Privacy Policy

This Privacy Policy explains how Astral Trading, Inc. (“Astral,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you access or use our websites, web-based terminal, mobile applications, application programming interfaces (“APIs”), model context protocol (“MCP”) interfaces, integrations, support channels, and related products and services (collectively, the “Services”).

This Privacy Policy is incorporated by reference into Astral’s Terms of Service. If there is a conflict between this Privacy Policy and the Terms of Service regarding our privacy practices, this Privacy Policy controls as to those privacy practices.

The Services are offered and intended for use only within the United States. We do not direct the Services to individuals located outside the United States. If you are outside the United States, do not access or use the Services.

1. Scope and Key Terms

1.1 Scope

This Privacy Policy applies to Personal Data we process in connection with the Services. It does not govern the privacy practices of third-party brokers, exchanges, digital asset trading platforms, connectivity providers, payment processors, app stores, market-data providers, websites, or services that you choose to use or connect, each of which may maintain its own privacy policy and terms.

1.2 Key Terms

“Personal Data” or “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual or household, as defined under applicable law.

“De-Identified Data” means data processed so that it cannot reasonably be used to identify an individual, consistent with applicable law and commercially reasonable practices.

“Connected Account” means a brokerage, exchange, or digital asset trading account that you link to the Services, whether directly or through a third-party connectivity provider or other integration method Astral makes available.

“User Content” means content you submit to the Services, including prompts, strategies, configurations, watchlists, notes, comments, uploads, and other content you choose to provide.

“AI Content” means inputs you provide to AI-enabled features and outputs returned by those features.

“User Strategy Output” means the particular strategy definition, parameter configuration, or strategy expression generated specifically for you by the Services, as further described in the Terms of Service.

“Shared Content” means User Content or User Strategy Output that you affirmatively choose to publish, share, or otherwise make available to other users through the Services.

2. Children’s Privacy and Age Requirement

The Services are intended only for individuals who are at least 18 years old (or the age of majority in their jurisdiction, if higher). The Services are not directed to children under 13, and Astral does not knowingly collect Personal Data online from children under 13.

If we learn that we have collected Personal Data from a child under 13, we will delete the information as required by law and terminate or restrict the associated account. If you believe a child under 13 has provided Personal Data to Astral, please contact us at legal@heyastral.ai.

Our 18-and-over eligibility rule is a condition of using the Services and is broader than the age threshold under federal children’s privacy law.

3. Information We Collect

We collect information from: (a) information you provide directly; (b) information collected automatically when you use the Services; (c) information generated through your use of the Services; and (d) information received from third parties that you connect to, transact with, or interact with through the Services.

3.1 Account, Profile, and Communications Information

• Account and profile information, such as your name, username, email address, telephone number, account preferences, notification settings, and similar account information.
• Authentication and security information, such as account identifiers, login and session information, security events, and credentials or tokens issued by Astral for access to the Services, APIs, or MCP interfaces.
• Communications with Astral, including support requests, complaint submissions, surveys, bug reports, feedback, and other correspondence.
• Any other information you choose to provide when using the Services.

3.2 User Content, Strategies, and Product Activity

• User Content, including prompts, strategy ideas, strategy parameters, watchlists, notes, uploads, comments, and other content you submit.
• User Strategy Output and related strategy configuration information, including saved strategies, parameter settings, backtests, paper-trading activity, deployment status, alert settings, and strategy changes.
• Product interaction data, such as features used, screens viewed, actions taken, strategies created or saved, alerts configured, and other activity within the Services.

3.3 AI Interaction Data

If you use AI-enabled features, we may process and store AI Content and related signals, including:

• prompts, instructions, context, strategy parameters, and other inputs you provide;
• outputs generated in response to those inputs;
• follow-on edits, ratings, corrections, accept/reject events, and other interaction signals;
• safety, abuse-prevention, and quality signals; and
• token counts, request counts, latency, model usage, and similar quantitative usage measurements.

We may use third-party infrastructure or AI model providers as service providers to process AI Content on our behalf. These providers may receive the information necessary to perform the requested function, subject to our agreements with them and applicable law.

3.4 Connected Account and Financial Information

If you choose to link a Connected Account, we may receive, generate, display, and process information that you authorize the applicable broker, exchange, digital asset trading platform, connectivity provider, or integration to make available. Depending on the connection and permissions you grant, this may include:

• broker, exchange, platform, account, or connection identifiers;
• account type and connection or authorization status;
• cash balances, account balances, buying power, and similar account-level financial information;
• holdings, positions, quantities, cost information, and related portfolio information;
• orders, order status, cancellations, fills, executions, and transaction history;
• Trade Instructions transmitted through the Services and responses or status information received from the applicable third party; and
• technical information about the connection, including errors, latency, permission status, and connection health.

Astral uses Connected Account information to provide the account, strategy, monitoring, and order-transmission functionality that you request. Astral does not use Connected Account permissions to withdraw or transfer funds, securities, or digital assets from your Connected Account.

Depending on the integration, authentication may be handled directly by the third-party broker or connectivity provider. Astral may receive authorization tokens or other technical credentials needed to maintain a connection rather than the underlying password you use with the third party. You should review the third party’s privacy policy and security practices for information about how it handles your credentials and account data.

3.5 Payments, Subscriptions, and Purchase Information

If you purchase a paid plan or other paid feature, we may collect or receive information relating to your subscription and transaction, such as your plan, subscription status, transaction or receipt identifiers, billing dates, amounts paid, refund or dispute status, and limited billing information provided by our payment processor or applicable app store. Payment card details may be collected and processed directly by third-party payment processors or app stores. Astral does not store complete payment card numbers when payment information is handled directly by those providers.

3.6 Referral and Partner Information

If you follow, use, or participate in a referral, partner, or integrated offering made available through the Services, we may provide or receive information necessary to administer, attribute, measure, and support that relationship. This may include a referral identifier, campaign or source information, timestamps, and limited status information indicating whether a referral resulted in a qualifying event, such as establishing or funding an account, where applicable. We may use this information to administer partner programs, measure referrals, prevent fraud, provide support, and account for compensation owed between Astral and the applicable partner.

3.7 Information Collected Automatically

When you use the Services, Astral and our service providers may automatically collect information such as:

• IP address, device identifiers, browser type, operating system, language, time zone, device or app version, and approximate location derived from IP address;
• pages or screens viewed, click paths, feature interactions, session timestamps and duration, referral URLs, and similar usage information;
• crash logs, error reports, performance metrics, latency information, log files, access times, and diagnostic information; and
• security, fraud-prevention, abuse, authentication, and account-integrity signals.

3.8 Cookies, SDKs, Local Storage, and Similar Technologies

We and our service providers may use cookies, software development kits (“SDKs”), local storage, pixels, and similar technologies to authenticate users, maintain sessions, remember preferences, understand product usage, measure performance, prevent fraud, and secure the Services. Your browser or device may allow you to limit certain technologies, but doing so may affect functionality.

3.9 Derived and Inferred Information

We may derive information from the categories described above, such as product preferences, feature interests, usage patterns, account or strategy activity summaries, and security or fraud indicators. We use these derived insights to operate, personalize, secure, analyze, and improve the Services.

4. How We Use Information

We may use Personal Data and other information for the following purposes:

• Provide, operate, maintain, and secure the Services and your account.
• Authenticate users, manage sessions, administer accounts, and provide customer support.
• Display Connected Account balances, positions, order information, transaction information, and other authorized account data.
• Enable the creation, saving, backtesting, paper trading, monitoring, deployment, and operation of strategies and alerts.
• Generate and transmit user-authorized Trade Instructions and receive related status information from brokers or connectivity providers.
• Provide, evaluate, test, secure, and improve AI-enabled features and other product functionality, consistent with Section 5.
• Personalize the Services, including settings, layouts, feature suggestions, and product experiences.
• Process subscriptions, payments, refunds, billing support, and plan administration.
• Administer referral and partner programs, attribute qualifying events, account for partner compensation, and prevent referral abuse or fraud.
• Provide service-related communications, security notices, product notices, and responses to your requests.
• Send marketing communications where permitted and subject to your choices.
• Conduct analytics, research, benchmarking, capacity planning, product development, and performance measurement.
• Detect, investigate, prevent, and respond to fraud, abuse, security incidents, prohibited conduct, or violations of our agreements.
• Comply with applicable law, legal process, and regulatory obligations; establish, exercise, or defend legal claims; and enforce our Terms of Service and other agreements.
• Create and use De-Identified Data as described in this Privacy Policy.

5. AI, Strategy Content, and De-Identified Data

5.1 Use of User Content and AI Content

Consistent with our Terms of Service, Astral may process User Content, AI Content, and User Strategy Output to provide the functionality you request and to develop, test, evaluate, secure, and improve the Services and AI-enabled features, unless prohibited by law or restricted by any settings we may make available.

5.2 Service Providers Used for AI

Astral may use third-party cloud, infrastructure, or AI model providers to process AI Content on our behalf. We seek to limit information provided to those service providers to what is reasonably necessary for the applicable service and to use contractual and technical measures appropriate to the nature of the information and service.

5.3 Strategy Content Commitments

Astral will not sell your identifiable User Content or User Strategy Output, including identifiable strategies and prompts, to third parties. Astral will not use your identifiable User Content or User Strategy Output to operate, seed, or manage a fund, ETF, or proprietary trading system without your explicit consent. These commitments do not prevent Astral from processing User Content or User Strategy Output to provide, secure, support, or improve the Services as described in the Terms of Service and this Privacy Policy.

5.4 De-Identified and Aggregated Data

We may create De-Identified Data and aggregated statistics derived from Personal Data, User Content, AI Content, Connected Account information, strategy activity, and use of the Services. We may use De-Identified Data for analytics, research, benchmarking, security, model and product improvement, capacity planning, and development of new products and services. We do not attempt to re-identify De-Identified Data except where permitted by law, such as to test or validate de-identification safeguards.

6. How We Disclose Information

We may disclose information in the circumstances described below. The categories of information disclosed depend on the Services you use and the purpose of the disclosure.

6.1 Service Providers and Processors

We may disclose information to vendors and service providers that perform services on our behalf, including cloud hosting, infrastructure, AI processing, analytics, error monitoring, security, communications, customer support, payment processing, subscription management, data storage, and other operational services. We authorize these providers to process information for the services they provide to Astral, subject to contractual restrictions and applicable law.

6.2 Brokers, Connectivity Providers, and Integrations You Enable

When you link a Connected Account or enable another integration, Astral may exchange information with the applicable broker, exchange, digital asset trading platform, connectivity provider, or integration as necessary to establish and maintain the connection, retrieve the information you authorize, transmit Trade Instructions you authorize, receive order or connection status information, troubleshoot the integration, and provide the requested functionality.

6.3 Payment Providers and App Stores

We may disclose or receive information from payment processors and app stores to process purchases, manage subscriptions, verify entitlements, administer refunds, respond to payment disputes, and prevent payment fraud. Those providers process payment information under their own terms and privacy policies.

6.4 Referral and Commercial Partners

We may exchange limited information with referral, distribution, integration, or other commercial partners when necessary to administer and measure a program that you use or interact with. For example, we may exchange referral identifiers and qualifying-event status information to determine whether a referral resulted in an eligible account event and to administer compensation between Astral and the partner. We do not disclose your private strategy content to a referral partner merely because you participated in a referral program.

6.5 Shared Content and Public or User-Directed Disclosures

If you affirmatively choose to publish, share, or distribute Shared Content through Explore, community, strategy-sharing, or similar features, the information you choose to share will be visible to the users or audience indicated by the feature. Shared Content should not be treated as private or confidential. Other users may be able to view, save, copy, test, modify, or use Shared Content as permitted by the Services and Terms of Service. If you later remove Shared Content or delete your account, copies that other users have already saved, copied, or deployed may persist as described in the Terms of Service.

If you connect the Services to a third-party application or AI assistant, including through Astral’s APIs or MCP interfaces, information you request through that connection — which may include Connected Account information, strategy content, and other Personal Data — will be transmitted to that third-party application at your direction. Once received, that information is governed by the third party’s own privacy policy and practices, including any retention or model-training practices of an AI provider you choose to use. You should review the privacy practices of any application you connect.

We may also disclose information when you direct us to do so or when disclosure is reasonably necessary to complete an action you request.

6.6 Legal, Safety, Security, and Enforcement

We may disclose information when we reasonably believe disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; protect the rights, property, or safety of Astral, our users, or others; detect, investigate, or prevent fraud, abuse, security incidents, or unlawful conduct; enforce our agreements; or establish, exercise, or defend legal claims.

6.7 Corporate Transactions

If Astral is involved in or evaluates a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, information may be disclosed to counterparties, investors, lenders, advisors, and service providers and may be transferred as part of the transaction, subject to applicable law and appropriate confidentiality protections.

7. Your Choices and Privacy Rights

7.1 Account Information

You may access or update certain account information through available account settings. You may also contact legal@heyastral.ai to request access to, correction of, or deletion of Personal Data associated with your account. We may need to verify your identity before completing certain requests.

7.2 Connected Accounts and Integration Permissions

You may disconnect a Connected Account or revoke an integration through controls made available by Astral, the applicable broker, or the connectivity provider, depending on the connection. Disconnecting a Connected Account generally stops future retrieval of account data and future transmission of Trade Instructions through that connection. It does not require Astral to delete information that we are permitted or required to retain, and it does not affect information already held by the applicable third party.

7.3 Account Deletion

You may request deletion of your Astral account through account controls made available in the Services or by contacting legal@heyastral.ai. Account deletion will stop future use of the account and will result in deletion or de-identification of Personal Data associated with the account as reasonably appropriate, subject to the retention practices in Section 9 and any information we must or are permitted to retain for legal, security, fraud-prevention, accounting, dispute-resolution, or backup purposes.

Deleting your Astral account does not close any Connected Account held with a broker, exchange, or digital asset trading platform and does not remove information maintained independently by those third parties.

Account deletion and removal of Shared Content do not recall or delete copies of Shared Content that other users viewed, saved, copied, modified, or deployed before removal, and do not delete De-Identified Data.

7.4 Marketing Communications

You may opt out of marketing emails by using the unsubscribe link included in those messages or by contacting us. Even if you opt out of marketing messages, we may continue to send service-related, transactional, security, legal, or account communications.

7.5 Cookies and Similar Technologies

You can control certain cookies through your browser or device settings and through any cookie controls Astral makes available. Disabling certain cookies or storage technologies may affect the availability or functionality of the Services.

7.6 Other U.S. State Privacy Rights

Depending on where you reside and whether an applicable state privacy law applies to Astral, you may have additional rights regarding your Personal Data. These rights may include rights to access, correct, delete, or obtain a copy of certain Personal Data or to exercise other choices provided by applicable law. Astral will respond to verified requests as required by applicable law. You may submit a request at legal@heyastral.ai. We will not unlawfully discriminate against you for exercising an applicable privacy right.

8. Do Not Track and Cross-Site Collection

Some web browsers offer a “Do Not Track” (“DNT”) signal. Because there is not a uniform industry standard for interpreting DNT signals, Astral does not currently change how the Services operate in response to a browser DNT signal. We will honor browser-based opt-out preference signals where required by applicable law.

Third parties that provide analytics, embedded functionality, security, measurement, or similar technologies may collect information about your online activities over time and across different websites or online services when their technologies are present in the Services. The extent of that collection depends on the technologies in use and the third party’s own practices. Astral uses these technologies as described in this Privacy Policy and will provide additional notices or choices when required by applicable law.

9. Data Retention

We retain information for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal, contractual, security, and operational requirements. Retention periods vary based on the nature of the information and why it is processed.

Factors we consider when determining retention periods include:

• whether your account remains active and whether the information is needed to provide requested Services;
• whether the information is needed to maintain account, security, fraud-prevention, abuse-prevention, or audit records;
• whether the information relates to transactions, billing, disputes, complaints, or legal claims;
• applicable legal, regulatory, contractual, tax, accounting, or recordkeeping requirements;
• whether the information is maintained in backups, logs, or disaster-recovery systems and the time reasonably required for those systems to cycle or expire; and
• whether the information has been de-identified or aggregated so that it no longer reasonably identifies you.

When information is no longer reasonably needed, we may delete it, de-identify it, or retain it in a form that is not reasonably linked to you. De-Identified Data may be retained for longer periods where permitted by law.

10. Security

Astral uses reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, acquisition, alteration, disclosure, loss, or destruction. Depending on the information and system, these measures may include access controls, authentication controls, encryption in transit, secure handling of tokens and keys, logging and monitoring, backups, vulnerability management, and measures intended to detect or prevent abuse and fraud.

We may monitor, log, and analyze activity on the Services for security, fraud prevention, troubleshooting, compliance, and operational integrity. No security system is perfect, and Astral cannot guarantee that information will never be accessed, used, disclosed, altered, or lost in an unauthorized manner.

11. Processing Locations and Non-U.S. Access

Astral is based in the United States, and the Services are intended for users located in the United States. We primarily process information in the United States. Some service providers may process information from other jurisdictions as part of providing cloud, infrastructure, analytics, AI, customer support, security, or other services to Astral.

If you access the Services from outside the United States, including while traveling or through a VPN, your information will be processed as described in this Privacy Policy. Astral does not represent that the Services or this Privacy Policy are designed to satisfy privacy requirements that apply to services intentionally offered outside the United States.

12. Third-Party Services and Links

The Services may contain links to, integrate with, or allow you to connect accounts or services provided by third parties. This Privacy Policy does not control the privacy practices of those third parties. We encourage you to review the privacy policies and terms of any broker, exchange, digital asset trading platform, connectivity provider, payment processor, app store, or other third-party service you choose to use.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will identify the effective date at the top of the policy. If we make a material change, we will provide notice through reasonable means, which may include an in-product notice, an email to the address associated with your account, or another prominent notice through the Services, as appropriate to the change and applicable law.

If we make a material change to this Privacy Policy that would permit us to use previously collected Personal Data in ways materially different from those disclosed at the time of collection, we will provide prominent notice and, where required by applicable law, obtain your consent before applying the change to that previously collected data.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after an updated policy becomes effective is subject to the updated policy, except where applicable law requires additional notice or consent.

14. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or Astral’s privacy practices, contact:

Astral Trading, Inc.

Attn: Privacy / Legal

13300 Query Mill Road

North Potomac, MD 20878

Email: legal@heyastral.ai