Privacy Policy

01Personal data we collect

1.1 Account and identity data. We collect information you provide to register or manage an account, such as your name or username, email address and authentication information. If you sign in through another provider, we receive the profile and authentication information that provider shares with us.

1.2 Payment and subscription data. Payment processors handle payment details. We do not collect or store full payment-card numbers. We may receive billing details, transaction references, limited card information, subscription status and payment amounts or confirmations.

1.3 Research and service records. We receive materials that you or an agent acting for you submit, create, validate or save through the Services, including factor code, formulas, prompts, parameters, strategies, task selections, backtests and evaluation records. Some records may contain personal data or be linked to your account. Their treatment as intellectual property and their eligibility for commercial use are separate questions, addressed in Section 6 and the Terms of Service.

1.4 Connected account data. When you request a supported account or trading connection, we may process the credentials, permissions, account identifiers, balances, positions, orders and transaction records needed for that feature. We use this information to provide and protect the requested connection. It is excluded from the Research Materials commercial licence; a connection does not authorise its use to train our commercial models or trade for our own account.

1.5 Usage and device data. We collect information such as features used, API requests, timestamps, referring URLs, IP addresses, browser and device details, and service or security logs. Cookies and local storage may also record preferences and usage information as described in Section 8.

1.6 Communications and permissions. We keep information you provide when requesting support, responding to surveys or corresponding with us, together with records needed to document notices, contract acceptance, permissions and privacy requests. Please do not put passwords, API secrets, personal identifiers or information about other people into research prompts or code.

02How we use personal data

2.1 We use personal data, where supported by the legal basis described in Section 3, for these purposes:

• Provide the features you request: manage accounts, authenticate access, process research submissions, return results, maintain research history and operate supported connections.
• Operate and secure the platform: diagnose errors, maintain reliability, prevent fraud and abuse, enforce limits and investigate security incidents.
• Administer our relationship: process subscriptions and payments, answer enquiries, send service notices and document contractual permissions.
• Understand and improve the Services: analyse usage and performance, test features and improve service quality with appropriate data minimisation. The additional rules for commercial research and model development are in Section 6.
• Send product news or marketing where permitted, with a way to opt out.
• Meet legal, regulatory, tax and accounting requirements, resolve disputes and establish or defend legal claims.

2.2 We limit personal data processing to the purposes notified to you and other purposes permitted by applicable law. A commercial research licence is not a licence to use your identity, account information or actual trading activity for unrestricted business purposes.

03Legal basis and consent (PDPA)

3.1 We collect, use or disclose personal data with valid consent, including deemed consent only where its statutory requirements are met, or under an applicable legal requirement or exception. We notify you of relevant purposes as required by law. We do not treat acceptance of an intellectual property licence as irrevocable consent to process personal data.

3.2 Any reliance on a PDPA exception, including a business improvement, research or legitimate interests exception, depends on its actual scope and conditions. Where required, we assess necessity and risks, implement safeguards and make the relevant disclosures. These exceptions do not provide a blanket permission to train models or conduct commercial trading using personal data.

3.3 Before using personal data for a new model-training or other materially different purpose, we will provide an appropriate notice and establish a valid legal basis. If consent is required, we will seek it separately before that processing. We will not make consent to unnecessary personal data processing a condition of access to an unrelated service.

3.4 You may withdraw consent on reasonable notice through the contact details in Section 14. We will explain any likely consequences and stop the processing that depends on that consent, including through our service providers, unless continued processing is permitted or required by law. Withdrawing necessary service permissions may affect the relevant feature; it does not waive your other rights.

04How we disclose personal data

4.1 We do not sell personal data. We share it only for a notified purpose with a valid legal basis and appropriate safeguards. Commercial licensing of eligible non-personal research does not authorise a sale of personal data.

4.2 Service providers. We use providers for functions such as hosting, storage, authentication, payments, communications, support and analytics. Providers processing personal data on our behalf are subject to instructions, confidentiality, security and purpose restrictions. Where we appoint an AI or training provider on our behalf, we require it not to use the supplied data to train its own or another customer’s models independently of our instructions.

4.3 Connected tools. If you direct a connection to an external AI assistant, broker, exchange or other service, information needed for your request passes to that service. An independently operated tool you choose is governed by its own terms and privacy practices. This is different from a provider we appoint to process data solely on our behalf.

4.4 Affiliates. We may share personal data with affiliated entities where necessary for a purpose described in this Policy and legally permitted, subject to appropriate access and use restrictions. An affiliate’s participation in commercial research or trading does not by itself authorise access to your personal data or actual account and transaction records.

4.5 Legal obligations and corporate transactions. We may make disclosures required or permitted by law to authorities, professional advisers or parties involved in a dispute. In a merger, acquisition, financing, reorganisation or sale of assets, we limit disclosures to what is appropriate and lawful and require suitable confidentiality and data protection commitments. A corporate transaction does not remove applicable purpose or data protection restrictions.

4.6 Other disclosures. For a different purpose requiring your consent, we will explain that purpose and obtain the required consent before disclosure.

05International transfers

5.1 We are based in Singapore. Our providers and authorised recipients may process personal data in other countries. Before transferring personal data overseas, we take the steps required by the PDPA’s transfer limitation rules to ensure protection comparable to the PDPA, such as legally enforceable contractual protections, or rely on another permitted transfer mechanism whose conditions are met. Where another applicable law imposes additional transfer requirements, we comply with those requirements.

06Research Materials, AI and confidentiality

6.1 Ownership and commercial use. You retain your rights in User Content as described in the Terms of Service. Standard Users grant the commercial licence stated in those Terms for eligible Research Materials. Confidential handling does not mean that licensed research is reserved for your exclusive commercial use.

6.2 Scope and timing. Eligible Research Materials are the research materials covered by the Terms that you or your authorised agent submit, create, validate or save through the platform after accepting the applicable Terms. They may include factor code, formulas, parameters, signals, strategies, non-personal research prompts, backtests and evaluations. Rights in pre-existing material extend only to what is incorporated and necessary for the permitted use and what you are entitled to license. Materials already held before acceptance are not brought into the commercial licence merely by being retained, by this Policy changing or by your continued browsing.

6.3 Excluded information. The Research Materials commercial licence excludes identity and account information, credentials and API secrets, actual balances, positions, orders and customer investment data, third-party materials whose restrictions prevent that use, and content in workspaces covered by a signed enterprise agreement. These exclusions apply even where that information appears in a prompt, code comment or research record. Historical materials require a separate valid authorisation before any new commercial use.

6.4 Permitted research activities. Subject to the accepted Terms and applicable law, eligible non-personal Research Materials may be used for proprietary trading and lawful affiliated investment activities; quantitative and AI research, including training, fine-tuning, evaluation and retrieval-augmented generation; and creating or commercialising derived signals, models and strategies. This Policy explains that processing but does not expand the contractual licence or authorise regulated activities.

6.5 Confidential handling. We do not publish your raw proprietary research code or offer it for sale to the public under the standard commercial licence. Necessary access by our personnel, affiliates, service providers and private licensees is subject to the purposes and confidentiality restrictions in the Terms and applicable agreements. Access to licensed research is distinct from access to your personal or connected-account data.

6.6 Personal data and model development. Our standard commercial model-development use excludes personal identifiers and actual customer account and trading data. Before admitting research to that use, we assess whether it contains personal data or excluded information and remove or segregate it as appropriate. Any proposed additional use of personal data for training, fine-tuning, evaluation or retrieval requires the notice and valid legal basis described in Section 3; the research licence alone is insufficient.

6.7 Anonymisation and derived models. Removing a name, replacing it with an identifier or combining records does not necessarily make data anonymous. We assess whether an individual can still reasonably be identified, including through available linked information and the risk of extracting personal information from a model. Model weights, embeddings and outputs are not automatically treated as anonymous simply because they were derived from data. Where they contain personal data, applicable data protection requirements continue to apply.

6.8 Enterprise workspaces. We process enterprise content according to the applicable signed agreement and authorised instructions. The standard commercial licence does not automatically apply to those workspaces. Research submitted outside a covered enterprise workspace remains subject to the terms applicable to that submission.

07Data retention

7.1 Personal data. We retain personal data only while it is needed for a notified and lawful purpose, including providing requested services, maintaining security, meeting legal obligations, resolving disputes or documenting rights and permissions. When retention is no longer necessary for a legal or business purpose, we delete or anonymise the data as required by law. A commercial intellectual property licence does not make all related personal data permanently retainable.

7.2 Licensed non-personal research. The Terms of Service determine how long we may retain and use validly licensed non-personal Research Materials and permitted derivatives. That licence may continue after you close an account or stop submitting new research, subject to its terms and applicable law. It does not override the exclusions or privacy rights described in this Policy.

7.3 Backups and model-related records. Deletion may involve removing active copies and allowing protected backup copies to expire through normal retention processes, subject to legal requirements. We evaluate requests affecting training datasets, retrieval stores, embeddings or models according to the personal data involved, our obligations and available measures. We do not assume that every trained model or its weights may always be retained regardless of those obligations.

08Cookies and similar technologies

8.1 We use cookies and similar technologies, including local storage, to support authentication, remember preferences, maintain security and understand use of the Services where permitted.

• Necessary technologies support functions such as authentication, security and the preferences you request.
• Analytics and performance technologies help us measure and improve the Services.

8.2 You can manage browser storage and cookies through your browser settings. Where consent is required for non-essential technologies, we will obtain it before using them. Blocking storage may affect features such as sign-in or saved preferences.

09Your rights and choices

9.1 Subject to applicable law and its exceptions, you may:

• Request access to your personal data and information about its use or disclosure, and request correction of inaccurate or incomplete personal data. A reasonable access fee may apply where permitted by law.
• Withdraw consent to processing that relies on your consent, on reasonable notice, as described in Section 3.
• Opt out of marketing through an available unsubscribe method or by contacting us.
• Request account closure and deletion of associated personal data, subject to applicable retention requirements and any additional rights provided by law.

9.2 You may stop making future submissions. That does not automatically revoke a valid commercial licence for earlier eligible non-personal Research Materials. Equally, the survival of that licence does not prevent you from exercising applicable personal data rights. We assess requests according to the relevant data and legal obligations rather than treating all research records or model weights alike.

9.3 Contact our Data Protection Officer using Section 14 to exercise your rights or ask about a processing purpose. We may verify your identity and clarify the request, and will respond within applicable legal timeframes. If an enterprise customer controls the relevant processing, we may refer the request to that customer and assist as required by our agreement and law.

10Security

10.1 We use reasonable administrative, technical and organisational safeguards appropriate to the data and risks, including access restrictions and measures to protect information in transit and in storage. No system can guarantee absolute security. Keep account credentials and API secrets confidential, use only the permissions needed for a connection and notify us promptly of suspected unauthorised access.

10.2 We assess suspected personal data breaches and notify the relevant authorities and affected individuals where required by applicable law.

11Children

11.1 The Services are intended for people aged 18 or over. We do not knowingly collect personal data from children using the Services. If you believe a child has provided personal data, please contact us so we can investigate and take appropriate steps, including deletion where required.

12Third-party links and services

12.1 External websites, exchanges, brokers, data providers and AI tools that you independently use have their own terms and privacy practices. Review them before sharing information. This does not remove our responsibility for processing we control or for providers acting on our behalf.

13Changes to this Policy

13.1 We may update this Policy and publish a revised version with a new date. We provide appropriate notice of material changes. If a change introduces a new personal data purpose, we establish the required legal basis and obtain fresh consent where required before starting that processing. A notice or continued browsing alone is not treated as that consent.

13.2 Changes to this Policy do not retrospectively grant commercial rights in historical research or override a signed enterprise agreement. The applicable Terms, recorded authorisations and mandatory law determine those rights.

14Contact us and Data Protection Officer

14.1 For questions, concerns, complaints or privacy requests, contact our Data Protection Officer:

• Email: louis@varsity-tech.com
• Postal: VARSITY TECH PTE. LTD., Robinson Square, 144 Robinson Road, #13-01, Singapore 068908.

14.2 You may also contact the Personal Data Protection Commission of Singapore or another competent data protection authority under applicable law.

Visit the Personal Data Protection Commission of Singapore.