Privacy Policy

Last updated:

InTradingHub is operated by Varity Ventures ("we", "us", "our"), located in Ontario, Canada. This policy explains what personal information InTradingHub collects, why, how we protect it, and the choices and rights you have. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Quebec Law 25).

For any privacy question, or to exercise a right described below, contact our Privacy Officer through Support (subject line: "Privacy request").

1. Information we collect

Category	Examples	Why we collect it
Account	Username, email address, hashed password, plan tier, trial status	To create and secure your account and provide the Service
Trading configuration & activity	Watchlists, strategy settings, risk limits, and the trades, positions, deposits and analytics you create, import from a broker, or that the Service records on your behalf	To run scans, backtests and analytics, and to execute the orders you configure
Broker credentials / tokens	API keys and OAuth tokens for brokerages you choose to connect	Stored only to place and reconcile orders in your brokerage account. Encrypted at rest (see Safeguards). We never take custody of your funds or securities.
Billing	Stripe customer / session identifiers, payment records (amount, date, status, tax), invoice records, and the billing name / address / tax ID you provide at checkout	To process subscription payments, issue tax-compliant invoices, and meet tax/accounting record-keeping obligations. Card numbers are handled entirely by Stripe; we never see or store them.
Support	Messages you send us or the in-app assistant, name and email if you start a chat while logged out, and any CAPTCHA verification	To answer your questions and prevent abuse
Technical	Server logs (IP address, timestamps, request paths, error traces), last-login and last-seen timestamps, session and "remember me" cookies	Security, fraud prevention, debugging, and detecting inactive accounts

2. How we use your information

To provide the Service you signed up for: scanning, backtesting, analytics, and placing the orders you configure through your connected broker.
To process subscription payments and issue invoices and receipts.
To provide customer support.
To secure the Service, prevent fraud and abuse, and diagnose problems.
To send you service (transactional) messages — a welcome email, payment receipts, renewal and payment-failure notices, trial-ending reminders, password resets, and important changes to the Service or these terms.
To send you optional promotional messages about features and offers — only if you have given consent (see Marketing email & CASL below). You can withdraw that consent at any time.

We do not sell or rent your personal information. We do not use your trading data to trade for our own account, and we do not use it to build or train machine-learning models that are shared outside your account.

3. Legal basis / consent

We collect, use and disclose personal information with your consent, which you give by creating an account and using the Service for the purposes described here. For some processing we rely on the fact that it is necessary to perform our contract with you (for example, placing an order you configured) or to meet a legal obligation (for example, keeping tax records). You may withdraw consent for non-essential processing (such as marketing email) at any time; withdrawing consent needed to run the Service may mean we can no longer provide it.

4. Sharing and service providers

We share personal information only as needed to run the Service, and only with providers bound to protect it:

Recipient	What is shared	Location
The brokerage(s) you connect	Order instructions, and the credentials you supplied, to place and manage your orders	Per that broker
Stripe, Inc.	Payment and billing details you enter at checkout	United States
Market-data providers	The stock/option symbols needed to compute prices and signals (no personal identifiers)	United States / global
AI provider (OpenAI or Anthropic)	Only if you enable AI evaluation or use the AI assistant: the symbol / indicator context for an evaluation, or your typed question. We deliberately do not send your identity, account, holdings or any other customer's data to the AI provider.	United States
Email provider (SMTP) / SMS provider (Twilio)	Your email address / phone number and the message content, to deliver notifications you have opted into	United States / global
Hosting / infrastructure provider	Encrypted application data and logs	As disclosed on request
Law enforcement or regulators	Only where required by valid legal process, or to protect rights, safety or the security of the Service	Canada

We may also disclose information in connection with a corporate transaction (merger, financing, or sale of assets), subject to the recipient honouring this policy.

5. Storage outside Canada & foreign access

Some of the service providers listed above store or process personal information outside Canada, primarily in the United States. While that information is outside Canada it is subject to the laws of that country, and courts, law-enforcement and regulatory authorities there may be able to obtain access to it under those laws. By using the Service you acknowledge this transfer. If you are a Quebec resident, we have assessed these transfers as required by Law 25; contact us for details.

6. Retention

Account, trading configuration and trading-activity data are kept for as long as your account is active.
If you delete your account, we delete or irreversibly anonymise your personal information within 30 days, except records we are required to keep (see below).
Payment, invoice and tax records are retained for the period required by Canadian tax and accounting law (generally 6–7 years) even after account deletion.
Server logs are retained for a limited period (typically up to 12 months) for security and debugging, then deleted or aggregated.
Broker credentials are deleted immediately when you remove a broker connection, and when you delete your account.

7. Safeguards

Passwords are stored only as salted hashes and are never recoverable in plain text.
Broker API keys/tokens, your email address, and payment-provider secrets are encrypted at rest using AES-256 authenticated encryption; the encryption key is held separately from the database.
Traffic between your browser and the Service is protected in transit (HTTPS/TLS).
Access to production data is limited to personnel who need it to operate and support the Service, and is logged.
The in-app AI assistant is technically prevented from receiving any customer's account, identity or holdings.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, and you use the Service at your own risk.

8. Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information) as soon as feasible, and keep a record of the breach as required by law.

9. Your rights and choices

Access & portability: you can ask for a copy of the personal information we hold about you, and information about how it has been used and disclosed. We will respond within 30 days.
Correction: you can update your email and password on your profile page, or ask us to correct other information that is inaccurate or incomplete.
Deletion: you can ask us to delete your account and personal information (subject to the retention exceptions above) by contacting Support.
Withdraw consent: you can turn off marketing email at any time (see below) and remove broker credentials at any time in the connections settings.
Complain: if you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, for Quebec residents, the Commission d'accès à l'information du Québec.

We may need to verify your identity before acting on a request. There is no charge for a reasonable request.

10. Marketing email & CASL

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages. We comply as follows:

Transactional messages (receipts, renewal and failed-payment notices, trial reminders, password resets, security and policy notices) are sent to all users as part of the Service and are not subject to an unsubscribe requirement, but you may still opt out of non-essential ones.
Promotional messages are sent only to users who have given express consent — a checkbox at registration, or a later opt-in in account settings. We do not pre-tick that box.
Every message identifies Varity Ventures as the sender, includes a contact method, and — for promotional messages — a working unsubscribe link that takes effect immediately (and no later than 10 business days).
You can also change your email preferences any time on your profile page, or by replying to any message and asking to be removed.

11. Cookies

We use a session cookie to keep you signed in and a "remember me" cookie only if you opt in. We do not use third-party advertising or cross-site tracking cookies.

12. Children

The Service is not directed to, and may not be used by, anyone under the age of majority in their province or territory. We do not knowingly collect personal information from minors.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date changes when we do, and we will notify account holders of material changes by email or in-app notice.

14. Data controller & contact

The organisation responsible for personal information processed through the Service is Varity Ventures, Ontario, Canada. Contact our Privacy Officer through Support with the subject "Privacy request".