This Policy explains which personal data ScripTrade processes, why it is processed, how long it is retained, and which choices are available. Processing is carried out in accordance with the EU General Data Protection Regulation (GDPR) and other applicable law.
1. Controller and contact
The data controller is AlgoWizard di Emmanuele Carcereri, registered office at Via Camalavicina 7, 37014 Castelnuovo del Garda (VR), Italy, VAT number 05222030230, reachable at support@algowizard.ai.
2. Data we process
- Account and authentication data: email address, name, account identifiers, and information needed to secure your session. Authentication is handled through Clerk; ScripTrade does not receive your password in plain text.
- Service content: strategy descriptions, parameters, conversations, generated Expert Advisors, revisions, and preferences.
- Billing and payment data: name or company name, billing address, VAT number or tax code where provided, and transaction outcomes. Full payment card details are handled directly by Stripe and are not stored by ScripTrade.
- Technical and security data: IP address, browser, device, timestamps, application logs, error events, and signals needed to prevent abuse.
- Waitlist and referral data: email address, invitation code, and information needed to attribute a referral.
- Evidence of privacy and contractual choices: random choice identifier, accepted or rejected categories, document versions, date and, for purchases or plan changes, account identifier and Stripe reference. We do not record IP addresses, user agents, email addresses, prompts, or content in consent evidence.
3. Purposes and legal bases
- Create and manage accounts, generate requested code, and provide the Service: performance of a contract.
- Process payments, invoices, and tax obligations: performance of a contract and compliance with law.
- Protect accounts and infrastructure, prevent fraud, and resolve incidents: legitimate interests in operating a secure Service.
- Send operational account and service messages: performance of a contract.
- Send promotional messages or enable non-essential analytics: consent, which may be withdrawn at any time.
- Record and demonstrate privacy and contractual choices: compliance with legal obligations and legitimate interests in handling requests, disputes, and compliance.
4. Providers and recipients
We share data only as necessary with providers supporting authentication and user management (Clerk), frontend hosting (Vercel), application and database infrastructure (Railway), payments (Stripe), and AI-assisted code generation (OpenAI). If you consent to marketing cookies, we use Google Ads, Meta and OpenAI Ads tools to measure advertising conversions. Other providers act as processors or independent controllers according to the service.
Instructions and content sent to AI providers are limited to what is needed to generate or correct the requested code. We do not sell personal data.
We do not use your briefs or generated code to train artificial intelligence models, whether ours or those of our AI providers; we keep them only for as long as needed to deliver and, where necessary, correct the requested generation, as described in section 6. Avoid putting third-party personal data, credentials, API keys or other unnecessary sensitive information into your briefs.
Our personnel do not access Service content by default. Access is restricted to authorised personnel on a need-to-know basis and limited to what is necessary for technical support, diagnosing faults, investigating abuse of the Service and legal compliance. Every time a generation record is opened and every download of generated code is written to an internal access log recording who accessed it and when. We do not use Service content for purposes other than those set out in section 3.
For more information, see the Meta Privacy Policy, the Meta Business Tools Terms and the Controller Addendum. You can also manage advertising preferences through YourOnlineChoices.
5. International transfers
Some providers may process data outside the European Economic Area. Where required, ScripTrade relies on adequacy decisions, Standard Contractual Clauses, or another recognized transfer mechanism. You may request information about the applicable safeguards and a copy of them, subject to necessary redactions, using the contact in section 1.
6. Retention
We keep account data while the account is open. You can delete your Expert Advisors or the whole account at any time from Settings > Danger zone; deletion takes effect immediately. When you delete your account we erase the profile, Expert Advisors, generated code, conversations, strategy descriptions, credits and preferences, and we delete the authentication account at Clerk. We keep only: invoices, payment records and the billing data in them, for ten years, as tax and accounting law requires (Stripe keeps its own copy as an independent controller); evidence of contractual and privacy choices, in pseudonymous form, for ten years (purchases) or two years (cookies); affiliate commission and payout records, without the link to your account, for ten years; the administrative access log, without your email address, for up to ten years, for security; and, if you used the free trial, a keyed one-way hash of your email address and IP address together with a record of the deletion, for twelve months, so the trial cannot be claimed repeatedly. Deleted data may remain in encrypted backups until they rotate and in technical logs, in both cases for at most 30 days. The AI provider may keep content sent for generation for up to 30 days for abuse monitoring. Anonymous cookie-choice evidence is deleted within two years; the on-device preference expires after six months. Consent-based data is processed until consent is withdrawn unless another legal ground applies. Google Ads, Meta and OpenAI may retain Event Data under their respective terms.
7. Cookies and similar technologies
Clerk uses strictly necessary cookies for authentication, security, and session continuity. Disabling them would prevent the Service from working. Non-essential analytics or marketing tools are enabled only according to the choices made in the cookie banner. Choices can be changed at any time using ‘Review cookie choices’ in the footer.
- Clerk authentication cookies (__session, __client_uat and related security cookies): strictly necessary; used to authenticate users, protect sessions, and prevent abuse; retained for the session or the period configured for Clerk authentication.
- aw_cookie_consent (local storage): strictly necessary to remember your cookie choices; retained for up to six months, or until choices are changed or browser storage is cleared.
- aw_privacy_subject_id (local storage): random identifier strictly necessary to link cookie-choice evidence on the device; it contains no name or email and remains until browser data is cleared.
- aw_pending_cookie_consent_events (local storage): temporary technical queue containing only choices not yet delivered to the compliance record; it is removed after delivery and contains at most ten events.
- aw_analytics_sid (session storage): optional analytics identifier, created only after analytics consent and removed when the browser session storage ends or consent is withdrawn.
- aw_waitlist_affiliate_code (local storage): functional identifier used to show the personal referral code issued after joining the waitlist; retained for up to 30 days. Referral attribution arriving from a shared link is passed directly to the waitlist request and is not stored on the device.
- Google Ads, Meta and OpenAI Ads marketing tools: They activate only with your consent to measure advertising conversions. You can change or withdraw your choice at any time from the footer.
8. Your rights
Where provided by law, you may request access, correction, deletion, restriction, portability, or object to processing. You can exercise the main rights yourself, at any time, from Settings: download a copy of your data in a reusable format (Privacy and data), delete your Expert Advisors, or delete your account (Danger zone). These actions require you to be signed in and, for deletions, to confirm your identity again. You may also send requests using the contact in section 1; we may ask for information needed to verify identity and normally respond within one month. You may withdraw consent without affecting earlier lawful processing.
You may also lodge a complaint with the competent authority, including the Italian Data Protection Authority (Garante).
9. Required and optional data
Account, authentication, service-request, and billing information marked as required is necessary to create an account, provide requested code generation, or complete a purchase. Without it, the related feature or contract cannot be provided. Newsletter, non-essential analytics, and marketing data are optional and refusal has no effect on access to the core Service.
10. Automated processing
ScripTrade uses automated systems to generate and technically review software from your instructions. It does not make decisions that produce legal or similarly significant effects about you, and it does not provide automated credit, employment, insurance, or investment-suitability decisions.
11. Security, children, and updates
We use technical and organizational safeguards proportionate to risk. The Service is intended for adults and is not knowingly directed to anyone under 18. We may update this Policy to reflect legal or Service changes and will provide appropriate notice of material revisions.
Use of the Service is also governed by the Terms of Service.