Privacy Notice
Last updated
Skip to the start of the Privacy Notice1. Who we are
AlsaTitan — the website at www.alsatitan.com, including the signed-in app — is provided by Alsatronix Solutions DMCC (licence no. JLT-66355), Unit UT-11-CO-23, DMCC Business Centre, Level 11, Uptown Tower, Dubai, United Arab Emirates.
We are the controller of your personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR). This notice explains what we collect, why, who receives it, how long we keep it and what rights you have.
For questions or requests about your data, email [email protected].
2. In short
- We use your data to run your account and AlsaTitan's tools, to take payments and to keep the service secure.
- If you choose to answer the optional questions about yourself, we use them to understand who uses AlsaTitan and to shape our offers. We email you offers only if you tick the box for them (section 3.16).
- We do not sell your personal data, and we use no advertising cookies.
- What you type or say to an AI feature goes to the AI provider that answers it. We do not keep it in our activity log.
- You can delete your account in Settings at any time (see section 10).
- Paper trading in AlsaTitan is simulated: no real orders are placed. Nothing in AlsaTitan is financial advice.
3. What we collect and why
This section lists what we collect, activity by activity. Section 4 gives the legal reason for each use, and section 8 how long we keep it.
3.1 Your account
If you sign up with an email code, we collect your name, email address and password. We store your password only as a bcrypt hash, which cannot be turned back into the password.
While you enter the code we emailed you, your name and a bcrypt hash of your password are held in our server's memory. Your password itself is hashed before the code is sent. They are discarded as soon as your account is created, and in any case 30 minutes after the last code we sent you.
An account created with an email code is stored in our database, like every other account, until you delete it. If you sign up again with an address that already has an account, we do not create a second one.
If you use Continue with Google, Google gives us your name, your email address and a link to your Google profile picture. We ask Google only to confirm who you are, and we keep no Google access key for signing in.
You can change your name and phone number in Settings → Edit Profile. To correct the email address of your account, contact us. An administrator can change it: we email a link to the new address, and we tell the current address, with a link to cancel the change. The change takes effect 24 hours after it was requested, once the new address has confirmed it and if no one has cancelled it. You are then signed out everywhere and sign in with the new address.
3.2 Payments
When you subscribe, you give us your name, email address and billing address and, if you choose, your phone number. We give Stripe, our payment provider, which runs the checkout page, your email address. You type your card details on Stripe's page; they never reach us.
Until your purchase is set up, we keep your name, billing address and phone number on our server, encrypted and tied to that one checkout and to a hash of your email address (a one-way scrambled form of it, from which the address cannot be read back), so that deleting your account deletes them too. When the payment succeeds, we copy them into your account, except any your account already holds, and delete the encrypted copy. If you do not finish, we stop using them after 24 hours, and our cleanup, which runs every 30 minutes, deletes them within half an hour after that.
When your payment goes through, Stripe creates a customer record with your email address and what you typed on its page. When a payment succeeds, we create your AlsaTitan account from your details, if you do not have one, and email you a link to set your password if your account has none. Before 21 October 2026, Stripe created a customer record with your email address and name as soon as you selected Continue to Payment, even if you did not then pay. Before 21 October 2026, we also gave Stripe, with each checkout, the billing address and, if you gave them, the phone number and company you typed on our form. Stripe keeps those checkout records in our Stripe account; deleting your account does not remove them (section 10).
To switch between monthly and annual billing, or to cancel, email [email protected] and we will confirm by email; there is no self-service screen for it.
We keep your plan, the status and dates of your subscription, the amounts you paid, your billing address and phone number, and the identifiers Stripe gives your customer record and subscription.
3.3 Signing in and security
When you sign in, we set a session cookie that lasts up to 7 days. If your account has a password, the session is tied to it: changing or resetting your password ends every session signed in with the old one, and Sign Out of All Devices in Settings ends them all.
When you sign out, we keep a record so that the session cannot be used again. A record for one session holds only that session's random code and expires when the session would have (at most 7 days). A record that ends all your sessions — after Sign Out of All Devices, a password change or deleting your account — holds a hash of your email address (see section 3.2), not the address itself, and expires after 90 days. Expired records are deleted when we next clean up these records.
After you sign in with a password, we set a __Host-signin_device cookie for 90 days. It holds a random code, the time it was issued and a signature — not your email address. It only lets us count this browser's sign-in attempts separately from other people's attempts on your address.
To stop password guessing, we count sign-in attempts in our server's memory, per internet address and per email address, for up to an hour. A refused password sign-in is answered no sooner than half a second after we start checking it, to make it harder to learn from the timing whether an account exists.
We use Cloudflare Turnstile, a check that tells people from automated programs, on sign-up, code resend, password reset and the newsletter form, and on sign-in when we see unusual load. Your browser loads it from challenges.cloudflare.com, and Cloudflare collects technical information from your browser to run the check (see Cloudflare's privacy policy). We then send Cloudflare the result of the check and, when we know it, your IP address. On our public pages, the newsletter's check loads only when you start using the form.
3.4 AI features
When you use an AI feature, what you type or say is sent to the AI provider that answers it, together with the conversation so far, the market data the answer needs and, when a tool needs them, your watchlist or paper-trading positions. Section 5 lists the providers.
When you talk to a voice assistant, the audio goes from your browser straight to Google Gemini Live or OpenAI Realtime, using a short-lived key from our server. GOAT Mode and the Titan copilot, whether you type or speak, are told your name, email address and watchlist, the balance and open positions of your paper-trading account and, if you answered the setup questions, how you trade: your experience, trading styles, markets, goals, how you handle a losing trade, how you want answers worded and the guide you chose. They are not told your answers about yourself (section 3.16). When you dictate, the recording passes through our server to Google Gemini or OpenAI to be written out. Our servers do not store your recordings or transcripts; some assistants keep recent conversations in your browser (section 7).
During a voice session with GOAT Mode or the Titan copilot, when you ask about something on your screen ("what is this?"), the assistant reads the item under your mouse pointer: its visible text or label, the title of the section it is in and, on a chart, the symbol, the timeframe and the prices and indicator values at the pointer. Only that description is sent, never an image of your screen: to the voice provider and, when the assistant hands a hard question to a reasoning model, to the AI provider that answers it (section 5). It is not stored. It never includes what is in a field you type into or your own messages in our AI chats, parts of a page marked private, or anything on the administration, settings, connections, sign-in and payment pages, and email addresses and keys in the text are masked.
When the voice assistant hands a hard question to a reasoning model, that model's AI provider receives your question, the last few turns of the conversation, the list of windows you have open (their titles, symbols and timeframes) and, only if you pointed at something, the description above (section 5). To answer, the reasoning model looks up market data and the positions and watchlist of your demo account itself. Our server keeps none of it once the answer is sent.
We keep the chats and work you save in AI features — AI Assistant and Playground conversations, persona chats, Labs sessions, AI debates, your custom personas and backtest results — until you delete your account. You can delete a single persona chat from its history list, and a custom persona from the Playground, sooner.
We do not use your data to train AI models. Each AI provider's own terms govern what it does with the data we send it.
Our records of AI usage and cost hold no message text.
3.5 Paper trading and your tools
Paper trading in AlsaTitan uses simulated money. We keep your demo accounts and their orders, fills, positions and history. No real orders are ever placed.
We also keep what you set up in the app: terminal boards, your watchlist, price alerts, saved screens, saved chart scripts, analyst runs, Playground tools, daily-brief settings, and your answers to the setup questions with your getting-started checklist and, if you give them, your answers about yourself (section 3.16).
If you publish a script to the community, other users see its name, its description, its code (unless you lock it; even then, its code is sent to their browser when they run it) and an author label such as “Trader 3FA2C1”, which is not your name or email address.
If you share a script with someone directly, you type their full email address. We do not tell you whether that address has an AlsaTitan account, we send them no email, and only you see the list of people you shared it with.
If someone you shared a script with deletes their AlsaTitan account, their address is removed from the list of people you shared it with.
When you like a script, we record the like against your account; other users see only how many likes it has.
3.6 Connected services
If you connect a Google service (Drive, Gmail, Calendar, Sheets, Slides or Docs), we store the access Google gives us, encrypted. We use it only for the features you use with that service, including ones you schedule, such as the daily brief. What it reads may be sent to the AI provider answering you. With Gmail connected, the assistant can read and search your mail, and send mail from your account when you ask it to. When you ask the assistant to put a chart in a document it saves to your Google Drive (including a Google Docs document or an HTML file) or in a Slides deck, we send the chart's data to QuickChart (quickchart.io), which draws it as an image (section 5).
Disconnecting one Google service stops AlsaTitan using it at once, but Google keeps listing AlsaTitan's access. When you choose Disconnect Google, or disconnect your last Google service, we ask Google to remove AlsaTitan's access and delete the keys we hold. Deleting your account does the same. Google says this might take some time to take effect.
If you connect an exchange or broker account (Binance, Bybit or Alpaca), we store its API key and secret encrypted and use them only to read your balances and positions: AlsaTitan has no code that places orders. Disconnecting deletes them from AlsaTitan. Give the key read-only permission when you create it, and delete it at the exchange too when you stop using it.
3.7 Activity log
When you are signed in, we keep an activity log to help you when something goes wrong and to keep AlsaTitan secure. It records the pages you open, the buttons you press, the commands you give a voice assistant (the action and the symbol), errors in your browser and your paper-trading orders, with the time, your email address, a random code for the browser tab, your IP address (for IPv6, only the network part), your country, and your browser's identification string (its user agent).
It also records server events about your account, such as sign-ins, failed sign-ins, AI usage and errors. When anyone tries to sign in, we record the address typed, the IP address and the browser, also when it is not an AlsaTitan account.
Our activity log does not record what you type into AI tools or search boxes — only that you sent something and how long it was. The words you type into a search box travel inside the request, not in the web address it asks for. Only a symbol goes into the web address a request asks for: one you pick from the results, or what you type in capitals in a ticker's shape — up to five letters and digits, or a name with a short ending such as .B, -USD or =X — such as NVDA or BRK.B. A word typed that way counts as a ticker even when it is not one, such as LOAN or LAWYER.US; and the Flow Screener's Ticker filter changes what you type there to capitals first, so a short word such as loan becomes LOAN in its address. Our web server's access log leaves out the part of a web address after a question mark; its error log keeps the full address of a request it reports an error for, for up to 14 days; and Cloudflare, which carries our traffic, receives the full address (section 3.9).
Some pages keep your search in their own web address, so that a link you copy shows the same results. They keep it after a # sign: your browser shows it and keeps it in its history, but never sends it to us or to Cloudflare. A link saved before this change can still carry search words after a question mark: opening it sends them once, as described above, and the page then moves them after the #.
Our support staff can read this log. They can also open your account to see it as you do, for at most 30 minutes at a time; what they do then is recorded in the activity log under the staff member's name. When they look up your account or your activity, your email address and the words they search for travel inside the request, not in the web address.
We keep the log for 14 days in our database, then for 365 days in compressed archives, and then delete it.
3.8 Emails
We send account emails: sign-up codes, password and security messages, your welcome email, reminders about a free trial and billing emails. They have no unsubscribe link, because you need them to use your account.
Price alerts and the daily brief are emailed only if you set them up. Each email has a one-click unsubscribe link, and you can also turn them off in Settings → Email. The link works for a year after the email was sent; after that, use Settings → Email.
Reports, strategies and trade lists you ask the assistant to email are sent only to your own address.
We send our emails through Google Workspace.
If you sign up for our newsletter on the website, your address is emailed to our support mailbox ([email protected]). We may send you occasional product updates and market notes. We keep your address until you ask us to stop: email [email protected].
We email you offers and product news only if you tick the box for them under About you (section 3.16). To stop them, untick it in Settings → About you, or email [email protected].
3.9 Visiting our website
When you open any page, our web server and Cloudflare, which carries our traffic, receive your IP address, the web address you ask for and your browser's details. Our web server keeps them in its access log for up to 14 days, without the part of the address after a question mark; its error log, kept as long, holds the full address of a request it reports an error for. Cloudflare also adds its Web Analytics script to our pages to count visits and measure how fast they load.
Our pages load their fonts from Google Fonts, so your browser contacts Google's servers. Charts come from TradingView, and the logos and flags shown next to instruments from other websites; your browser fetches them directly, so those websites receive your IP address and browser details. The home page shows images from Unsplash, and tools you build in the Playground load code libraries from public code hosts (CDNs); your browser contacts them directly too. When you are signed in, live prices may stream to your browser straight from our data providers: Finnhub and, on Alsa Charts for a crypto symbol, Binance, which then receive your IP address, your browser's details and the symbol. Smart Money pages show portraits from Wikipedia (Wikimedia), which your browser loads directly.
3.10 People in public filings
Our Smart Money pages show the names, roles and trades of company insiders, fund managers and members of the US Congress, taken from public filings. We did not collect this from them directly. If you are one of them, you can use your rights in section 9 by contacting us.
3.11 Emailing our support team
If you email [email protected], we keep your messages in our support mailbox to answer you.
3.12 Sign-in history
Each time someone tries to sign in to AlsaTitan, we record what happened. This covers sign-in with a password, with Google, with an email code, by setting a password from a link we emailed, and when someone already signed in confirms it is them before a sensitive change. For each attempt we record:
- the time;
- the account, when the attempt matched one. For an address with no account, we keep a code worked out from the address with a secret key, not the address itself;
- the IP address (for IPv6, only the network part);
- the approximate place that address belongs to (country, region and city) and the network it belongs to;
- the browser, operating system and kind of device, read from the browser's identification string;
- how the sign-in was made, and whether it worked and, if not, why (for example, a wrong password);
- for a sign-in that worked, a code for the session that can't be turned back into the session.
We work out the approximate place on our own server, using a database file from DB-IP (IP to City Lite and IP to ASN Lite, under the Creative Commons Attribution 4.0 licence). Your IP address is not sent to anyone for this. The place is approximate, usually where your internet provider's equipment is, and can be wrong. We don't record map coordinates.
We use these records to keep accounts safe and to prevent fraud: to notice sign-ins from unusual places, repeated failed attempts and stolen passwords. This is our legitimate interest (Article 6(1)(f) GDPR). You can see your own recent sign-ins, and sign a device out, in Settings. Our administrators see them when they look after your account or investigate misuse. If you are an administrator, we email you when your account is signed in to from a country it hasn't been used from in the last 90 days.
We delete each record 90 days after it is made, and at once when you delete your account.
3.13 Changes our staff make to your account
When one of our administrators changes your account (for example your name, email address, plan, free trial, AI message allowance, or whether the account is active), or exports the list of accounts or the marketing list (section 3.16), we record which administrator did it, when, and what changed. For your name and phone number we record only that they changed. For an email address we record a shortened form such as d•••@example.com. We keep these records for 1 year, including after your account is deleted, so that we can account for every change our staff made. After a deletion they hold only the shortened address and a random account number. This is our legitimate interest in the security of accounts and in being able to account for what our staff do, and in establishing or defending legal claims.
3.14 Free trial
When you create an account, you may get the paid plan free for 7 days. We don't ask for a card and nothing is charged. When the trial ends, your account goes back to the free version unless you subscribe. To give each person one trial, we keep a code worked out with a secret key from your email address (and, if you use Google, from your Google account's identifier). We keep it for 12 months after the trial ends or the account is deleted. It can't be turned back into your address. We may refuse a trial to temporary email addresses, to forwarding (“hide my email”) addresses, and to too many new accounts from one network in a day. To count those, we keep a code worked out with a secret key from your network (never your full IP address) for one day. This is our legitimate interest in preventing abuse of the free trial.
3.15 If an administrator invites you
If an administrator of AlsaTitan invites you, we create an account with your email address and the name they entered, and email you a link to choose your own password. The link works for 72 hours. Until you choose a password, the account can't be signed in to. If you don't use the link, nothing further happens.
3.16 About you (optional)
After the setup questions, we ask a few questions about you. Every answer is optional, you can skip the whole step, and you can use all of AlsaTitan without answering. We ask:
- your date of birth: we keep it only if it says you are 18 or older, and never store a date that says you are younger;
- where you trade: the brokers or exchanges you use, or that you have none yet;
- who sent you our way;
- the country you trade from, which we suggest from your browser's time zone or language and keep only if you save. It puts your country's brokers first in the list;
- whether you want emails from us with offers and product news. This is a separate box, unticked until you tick it, and we record when you last changed the answer.
We use these answers to understand who uses AlsaTitan and to shape our offers, and we email you offers only if you ticked the box (section 3.8). They also do two things for you in the app. On your birthday, your guide shows you a one-line birthday greeting: your browser works out the day from your saved date of birth, and remembers in its own storage that you closed the greeting (section 7). And where you trade lets us offer a link to your broker on our Compare Brokers page or, if you have none yet, a way to find one that fits you. Titan's AI is not given them (section 3.4 lists what it is told).
This rests on your consent. You can change or clear any answer, or untick the offers box, at any time in Settings → About you; clearing your answers withdraws your consent, and does not affect what we did before. We keep the answers until you clear them or delete your account (section 10).
Only the owner of AlsaTitan can download these answers, as a list that also holds your email address, your name and the day you joined, and only after confirming who they are again. The list can be limited to the people who ticked the offers box. Each download is recorded with the changes our staff make (section 3.13).
4. Our legal reasons
Why we use your data, and the legal basis for each use
| Purpose | EU and UK GDPR | UAE PDPL |
|---|---|---|
| Your account and AlsaTitan's tools, AI features and connected services; account emails; price alerts and the daily brief you set up; taking payments and keeping your billing history | Performing our contract with you (Article 6(1)(b)) | Necessary to perform our contract with you |
| Answering authorities when the law requires it | Meeting a legal obligation (Article 6(1)(c)) | Necessary to meet a legal obligation |
| Security, preventing abuse, the activity log, the history of sign-ins, the record of changes our staff make to accounts, the code that stops a second free trial, and helping you when something goes wrong; delivering and measuring our website; showing data from public filings | Our legitimate interests in a secure, working service and in reporting public filings (Article 6(1)(f)) | Necessary to perform our contract with you and to protect our service and its users; for public filings, data made public |
| The newsletter | Your consent (Article 6(1)(a)), which you can withdraw at any time | Your consent, which you can withdraw at any time |
| Your answers about yourself (section 3.16), and emails with offers if you ticked the box for them | Your consent (Article 6(1)(a)), which you can withdraw at any time | Your consent, which you can withdraw at any time |
5. Who receives your data
The companies that receive personal data from AlsaTitan
| Who | What they receive | Why |
|---|---|---|
| Our hosting provider, InterServer, in the United States | Everything described in this notice, stored on the servers they run for us, including the daily backups of our database | To host AlsaTitan |
| Cloudflare | Every request to our website (your IP address, the page and your browser's details), the Turnstile check, and visit counts from its Web Analytics | To deliver and protect our website |
| Stripe | Your email address and plan, and the card details and anything else you type on Stripe's page; for a checkout before 21 October 2026, also the billing address, phone number and company you typed on our form, and before 21 October 2026, also your name | To take payments |
| Your sign-in; the Google services you connect; what you send to features answered by Google Gemini, including voice and the web searches Gemini runs for an answer; your browser's request for fonts; the emails we send you | To sign you in, run the services you connect, answer you, and send our emails (Google Workspace) | |
| OpenAI | What you send to features answered by OpenAI models, including voice and dictation | To answer you |
| Anthropic, xAI, Groq and DeepSeek | What you send to a feature, when we have switched on one of their models for it | To answer you |
| Binance, Bybit and Alpaca, if you connect them | Requests signed with your key | To read your balances and positions |
| Market data and news providers | The symbols and search words a page needs, not who you are; Finnhub and Binance also receive your IP address and the symbol when your browser streams live prices from them | To show market data and news |
| TradingView | Your IP address, your browser's details, the symbol a chart shows and anything you type into the chart itself (its own symbol box), when your browser loads one of its charts; from our server, the words you type into our chart symbol search, not who you are | To show charts and find the symbol you ask for |
| QuickChart (quickchart.io) | The data of a chart you ask the assistant to put in a Google Drive document (including an HTML file) or a Slides deck | To draw the chart as an image |
| Unsplash, Wikimedia, public code hosts (CDNs) and the websites that host logos and flags | Your IP address and browser details, when your browser loads their images or code | To show images, and to run the tools you build in the Playground |
| Authorities, our professional advisers, and a buyer of our business | What the law requires, what they need to advise us, or what a buyer needs to continue the service | To meet legal obligations, get advice, or transfer the business |
IP geolocation data © DB-IP.com, CC BY 4.0. IP Geolocation by DB-IP. DB-IP is not a recipient of your data: we use a database file from them on our own server, and send them no personal data.
We do not sell personal data.
6. Transfers outside your country
We store and process your data on servers in the United States, run for us by InterServer. The other providers in section 5 may process it in the United States, the European Union and other countries. Where the law requires it, these transfers, including to our hosting provider, rely on the providers' data protection terms, such as standard contractual clauses, or on another lawful safeguard.
7. Cookies and storage in your browser
We set only cookies that AlsaTitan needs to work and to stay secure, and no advertising cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
| __Host-session | Keeps you signed in. A signed token naming your account and email address. | 7 days; 30 minutes while our support staff open your account |
| __Host-signin_device | Set after a password sign-in. Counts this browser's sign-in attempts separately from others'. Holds a random code, a time and a signature, not your email address. | 90 days |
| __Host-g_oauth_state | Set while you sign in with Google or connect a Google service. It holds a random value that ties Google's answer to the request this browser started. | 10 minutes |
| __Host-admin_return | Staff only: keeps a staff member's own session while they open a customer's account. | Until the staff member's own session would end |
| Where | Set and controlled by |
|---|---|
| Every page (security), and the Turnstile check | Cloudflare |
| The checkout page | Stripe |
| Charts | TradingView |
| Google's sign-in pages |
Older versions of AlsaTitan also set cookies named user_email, user_id, user_auth and demo_auth, and cookies named session, admin_return, signin_device and g_oauth_state without the __Host- prefix. We no longer set or read any of them. An old session cookie is ended and removed the next time your browser opens AlsaTitan. An old admin_return cookie (staff only) is ended and removed the next time that browser starts or ends a support view, and otherwise expires within 7 days of being set. The others expire on their own: user_email, user_id, user_auth and demo_auth within 7 days of the last time you signed in before this update (signing out removes them sooner), signin_device within 90 days of being set, and g_oauth_state within 10 minutes.
AlsaTitan also keeps your settings in your browser's storage and, for some features, your own content — for example AI assistant and voice assistant conversations, the copilot's feed, spoken replies, GOAT Mode history and memory, chart drawings and alerts, board and screener layouts, notes, scripts, your paper-trading journal and a copy of your watchlist. It stays there until you clear it, except that signing out, or someone else signing in on the same browser, removes the copies of your watchlist and your terminal boards. Signing out does not remove the rest, so on a shared computer use a private window. The names of the copies of your watchlist and boards contain a short label made from your email address. Deleting your account clears all of it in the browser you delete from.
8. How long we keep your data
How long we keep each kind of data
| Data | How long |
|---|---|
| Your account and what you create in AlsaTitan | Until you delete it, or your account |
| Sign-up details (name, password hash) while you confirm your email | Until your account is created, and at most 30 minutes after the last code we sent you |
| Session cookie | 7 days; 30 minutes while support staff open your account |
| __Host-signin_device cookie | 90 days |
| Sign-out records | One session: until it would have expired (at most 7 days); all sessions: 90 days |
| Sign-in attempt counts | Up to 1 hour, in memory |
| Activity log | 14 days in our database, then 365 days in compressed archives |
| Sign-in history | 90 days |
| Records of changes our staff made to your account | 1 year |
| Free-trial codes (keyed, no address) | 12 months after the trial or the deletion |
| Email-change requests | Until confirmed, cancelled or 24 hours, then with the account |
| Our servers' technical logs (for the web server: IP address, web addresses requested and browser) | 14 days |
| Newsletter address | Until you ask us to stop |
| About-you answers | Until you clear them, or delete your account |
| Content stored in your browser | Until you clear it, or delete your account in that browser |
| Copies in our database backups (taken daily) | 7 days, so what you delete leaves the backups within 7 days |
| A Stripe customer record from a checkout you did not finish before 21 October 2026 | Until you ask us to delete it |
| Name, billing address and phone number from a checkout not yet paid | Until the payment goes through, and at most 24 hours; deleted within half an hour after that |
| Record that an account was deleted | Holds the email address only until the deletion has finished in our archives; after that, only when it happened, who started it (you, our staff or our deletion script), what Stripe and Google answered, and how many items were removed |
9. Your rights
Depending on where you live, you have the right to:
- see the personal data we hold about you and get a copy, including in a format you can take elsewhere;
- have it corrected: you can change your name and phone number yourself in Settings; to correct your email address, contact us and we will help (section 3.1);
- have it deleted: delete your account in Settings, or ask us (section 10);
- object to how we use it, or ask us to restrict it;
- withdraw your consent where we rely on it, such as for the newsletter or your answers about yourself, at any time; this does not affect what we did before;
- complain to a data protection authority: in the UAE, the UAE Data Office; in the EU or the UK, the authority where you live or work.
To use these rights, email [email protected]. We may first ask you to confirm who you are, for example by writing from the email address of your account. We reply within 30 days. If the law allows more time for a complex request and we need it, we will tell you why within those 30 days.
10. Deleting your account
You can delete your account in Settings → Delete Account: type DELETE, then confirm with your password or, if your account has no password, with a code we email you. This permanently deletes your AlsaTitan account. It can't be undone. What happens:
- Deleting your account ends any paid plan straight away; the rest of the period is not refunded. We delete your customer record at Stripe, our payment processor, which removes your saved card details. Stripe keeps a record of the deleted customer, and records of your past checkouts and payments stay in our Stripe account, with the billing details they hold; some older checkouts also hold the phone number and company you gave.
- We delete your profile and sign-in details, AI chats, Labs sessions, debates, custom personas, backtests, paper-trading accounts and their history, boards, watchlist, price alerts, saved screens, saved chart scripts, daily-brief settings, published and shared scripts, the Google and exchange keys you connected, and the billing details of a checkout you have not finished.
- If you connected a Google service, we ask Google to remove AlsaTitan's access to your Google account.
- We delete your activity-log entries now. Copies in our log archives, and mentions of your address in other log entries, are removed within 24 hours.
- We clear the data AlsaTitan keeps in this browser. Other browsers and devices keep theirs until you clear them.
What stays:
- Copies of your scripts that other people already made.
- API keys you created at an exchange: delete them there too.
- Emails you sent us, and your newsletter sign-up: ask us to delete them too.
- What we sent to AI providers, Stripe, Google and Cloudflare, which they keep under their own terms.
- Records of your past checkouts and payments in our Stripe account.
- If you once had admin access: records of the changes you made to other people's paper-trading money, which name your email address.
- Our web server's technical logs, deleted within 14 days, and security records that don't contain your address, deleted within 90 days.
- Counts our server keeps to stop abuse, for up to an hour — such as sign-in, password-reset and email-code attempts — and how many emails we sent you, for 24 hours without your address, until they expire.
- Copies in our daily database backups, deleted within 7 days.
- Records of changes our staff made to your account, for up to a year, with only a shortened form of your address.
- A keyed code of your email address that stops a second free trial, for 12 months.
An account with admin access must have it removed first. If you cannot sign in, email us and we will delete your account for you.
11. How we protect your data
- Connections to AlsaTitan are encrypted (HTTPS), and browsers are told to use only encrypted connections.
- Passwords are stored only as bcrypt hashes.
- The keys for services you connect are encrypted (AES-256-GCM).
- Sessions are signed, tied to your current password if you have one, and can be ended on every device.
- Browsers cannot read our database; only our server can.
- Sign-up, sign-in and other forms are protected by security checks and limits. Requests from your browser that change your data must come from our own pages, and a request for your data that another website's page makes your browser send is refused when the browser marks it as coming from another site, as current browsers do. Requests from elsewhere that can change your data must carry proof we check: Stripe's payment notices carry Stripe's signature, Google's return from its sign-in and consent pages carries a signed code tied to your browser, and the one-click unsubscribe your mailbox sends carries the sealed code in the unsubscribe link.
- Every time our staff open your account, it is recorded.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities where the law requires.
12. Children
AlsaTitan is for adults. You must be 18 or older; we ask you to confirm this when you create an account. If you believe someone under 18 has given us personal data, contact us and we will delete it.
13. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects on you. AI answers are information, and paper-trading bots trade only with simulated money.
14. Changes to this notice
When we change this notice, we post the new version here with a new date. If a change is significant, we will email account holders before it takes effect.