SYMETRIQ — Privacy Policy

Document version: v3.0-DRAFT · Effective launch · Version 3.0 Status: DRAFT FOR LEGAL REVIEW — NOT FINAL. Must be reviewed by qualified privacy / data-protection counsel (and fintech counsel for the GLBA and financial-data points) before publication. Supersedes: SYMETRIQ Privacy Policy v1 (S195, June 2026) and the Termly-generated policy previously on symetriq.ai. Companion to: Terms of Service v4.1 ("Terms"), Risk Disclosure v2, Cookie Policy v1. Capitalized terms not defined here have the meaning given in the Terms.

Section map

A. Read this first — what we collect and what we don't

1. Who we are and what this Policy covers
2. What we collect
3. Where it comes from
4. Why we use it and our legal bases
5. Broker keys, LLM keys, and trading data — special handling
6. Who we share it with — sub-processors and other recipients
7. Where your data lives and international transfers
8. How long we keep it
9. How we protect it
10. Your choices — communications, cookies, signals
11. Your rights — everyone
12. California and other U.S. state residents
13. EEA and United Kingdom residents
14. Australian residents
15. AI features and your data
16. Automated decision-making
17. Children
18. Financial-privacy status
19. Changes to this Policy
20. Contact

A. Read this first — what we collect and what we don't

We collect: your account details; the encrypted Broker and LLM API keys you give us; your Strategies, risk settings, orders, fills, and positions as reported by your Broker; the prompts and outputs of the AI agents you use; technical logs; and payment metadata (not your card number).

We do not: sell your personal data; share it for targeted advertising; use your Strategies or trading data to train models; let anyone at SYMETRIQ see your keys in plaintext; or connect to any account you did not connect yourself.

Where it lives: the United States (our Hetzner server in Hillsboro, Oregon, and Supabase in a U.S. region), with some processing in the United States by the providers named in Section 6.

Your controls: access, correction, export, and deletion from your account settings or by email; one-click cancellation; key deletion on disconnect; opt-out of non-essential communications; and we honor Global Privacy Control signals.

In plain terms: we keep what the software needs to run your trading and to keep your account safe, we tell you exactly which companies touch it, and we don't make money from your data — only from your subscription.

1. Who we are and what this Policy covers

1.1 Controller. SYMETRIQ LLC, a Wyoming limited liability company with its principal place of business in St. George, Utah, is the controller of personal data processed through symetriq.ai, api.symetriq.ai, and the SYMETRIQ application (together, the "Platform"). Contact details are in Section 20.

1.2 Scope. This Policy covers personal data we process when you visit the public site, join the waitlist, create an account, use the Platform, contact us, or interact with our communications.

1.3 Not covered. Your Broker, your LLM Provider, and any other service you connect are independent controllers of the data you send them and of what they do with it. Their privacy policies govern them. Read them.

1.4 Two systems. The public waitlist runs on a separate, isolated database from the trading Platform. Waitlist data is never joined to trading data unless and until you create a Platform account.

2. What we collect

2.1 We do not collect government identifiers, biometric data, precise geolocation, or data about race, religion, health, sexual orientation, or union membership. Do not send us such data. If you include it in a support message or an agent prompt, we will delete it when we notice it.

2.2 Information you volunteer to agents. If you tell an agent about your holdings, finances, or objectives, that text is stored with the conversation and sent to your LLM Provider (Section 15). Do not volunteer more than you need to.

3. Where it comes from

• From you: registration, settings, Strategy Builder, agent prompts, support, surveys, checkout.
• From your Broker, at your direction: account data reported through the API key you connected.
• From your LLM Provider, at your direction: agent outputs generated through your key.
• Automatically: logs, telemetry, consent records, audit log.
• From service providers: Stripe (payment status), Resend (delivery status), Google (sign-in identity), error-monitoring tools.
• We do not buy data about you from data brokers or append third-party profiles to your account.

4. Why we use it and our legal bases

4.1 We do not use personal data for targeted advertising, sell it, share it for cross-context behavioral advertising, profile you for eligibility decisions, or train machine-learning models on your Strategies, trading data, or agent conversations (Section 15.4).

5. Broker keys, LLM keys, and trading data — special handling

5.1 Encryption. Broker and LLM API keys are encrypted at rest with AES-256-GCM. The master key is held in a separate secrets store, not in the application database. Keys are decrypted only in memory, only for the duration of an API call, and are never written to logs, files, backups in plaintext, error reports, or analytics.

5.2 No plaintext access. No SYMETRIQ personnel, support tool, or administrative interface can display a key in plaintext. Support access to your account (Terms 17.5) never exposes keys.

5.3 Permission detection. On connection we check the permission scope your Broker reports and warn or refuse if withdrawal permission is present. We do not, and cannot, remove permissions at your Broker; you must create trade-only keys yourself.

5.4 Deletion. Keys are deleted when you disconnect a Broker or LLM Provider, when you close your account, and after 12 months of inactivity following notice. Deleted keys are purged from active systems immediately and from backups within 30 days.

5.5 Trading data is yours and stays isolated. Storage is tenant-scoped: each User's Strategies, orders, and positions are segregated so that no other User can access them. We do not share, sell, aggregate for resale, or use your Strategies or trading data for our own trading.

5.6 Your Broker's records control. Trading data we hold is a copy of what your Broker reported. Your Broker's statements are the authoritative record.

In plain terms: your keys go into a locked box we can open only by machine, only for the instant needed to send an order, and nobody at SYMETRIQ can read them. Your Strategies are yours; we don't peek, pool, or resell.

6. Who we share it with — sub-processors and other recipients

6.1 Sub-processors. These companies process personal data on our behalf, under contracts that restrict their use to providing their service to us.

6.1a Data sources (not sub-processors — they receive no personal data). The backend requests market, news, and reference data from these services under our own API keys: FRED (Federal Reserve Bank of St. Louis), Finnhub, NewsAPI, CryptoPanic, Etherscan, DefiLlama, alternative.me, Yahoo Finance, and Polygon. Your Broker also supplies market data under your key (6.2).

We will update this table before adding a sub-processor that will access personal data and will notify account holders by email at least 15 days before a change that materially affects how your data is processed. A current copy is always at a page we will publish at launch.

6.2 Independent controllers you connect (not our sub-processors).

• Your Broker. When you connect a Broker, we transmit your API key (to authenticate), order instructions, and cancel requests to that Broker, and we receive account data back. Your Broker's privacy policy governs what it does with that data.
• Your LLM Provider (OpenRouter, a LiteLLM endpoint, or another provider you configure; openrouter.ai/privacy). Agent prompts — including market data context and anything you type — are sent to your provider under your key. Its terms govern retention and any training use. See Section 15.

6.3 Other disclosures.

• Legal and safety: to courts, regulators, self-regulatory organizations, law enforcement, or a Broker's compliance investigation in response to lawful process, or where we believe disclosure is necessary to prevent harm, investigate fraud, or enforce the Terms. Where lawful and practicable we notify you.
• Business transfers: to a successor in a merger, acquisition, financing, or sale of assets, under this Policy, with notice to you.
• Professional advisers: lawyers, accountants, auditors, insurers, under confidentiality.
• With your direction: when you ask us to share something.
• De-identified, aggregated statistics that cannot reasonably identify you.

6.4 We do not sell personal data and do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months.

7. Where your data lives and international transfers

7.1 Platform data is stored in the United States (Hetzner, Hillsboro, Oregon; Supabase, U.S. region). Some processing occurs in the United States by the providers named in Section 6 and wherever those providers operate.

7.2 EEA/UK users (when we launch there): transfers of your personal data to the United States rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), with supplementary measures where needed.

7.3 Australian users (when we launch there): we take reasonable steps to ensure overseas recipients handle your data consistently with the Australian Privacy Principles (Section 14).

8. How long we keep it

8.1 When a retention period ends we delete or irreversibly de-identify the data.

8.2 Audit log and erasure. The audit log is append-only by design so that it can serve as evidence of what the Platform did, including for your benefit in a dispute with us or your Broker. When you exercise a deletion right, we delete your account data and de-identify the audit log entries that concern you by replacing your identifiers with a non-reversible token, retaining only the operational record.

9. How we protect it

9.1 Encryption in transit (TLS 1.2+) and at rest; key management as described in Section 5; tenant isolation with row-level security; multi-factor authentication available to you and required for our administrative access; least-privilege access with logging; secrets scrubbing on error reports; dependency vulnerability scanning; and regular backups. Details are at a page we will publish at launch.

9.2 No system is perfectly secure. If we learn of a security incident affecting your personal data or keys, we will notify you without undue delay and within the time applicable law requires, tell you what happened, and tell you what to do — usually: revoke and rotate the affected keys at your Broker immediately. Report suspected incidents to hello@symetriq.ai.

9.3 Your part. Use a unique password, enable MFA, keep devices updated, and never share keys. We will never ask you for a key or password.

10. Your choices — communications, cookies, signals

10.1 Service and safety messages (halts, security incidents, billing, legal changes) are part of the service and cannot be opted out of while you hold an account.

10.2 Product news and marketing are optional. Unsubscribe from any such email or in account settings. We honor opt-outs within 10 business days.

10.3 Cookies. The public site sets no cookies and uses cookieless analytics. The Platform uses only strictly necessary cookies (session, security, preference). Details are in the Cookie Policy.

10.4 Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale and sharing, which we already do not do; where a signal is received we record it on your account. We do not use targeted-advertising technologies, so there is nothing further to opt out of.

10.5 Account controls. From settings you can update your profile, disconnect Brokers and LLM Providers (which deletes the keys), export your Strategies and trade history, cancel your subscription in one screen, and close your account.

11. Your rights — everyone

Regardless of where you live, you can ask us to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate data;
• Delete your data, subject to the retention exceptions in Section 8;
• Export your Strategies, trade history, and account data in a machine-readable format;
• Restrict or object to processing based on legitimate interests;
• Withdraw consent where processing is based on consent;
• Appeal a decision we make on a request.

Submit requests from your account settings or by email to hello@symetriq.ai. We verify identity before acting — typically by confirming control of your account email and, for sensitive requests, an MFA challenge. We respond within 45 days (extendable once by 45 days with notice) or sooner where law requires. We do not discriminate against you for exercising rights. You may use an authorized agent where the law allows; we will verify the agent's authority.

12. California and other U.S. state residents

12.1 Categories collected (preceding 12 months): identifiers; customer records; commercial information (subscription history, Broker connections used); financial information you connect (Broker account data) and financial credentials (API keys); internet or network activity; inferences used only to operate and improve the Platform; and sensitive personal information limited to account login credentials and financial account credentials.

12.2 Sources, purposes, and recipients are described in Sections 3, 4, and 6. We disclose these categories to the service providers in Section 6 and to the Broker and LLM Provider you connect.

12.3 Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

12.4 Sensitive personal information. We use sensitive personal information only to provide the Platform you requested, secure your account, and as otherwise permitted by the CCPA; we do not use it to infer characteristics about you. You may ask us to limit its use; because we already limit it to permitted purposes, no additional action is needed.

12.5 Your rights under the CCPA/CPRA and similar laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws: to know/access, delete, correct, obtain a portable copy, opt out of sale, sharing, targeted advertising, and certain profiling, and to appeal. Exercise them under Section 11. If we deny a request you may appeal by replying to our response; if we deny the appeal you may contact your state attorney general.

12.6 Utah. For Utah residents, the Utah Consumer Privacy Act applies as amended, including the right to correct effective July 2026. Utah's Artificial Intelligence Policy Act disclosures are in Section 15.5.

12.7 Shine the Light (Cal. Civ. Code §1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.

12.8 Nevada. We do not sell covered information as defined by Nevada law.

12.9 Notice at collection. This Policy is our notice at collection. Retention periods are in Section 8.

13. EEA and United Kingdom residents (applies once we launch in that market)

13.1 Controller and representative. SYMETRIQ LLC is the controller. Our EU representative under Article 27 GDPR is and our UK representative under Article 27 UK GDPR is. Data Protection Officer:.

13.2 Legal bases are in Section 4. Where we rely on legitimate interests we have balanced them against your rights; you may request our assessment.

13.3 Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to solely automated decisions with legal or similarly significant effects (Section 16). Exercise them under Section 11; we respond within one month, extendable by two months for complex requests.

13.4 Complaints. You may lodge a complaint with your supervisory authority (list at edpb.europa.eu) or, in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

13.5 Transfers are described in Section 7.2.

13.6 Cookies and consent. Under ePrivacy rules we obtain consent before setting any non-essential cookie. The public site sets none. See the Cookie Policy.

13.7 AI transparency. Article 50 of the EU AI Act requires us to tell you when you are interacting with an AI system and when content is AI-generated. We do (Section 15.5).

14. Australian residents (applies once we launch in that market)

14.1 We are bound by the Australian Privacy Principles to the extent we carry on business in Australia and collect personal information there. This Policy is our APP 1 privacy policy.

14.2 Collection, use, disclosure, and overseas recipients are described in Sections 2–7. Overseas recipients are located in the countries listed in Section 6; we take reasonable steps to ensure they handle your information consistently with the APPs.

14.3 Access and correction rights are in Section 11. Complaints: contact hello@symetriq.ai; if unresolved you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

14.4 Notifiable data breaches. We will notify you and the OAIC of eligible data breaches as required by the Privacy Act.

14.5 Automated decision-making transparency obligations under the 2024 reforms are addressed in Section 16.

15. AI features and your data

15.1 What goes to your LLM Provider. When you use an agent that relies on a large language model, the Platform sends your LLM Provider: the agent's instructions, relevant market data and indicator context, the conversation history for that agent session, and anything you type. It does not send your Broker API key, your LLM key (which authenticates the request but is not content), or other Users' data.

15.2 Your provider's rules govern. Your LLM Provider's terms determine how long it retains prompts and whether it uses them for training. Many providers offer zero-retention or no-training settings; we recommend enabling them. We are not responsible for your provider's practices.

15.3 What we keep. We store agent prompts, outputs, and traces for the period in Section 8 so you can review them and so we can investigate errors. You can delete a conversation at any time.

15.4 No training by us. We do not use your Strategies, trading data, or agent conversations to train or fine-tune any model, and we do not permit sub-processors to do so. If that ever changes we will give clear prior notice and obtain any consent the law requires.

15.5 AI disclosure. Where you interact with an agent you are interacting with generative artificial intelligence, not a human. The Platform labels agent outputs as AI-generated and will confirm that you are interacting with AI whenever you clearly ask. This satisfies Utah Code §13-72 (Artificial Intelligence Policy Act) and, when applicable, Article 50 of the EU AI Act.

15.6 Agent outputs are not decisions about you. Agents produce generalized analysis; they do not make decisions about your eligibility, pricing, access, or account (Section 16).

16. Automated decision-making

16.1 Your Strategies are your decisions. When the Platform transmits an order because your Strategy's conditions were met, that is the execution of rules you authored and authorized, on your own account. We consider this automation you direct, not a decision we make about you.

16.2 Decisions we automate about you. The Platform automatically: enforces engine-wide and tenant risk limits (which can halt your order transmission); detects withdrawal permission on keys (which can block a connection); flags suspicious login activity (which can require re-authentication); and suspends accounts for non-payment after the notice period. None of these is a solely automated decision with legal or similarly significant effect; each can be reviewed by a human on request at hello@symetriq.ai.

16.3 No profiling for eligibility or pricing. We do not use automated profiling to decide whether to offer you the Platform, at what price, or on what terms.

17. Children

The Platform is for adults. We do not knowingly collect personal data from anyone under 18 (or the age of majority where they live). If you believe a minor has provided us data, contact hello@symetriq.ai and we will delete it.

18. Financial-privacy status

18.1 SYMETRIQ LLC is a software provider. We are not a bank, broker-dealer, investment adviser, lender, or other "financial institution" as defined by the Gramm-Leach-Bliley Act, and we do not rely on GLBA exemptions from state privacy laws. We treat the financial data you connect with the care those laws require of financial institutions regardless.

18.2 We do not obtain consumer reports, do not report to credit bureaus, and do not make credit decisions.

19. Changes to this Policy

We may revise this Policy. Each revision carries a new version number, content hash, and effective date. For material changes we will notify account holders by email and in-Platform at least 15 days before the effective date, and where the law requires consent we will obtain it. Your acceptance of a version is recorded. Prior versions are available at a page we will publish at launch.

20. Contact

Privacy requests and questions: hello@symetriq.ai Security incidents: hello@symetriq.ai Mail: SYMETRIQ LLC,; EU representative: UK representative:

This Privacy Policy is a draft prepared for review by qualified privacy/data-protection and fintech counsel. It is not legal advice. SYMETRIQ is a software tool and is not a broker, investment adviser, money transmitter, or custodian (see the Terms of Service). All bracketed items must be resolved before publication.