these transfers with the EU-U.S. Data Privacy Framework where the recipient is certified under it (Resend and Google are), and with the European Commission’s Standard Contractual Clauses, which Resend and Namecheap include in their data processing terms. You can ask us for a copy of these safeguards by contacting us.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law. In particular:

• Your account, bots, rulesets, feeds, and plans, including your bots’ state history, paper portfolios, and targets: for as long as your account is open. When your account is closed, we delete or anonymize this information within three (3) months, except as described below.
• The record of your acceptance of our Terms, including the IP address you accepted from: for as long as your account exists and, after it is closed, for as long as claims about our contract could be brought (in Spain, generally five (5) years); then we delete it. We keep the IP address only as part of this evidence.
• Invitation records: we keep a record that each invitation code was used. When your account is deleted, the record no longer points to you, and we delete any note that names you.
• Security counters: expire on their own after ten minutes to one hour.
• Server logs and error reports: for a limited period, as needed to operate and secure the Services.
• Emails we send: we do not keep copies of the emails we send. Resend keeps records of them for a limited period under its own terms.
• Your messages to us: in our mailbox, for as long as needed to deal with them and keep a record of our correspondence.
• Backups: backup copies contain the information above and are deleted when they are no longer needed.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. They include:

• The Services are served only over encrypted connections (HTTPS), and browsers are told to use nothing else.
• Passwords are stored only as salted hashes, made with a deliberately slow algorithm.
• Bot tokens are stored only as hashes, and are shown to you once.
• We hold no credential for your exchange or broker account, so none can be taken from us.
• Private links work once and expire after 24 hours, and a link opens a page with a button rather than signing you in, so that email scanners that open links cannot use it up.
• Repeated attempts are limited: wrong invitation codes, failed passwords, and requests for private links and password resets.
• Invitation codes are never written to our logs, and tokens that appear in our request logs are cut short so that they cannot be used.
• Access to personal information is limited to the people who run MarketAI.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. The Services are only for people who are at least 18, and everyone who opens an account confirms it. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@marketai.trade.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You have the rights the GDPR gives you, and you can complain to a data protection authority. You may review, change, or close your account at any time by contacting us.

Under the GDPR you have the right to:

• Access the personal information we hold about you, and receive a copy of it;
• Rectification: have inaccurate information corrected, and incomplete information completed;
• Erasure: have your information deleted, where we no longer need it or have no legal reason to keep it;
• Restriction: have us limit the processing of your information, for example while we check a request of yours;
• Portability: receive the information you gave us, and that we process under our contract, in a structured, commonly used, machine-readable format, or have it sent to someone else;
• Object to processing based on our legitimate interests;
• Not to be subject to a decision based solely on automated processing that significantly affects you, and to have a person review an automated decision, give your point of view, and contest it; and
• Withdraw your consent at any time, where we rely on it (we do not today).

To use any of these rights, email us at privacy@marketai.trade, if possible from the email address of your account. We may ask you to confirm your identity first. It is free of charge. We will answer within one month, which we may extend by up to two further months for complex or numerous requests, telling you why within the first month.

Complaints. If you think we process your personal information unlawfully, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, or to the data protection authority of the EU country where you live or work. We would like to hear from you first, but you do not have to contact us before you complain.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time, by contacting us using the details in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?” below. This will not affect the lawfulness of the processing before its withdrawal, or processing based on other legal grounds.

Account Information

If you would at any time like to review or change the information in your account or close your account, you can:

• See your email address on your profile page, and change your password in the Services.
• Pause, activate, or delete your bots, and change their leverage and settings, on My bots. A bot’s feed cannot be changed.
• See and manage your rulesets and feeds in the member area.
• Contact us using the contact information provided, to change your email address or to close your account.

Upon your request to close your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements, as section 7 describes.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. Because we use only strictly necessary cookies, rejecting them will prevent you from signing in. For further information, please see our Cookie Policy: https://app.marketai.trade/cookies/.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. Some browsers also send a Global Privacy Control (“GPC”) signal. We do not track your browsing across websites, and we do not sell or share your personal information or use it for targeted advertising, so these signals do not change how we process your information.

12. WHAT IF YOU LIVE OUTSIDE THE EUROPEAN UNION?

We apply this notice, and the rights in section 10, to everyone, wherever they live. If the law where you live gives you other rights, for example in the United Kingdom, Switzerland, or a state of the United States, you can use them by writing to us at privacy@marketai.trade, and we will answer as that law requires. We do not sell your personal information or share it for targeted advertising.

If you live in the United Kingdom, you can also complain to the UK data protection authority (the ICO). If you live in Switzerland, you can contact the Federal Data Protection and Information Commissioner.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes to the Services.

We may update this privacy notice from time to time. The updated version will be indicated by an updated “Last updated” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we will notify you by email or by prominently posting a notice of such changes in the Services. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@marketai.trade

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You may have the right to request access to the personal information we collect from you, change that information, or delete it (section 10). To request to review, update, or delete your personal information, please email us at privacy@marketai.trade from the email address of your account.