Privacy Policy
The short version.
- We collect what we need to run your account, bill you through Whop, support you and keep the Service secure — plus advertising and attribution data (§4).
- We do not sell personal information for money. Our use of the Meta Pixel and Conversions API can count as “sharing” or “targeted advertising”. You can opt out through Your Privacy Choices, and we honour Global Privacy Control.
- We never see your full card number (Whop handles it), your brokerage login or your brokerage account.
- AI QUANT — an AI — and the support agent send what you type to Anthropic, never your name, email or payment details (§5).
- Wherever you live in the United States or Canada, you can see, correct, export or delete your data, and appeal a refusal (§9, §10).
- Marketing email only if you tick the box for it; unsubscribe any time (§11).
1. Who we are and what this covers
This policy explains how [OWNER DECISION: legal name and postal address of the business. Recommended default: the same name, registration number and mailing address as Terms §1.1.], an Israeli business owned by Shaked Asher and trading as Trader Machine (“we”), handles personal information of visitors and customers of the US & Canada edition: our websites, web application, emails, live sessions, Direct Access, support chat and affiliate program. We decide why and how this information is used. The person responsible for personal information at our business (our privacy officer) is Shaked Asher, founder and owner, reachable at support@tradermachine.com. This policy forms part of our Terms of Service.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identifiers | Name, email, phone number if you give it, account ID, region, and your password (stored only as a hash by our sign-in provider) | You |
| Billing | Plan, amount, currency, tax, payment date and status, renewal date, cancellation date, country or province, and Whop's membership and payment references. We never receive your full card number; Whop and its payment partners do. | You, through Whop |
| Consent records | Time, IP address, browser, the exact wording of each box you ticked (sign-up, checkout, automation, marketing email), and the versions of the documents you accepted | Sign-up, checkout and the application |
| Product use | Features used, symbols viewed, watchlists, strategies, backtests, AI QUANT requests, runs and results, settings | Your use of the Service |
| Support and communications | Support chat messages (including the AI agent's replies), emails with us, and your name or handle and anything you say if you speak or write in a recorded live session | You |
| Direct Access | What you tell us when you apply (how you trade, what you want to improve), scheduling details, and our written agenda and notes from calls. Calls are not recorded. | You |
| Automation | Your SignalStack webhook address (stored encrypted), which strategies send alerts, and the delivery result of each alert | You, if you turn automation on |
| Device and log data | IP address, approximate location derived from it, browser and device type, time zone, timestamps, session identifiers, error logs | Your browser and our servers |
| Marketing attribution | Campaign tags (UTM), ad-click identifiers (such as fbclid or gclid), referring page, first landing page, affiliate referral code | The link you arrived through, recorded at your first visit |
| Cookies and similar technologies | Storage for sign-in and preferences, the first-visit and affiliate records, your privacy choice, and the cookies set by the Meta Pixel and our video player (§4) | Your browser |
| Affiliates only | Payout details and tax forms (which can include a taxpayer ID) | Affiliates |
Sensitive information. The only items above that privacy laws treat as sensitive are your account login and, for affiliates, a taxpayer ID. We use them only to provide and secure the Service and to meet tax obligations, never to infer anything about you. We do not collect precise geolocation, government ID (other than an affiliate's taxpayer ID), health or biometric data, and we have no access to your brokerage account. Your webhook address is not legally “sensitive”, but it works like a key, so we protect it like one (§12).
3. How we use it
- To create and run your account, deliver the Service, and save your work.
- To process payments through Whop, send receipts and the 40-day and 14-day renewal reminders, and process cancellations.
- To keep records of your consents (§7).
- To answer support requests, including through the AI support agent, and to run Direct Access.
- To deliver alerts to your SignalStack account if you turn automation on.
- To secure the Service, prevent fraud and account sharing, and enforce our geographic and sanctions rules (which uses your approximate location from your IP address and your time zone).
- To understand which features are used and fix problems.
- To measure and improve our advertising (§4) and to pay affiliate commissions.
- To send marketing email if you agreed to it (§11).
- To comply with law, respond to lawful requests, and establish or defend legal claims.
We do not use your information to make decisions about you that have legal or similarly significant effects, and we do not build profiles of you for anyone else.
4. Cookies, pixels and analytics
| Tool | What it does | Can you turn it off? |
|---|---|---|
| Sign-in and preference storage (our own browser storage) | Keeps you signed in and remembers settings such as language and theme | No — the Service needs it |
Attribution capture (first-party: the browser-storage entries tm_touch and
tm_vid, and the tm_ref cookie, which lasts 60 days) | Records how you first reached us — campaign tags (UTM), ad-click identifiers, the referring and first landing page — and any affiliate code, with a random visitor ID that connects an affiliate link click to the sign-up that follows. Set by us, read by us; not a third-party tool | Yes, for advertising use (§8); affiliate credit is part of the Service |
Your privacy choice (the tm_privacy_optout cookie, which lasts a year, and
browser-storage entry) | Remembers that this browser opted out (§8) | It is the opt-out; opting back in removes it |
| Meta Pixel (browser) and Meta Conversions API (server) | Tells Meta which ads bring visitors who sign up and subscribe. The Pixel sets Meta's own cookies | Yes (§8) |
| Vimeo player | Plays lessons and recordings; may set its own cookies | Through your browser settings |
We do not use Google Analytics. The only advertising tools we use are the Meta Pixel and the Conversions API above.
Meta Pixel and Conversions API. The two carry a shared event ID so the same action is not counted twice. The events we send are page views and key steps — signing up, starting checkout and purchasing. An event can include its name and time, the page address, your IP address and browser details, Meta's own browser identifiers and ad-click identifier, and, for server events, your email address hashed (SHA-256) before it leaves our server. Hashing hides the address in transit, but it is not anonymity: Meta uses the hash to match the event to a Meta account if one exists. Meta uses this data for measurement and for its own advertising purposes under its own policies. We send nothing to Meta after you opt out or while your browser sends Global Privacy Control.
What we never send to Meta: payment details, your strategies or backtests, the symbols you look at, your AI or support conversations, Direct Access information, or the titles of lessons, recordings or live sessions you watch.
Tracking across sites. Because of the Meta Pixel, Meta may collect information about your online activity over time and across different websites, including ours. You can limit this with Your Privacy Choices and with these tools: your Meta ad preferences, the DAA opt-out page (US) and YourAdChoices (Canada). Tracking for advertising is never a condition of using the Service.
5. AI features and support chat
AI QUANT is an AI: it and the support agent use large language models from Anthropic, PBC, which processes the data as our service provider.
| Sent to Anthropic | Never sent | |
|---|---|---|
| AI QUANT | Your written request; your answers to its questions (such as how often you want to trade); the symbol and timeframe; statistics about that symbol's past prices; and summaries of your own earlier AI QUANT runs | Your name, email, account ID, payment details, password, SignalStack webhook address, and anything from a brokerage account (we have no access to one) |
| Support chat | The messages you write in the chat and the help material the agent needs to answer them |
- Under Anthropic's commercial terms, Anthropic may not train its models on data we send through its service. It keeps that data only for a limited period for safety and abuse monitoring, then deletes it.
- We store AI QUANT runs, their candidate rules and results, and support chat transcripts in our own database (§7).
- When a chat opens we tell you that an automated AI agent answers first and that the conversation is recorded. If you ask for a person — or the agent cannot answer, or the question is about billing, a refund or what to buy or sell — the conversation passes to our founder, who reads it and replies in the same window. We email him a short notice that a conversation is waiting.
- Please do not type passwords, card numbers or your webhook address into any chat or AI field.
6. Who we disclose it to
Service providers. These companies process personal information on our behalf and only for the purposes we set:
| Provider | What they do for us |
|---|---|
| Whop | Checkout, payment processing, tax calculation and collection, and subscription billing, renewal and cancellation. You give your payment details to Whop directly. |
| Supabase | Database, sign-in and authentication |
| Render | Hosting of our application and servers |
| Resend | Sending account, billing, reminder and (if you agreed) marketing emails |
| Anthropic | AI QUANT and the AI support agent (§5) |
| Alpaca | Market data. Alpaca receives requests for symbols from our servers, not personal information about you. |
| Vimeo | Hosting and playing lessons and session recordings |
| LiveKit | Real-time video and audio for live sessions inside the application |
| Zoom | Booked calls and Direct Access calls |
| Our affiliate payout provider (named in the Affiliate Terms, §4) | Sending commission payouts to affiliates |
We also disclose information:
- To and from Whop. Whop processes your payment and also uses information for its own purposes — such as fraud prevention, legal compliance and running its platform — under its own privacy policy. For those purposes it acts as a separate business, not only for us. Whop passes us what we need to run your subscription: your name, email, country or region, plan, amounts, payment status and dates.
- To Meta, as described in §4. Meta acts for itself, not only for us, which is why this can count as “sharing”.
- To SignalStack, only if you turn automation on: the alerts we deliver to the webhook address you gave us (symbol, action and time). We do not send SignalStack your name or email. If you open a SignalStack account through the referral link in the application, SignalStack learns that you came from us.
- To affiliates: an affiliate who referred you sees, in their dashboard, that a referral signed up and subscribed, the commission it earned, and your email address with most characters hidden (for example j•••@gmail.com). They never see your payment details.
- To professional advisers, to authorities when the law requires it, to protect rights and safety, and to a buyer or successor if our business is transferred (this policy will continue to apply).
We do not sell personal information for money. In the last 12 months we have not sold personal information. We have “shared” identifiers and internet activity (device and browser details, page views, ad-click identifiers and hashed email) with Meta for cross-context behavioural advertising, as described in §4.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, product use, strategies, AI QUANT runs | While your account exists; deleted or de-identified within 90 days after you delete it |
| Consent records from sign-up, checkout and automation | At least three years, or one year after your subscription ends, whichever is later |
| Marketing-email consent | While we send you marketing email, and three years after you withdraw it |
| Billing records and receipts | Seven years, for tax and accounting law |
| Support chat transcripts and support email | 24 months after the last message |
| Direct Access applications, agendas and call notes | While you are a member, and 12 months after |
| Automation settings / alert delivery logs | While automation is on / 24 months |
| Security and server logs | 12 months |
| Marketing attribution and referral code | As long as an affiliate commission can be owed on the account, then deleted |
| Live-session recordings | As long as they are in the library |
| Affiliate payout and tax records | Seven years after the last payout |
We keep information longer only where the law requires it or to resolve a dispute.
8. Your Privacy Choices
Opt out of “sale”, “sharing” and targeted advertising
We do not sell personal information for money. Our use of the Meta Pixel and Conversions API may be “sharing” for cross-context behavioural advertising under California law, and “targeted advertising” under other states' laws. To opt out, use any of these:
- the “Your Privacy Choices” page, linked in our site footer, at the bottom of the sign-up card and at the bottom of Settings;
- Global Privacy Control (GPC). If your browser sends it, we treat it as an opt-out for that browser — and for your account, when you are signed in — without your having to do anything else;
- an email to us (§16).
After you opt out, we stop loading the Meta Pixel for you and stop sending your events to Meta — from your browser and from our server, including a purchase. Nothing changes in the Service itself.
Do Not Track
Browsers' “Do Not Track” setting has no agreed meaning, so we do not respond to it. We do honour Global Privacy Control, as described above.
Marketing email
Use the unsubscribe link in any marketing email, or tell us (§11).
9. Your rights in the United States
Several U.S. states give their residents privacy rights, and some of those laws may not apply to a business of our size. We give these rights to everyone in the United States, wherever you live. You can ask us to:
- know and access — tell you what personal information we hold about you, where it came from, why we use it and who we disclose it to, and give you a copy;
- port — give you that copy in a portable, machine-readable format;
- correct information that is wrong;
- delete your information (we may keep what the law requires, such as billing and consent records);
- opt out of sale, sharing, targeted advertising and profiling (§8); and
- appeal if we refuse.
How to ask. Email us from the address on your account (§16), with the subject “Privacy request”. We verify the request by confirming it with that address. You may use an authorised agent, who must show your signed permission; we may still confirm the request with you. We reply within 45 days; if we need more time (up to another 45 days), we tell you why.
Appeals. If we refuse a request, reply to our answer with the word “Appeal”. We will respond within the time your state's law sets, and explain our decision. If you are still not satisfied, you may contact your state attorney general.
No discrimination. We will not charge you more, give you a worse service, or treat you differently for using these rights.
California notice at collection. The categories we collect, their sources and purposes, and how long we keep them are in §2, §3 and §7. We disclose them only as §6 describes. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.
10. Your rights in Canada
If you live in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to how we handle your personal information. In particular:
- Consent. We collect, use and disclose personal information with your consent and for the purposes in §3. Advertising tracking (the Meta Pixel and Conversions API) is opt-out (§8) and is never a condition of using the Service. You may withdraw consent to any use that is not needed to provide the Service, and we will tell you what withdrawing means.
- Access and correction. You may ask to see the personal information we hold about you and how it has been used and disclosed, and ask us to correct it. We reply within 30 days, or tell you if we need more time as the law allows.
- Accountability. Our privacy officer is Shaked Asher, founder and owner (§1).
- Transfers. Your information is processed outside Canada — in Israel and the United States (§14) — and may be accessible to courts and authorities there.
- Complaints. Contact us first. You may also complain to the Office of the Privacy Commissioner of Canada or, where it applies, your provincial privacy regulator.
We do not sell the Service to residents of Québec (Terms §2.2).
11. Email and marketing consent
- Service emails — receipts, renewal reminders, cancellation confirmations, failed payment notices and security notices — are part of the Service. You receive them while you have an account, and they carry no advertising.
- Marketing email is sent only with your express consent: you tick the separate, unticked box for it when you create your account, or turn it on yourself in Settings. We do not rely on implied consent — not even where Canada's anti-spam law (CASL) would allow it, such as after a purchase. An account without that box or that switch receives no marketing email.
- Every marketing email identifies us, includes our postal address, and has a working unsubscribe link. Unsubscribing takes effect promptly, and in any case within 10 business days.
- We stay responsible for marketing email sent for us, including through Resend.
12. Security
Connections to the Service are encrypted in transit. Your SignalStack webhook address is encrypted at rest. Database access is restricted so that customer data is reached only through our server, and only people who need access have it. Card details are handled by Whop and its payment partners and never stored by us. No system is perfectly secure; if a breach affects your personal information, we will notify you and the authorities as the law requires.
13. Children
The Service is for adults only. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.
14. Where your data is processed
Our business operates from Israel, and our service providers — including Whop, Supabase, Render, Resend and Anthropic, which are based in the United States — process data in the United States and in other countries where they operate. Your information may therefore be stored and processed outside your state or province, and may be accessible to courts and authorities in those countries under their laws. We use providers that protect it under contract.
15. Changes to this policy
We will post any change here with a new effective date. If a change is material, we will also email you before it takes effect. We will not use information already collected in a materially different way without your consent where the law requires it.
16. Contact
Privacy requests and questions: support@tradermachine.com
— subject line “Privacy request”.
Privacy officer: Shaked Asher, founder and owner.
Post: the business named in §1, at the address given there.