Privacy Policy

Introduction

TradeVista Technologies Inc. ("RiskFloor", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform, including all features related to market briefings, journaling, personal trading rules, coach mode, reviews, insights, behavioral analysis, and subscription access (collectively, the "Platform").

We handle personal information in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA). Where the EU or UK General Data Protection Regulation applies to you, additional information is set out in Additional Information for EU and UK Users below.

What Leaves RiskFloor: A Summary

The detail follows, but in short:

• Market briefings are built from market data only, meaning prices, indicators, news, calendar events, and positioning. No information about you is included.
• Text you write, such as your thesis, your rules, and your outcome notes, is sent to a third-party AI provider for analysis when you ask for it. Your name, email address, and account identifier are never sent with it.
• Product analytics (PostHog) receives your account identifier, email address, username, and the pages you visit while signed in.
• Website analytics (Google Analytics) receives your IP address, browser and device information, and the pages you visit, whether or not you have an account.
• Error monitoring (Sentry) receives technical details when something on our servers fails.
• We never receive your broker credentials. RiskFloor does not connect to brokerage accounts, does not receive broker passwords or API keys, and does not place or execute trades.

Information We Collect

Information you provide

• Account information (such as name, email address, and authentication credentials)
• Trading preferences and platform settings
• Journal entries, notes, reasoning, and related content
• Rulebook definitions and rule usage data
• Review and outcome data
• Coach mode interaction data
• Communications with our support team

Information generated through your use of the Platform

• Generated briefings, reports, and insights
• Behavioral and decision-pattern data derived from platform usage
• Subscription and billing metadata

Information collected automatically

When you visit the Platform, we and our analytics providers automatically collect:

• IP address
• Browser type, version, and settings
• Device type, operating system, and screen dimensions
• Referring website address
• Campaign parameters in the URL you arrived from (UTM parameters)
• Pages you visit and the order in which you visit them, including page addresses that contain record identifiers, such as the address of a specific briefing you open
• Approximate location derived from IP address
• Interaction events such as clicks, scroll depth, and form engagement

We may receive subscription, billing, and transaction-related metadata from secure payment processing providers and merchant-of-record partners. We do not store full payment card details.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features
• Generate structured briefings, reviews, insights, nudges, and related outputs
• Support journaling, rulebook, coach mode, and review features
• Derive behavioral and decision-pattern analysis as part of the Platform's core functionality
• Process your transactions and manage your subscription and account access
• Send you transactional notices, service updates, and support messages
• Monitor platform performance, reliability, errors, and abuse
• Respond to your comments, questions, and support requests
• Comply with legal obligations and protect against fraudulent or illegal activity

Automated Analysis and Machine-Generated Content

Briefings, quality scores, reviews, and insights on the Platform are generated by automated systems, including third-party large-language-model providers. These outputs are informational and are not financial advice, investment recommendations, or instructions to enter a transaction.

Market briefings use market data only

Market briefings are generated from market data: prices, technical indicators, news headlines, economic calendar events, positioning data, and related market context. No account information, identifiers, or information about you is included in briefing generation.

Text analysis uses content you have written

Some features analyze text you have written on the Platform. These include compiling a rule you have written into a structured rule the Platform can check against, and promoting a resolved decision into a playbook.

When you use one of these features, the text you wrote is sent to a third-party large-language-model provider for analysis. This happens when you request the analysis, by choosing to compile a rule or to promote an entry. It does not happen automatically as you type or as you browse.

We do not send your name, email address, account identifier, or authentication token with that text. The provider receives the text and nothing that connects it to your account.

However, you should understand what this means in practice. The text is yours, and it may contain information that identifies you if you choose to include it, for example if you write about your broker, your position sizes, your employer, your location, or your personal circumstances. We do not remove or filter what you write. For that reason we treat this content as information that may be personal to you, and the large-language-model provider is treated as a service provider handling your information, not as a recipient of anonymous data.

Choose what you write accordingly. If you would prefer not to send a particular rule or entry for analysis, do not use the analysis features for it. Your journal, rulebook, and records remain fully usable without them.

We may change or add large-language-model providers as the Platform develops.

Behavioral and Decision-Pattern Analysis

The Platform analyzes your decision history, journal entries, rule usage, and related activity to generate behavioral insights, coach mode nudges, and review summaries. This analysis is a core part of the Platform's functionality and is intended to support personal review and self-awareness in the context of trading decisions.

This analysis is informational and reflective only. It does not constitute therapy, mental health services, psychological assessment, or professional coaching.

Cookies and Similar Technologies

Cookies

The Platform uses cookies stored against our domain and created by our analytics providers' software. These cookies are set when you first load a page, including if you are not signed in and have not created an account.

We do not currently operate a cookie consent banner. These analytics cookies are set on your first page load. We do not use cookies for authentication, and the Platform sets no strictly necessary or functional cookies of its own.

You can block or delete cookies through your browser settings. Blocking analytics cookies does not affect your ability to use the Platform.

Our public tools pages, meaning the economic calendar, currency strength meter, COT positioning dashboard, and pip calculator, do not load analytics and set no cookies.

Browser storage

The Platform stores information in your browser's local and session storage. This is stored on your device and is not a cookie. It includes:

• Authentication tokens that keep you signed in
• A cached copy of your account record, including your email address and username
• Interface preferences such as density and contrast settings
• Unsaved drafts of reports and other content you are composing

You can clear this at any time through your browser settings. Clearing it will sign you out and may discard unsaved drafts.

Third-Party Services

We use the following third-party providers to operate the Platform. Each is subject to its own privacy policy and terms.

Providers that receive information about you

PostHog: product analytics. Receives your user identifier, email address, username, account role, page addresses you visit, and interaction events. Used to understand how the Platform is used and to improve it. PostHog processes this information in the United States.

Google Analytics: website analytics. Receives your IP address, browser and device information, referring website, campaign parameters, and the pages you visit.

Google (Sign-In): authentication. If you sign in with Google, Google receives your authentication request. Google's sign-in library loads on our authentication pages, and Google may receive your IP address when those pages load, whether or not you choose to sign in with Google.

Sentry: error monitoring. Receives error reports from our servers, including the address of the request that failed, the IP address associated with it, and browser information. Used to detect and diagnose faults.

Lemon Squeezy: payment processing and merchant-of-record services. Receives your email address, username, user identifier, and the information required to process your payment and handle taxes. We do not store full payment card details.

Amazon Web Services (AWS): hosting and transactional email. Our infrastructure runs on AWS, and account emails such as sign-in links and service notices are sent through Amazon Simple Email Service.

Large-language-model providers: automated analysis. Receive the text you submit for analysis, as described in Automated Analysis and Machine-Generated Content above, without your name, email address, or account identifier.

Providers that receive no information about you

The following providers supply market data and content used to build briefings. They receive market queries, such as an asset symbol or a search term, and nothing about you.

Financial Modeling Prep (FMP): market data for asset prices, fundamentals, and macro-economic data.

OANDA: market data for forex pricing and historical FX series.

NewsAPI, Serper, and ScrapingDog: news headlines and web search results used to build market context.

Information Sharing

We do not sell your personal data. We may share your information only in the following circumstances:

• With your consent
• With the service providers listed above, for the purposes described
• To comply with legal obligations, court orders, or regulatory requirements
• To protect the rights, safety, or property of RiskFloor, our users, or others

Cross-Border Processing

RiskFloor is operated from Canada. Our infrastructure and several of our service providers process information in the United States, including PostHog. Other providers may process information in the United States or other jurisdictions.

Information processed outside Canada may be subject to lawful access requests by the courts, law enforcement, and national security authorities of the jurisdiction in which it is processed.

Commercial Electronic Messages

Where required by applicable law, including Canada's Anti-Spam Legislation (CASL), we obtain your consent before sending commercial electronic messages such as product updates, newsletters, or promotional communications. You may withdraw your consent or manage your communication preferences at any time by using the unsubscribe mechanism included in each message or by contacting us directly.

Messages that solely confirm a transaction, provide factual information about your account or subscription, deliver a service you are entitled to, or address a security matter may be sent without separate marketing consent, as permitted by applicable law. We do not include promotional content in those messages.

Data Security

We implement reasonable technical and organizational safeguards to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These safeguards are designed to be appropriate to the sensitivity of the information we collect.

However, no method of transmission over the Internet or electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

Data Retention and Deletion

We retain your personal information for as long as your account is active or as reasonably needed to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements.

When you delete your account:

1. Your account is immediately deactivated and you can no longer sign in.
2. Your data enters a 30-day recovery period, during which you may contact us to restore the account.
3. After that period, your account data is deleted from our active systems.

Some information may persist beyond that:

• Billing and transaction records we are required to retain for tax and accounting purposes
• Information subject to a legal hold, dispute, or investigation
• Information held by our service providers, which is governed by their own retention practices and which we do not control directly
• Backups, which are overwritten on their own cycle

If you have questions about what is retained in your specific case, contact us using the information below.

Children and Minors

The Platform is intended for adults and is not directed to children. If you believe a minor has provided us with personal information, please contact us and we will review the matter and delete the information where appropriate.

Your Rights

Subject to applicable law, you have the right to:

• Access and receive a copy of your personal information held by RiskFloor
• Request correction of inaccurate or incomplete personal information
• Request deletion of your personal information
• Request a copy of your information in a portable format
• Withdraw consent to certain processing of your information
• Object to or restrict certain processing of your information
• Request information about our privacy practices and policies

We may decline a deletion request only where we are legally required to retain the information, where it is needed to detect or prevent fraud or abuse, or where it is required to establish, exercise, or defend a legal claim. We will tell you if that is the case and why.

To exercise any of these rights, contact our Privacy Officer using the details below.

Additional Information for EU and UK Users

If you are in the European Economic Area or the United Kingdom, the following additional information applies.

Controller. TradeVista Technologies Inc. is the controller of your personal information. Contact details are below.

Legal bases for processing. We rely on the following:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You may object to that processing at any time.

International transfers. Your information is transferred outside the EEA and the UK, principally to Canada and the United States. Canada benefits from a partial adequacy decision from the European Commission for commercial organizations subject to PIPEDA, and the UK maintains equivalent adequacy arrangements. Where information is transferred to providers in jurisdictions without an adequacy decision, we rely on the transfer terms in those providers' standard agreements. You may contact us for further information about the safeguards that apply.

Retention. See Data Retention and Deletion above.

Your rights. In addition to the rights listed above, you have the right to lodge a complaint with your national supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EEA, this is the supervisory authority of the country in which you live or work.

Providing your information. Account information is required to create and use an account. Journal entries, rules, notes, and other content are entirely optional. The Platform works without them, though features that depend on them will be limited.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and may provide additional notice. Changes take effect on the date stated.

If we intend to use your personal information for a materially different purpose than the one for which it was collected, we will tell you and, where required by law, obtain your consent before doing so.

Contact Us

Privacy Officer
TradeVista Technologies Inc.
privacy@riskfloor.ai

For privacy questions, access or correction requests, deletion requests, or complaints, contact our Privacy Officer at the address above. We will respond within the timeframe required by applicable law.

You may also contact the Office of the Privacy Commissioner of Canada if you have concerns about our privacy practices: www.priv.gc.ca