Privacy Policy

This Privacy Policy explains how Vantix Wealth Labs ("VantageGrid", "we", "us", or "our") collects, uses, stores, and protects personal data when you use VantageGrid.pro, our applications, dashboards, integrations, APIs, and related services (the "Service").

1. Controller and Contact

For GDPR purposes, Vantix Wealth Labs, Netherlands, is the controller of personal data processed through the Service unless we state otherwise. You can contact us at privacy@vantagegrid.pro.

• Registered office: Industrieweg 9, 2254AE Voorschoten, Netherlands.
• Chamber of Commerce number: 42061959.
• VAT ID: NL005466966B47.
• Website: https://vantixwealthlabs.com.
• Support email: support@vantagegrid.pro.

2. Personal Data We Collect

We collect personal data directly from you, automatically from your use of the Service, and from third-party services you choose to connect, such as Stripe, broker or exchange integrations, TradingView workflows, email providers, and AI providers used for requested features.

TradingView is a trademark of its respective owner. VantageGrid is independent and is not affiliated with, endorsed by, or sponsored by these trademark owners.

Account Data

• Name, email address, password hash, account settings, subscription tier, legal acceptance timestamps, accepted legal document versions, and authentication metadata.
• Optional profile information such as public username, avatar, biography, and leaderboard preferences.

Trading and Journal Data

• Imported or manually entered trades, instruments, direction, quantities, prices, commissions, timestamps, tags, screenshots, notes, playbooks, and journal entries.
• Performance metrics generated from your data, including PnL, drawdown, expectancy, risk metrics, tax estimates, and coaching insights.

Integration and Security Data

• API keys, webhook identifiers, broker connection metadata, platform names, sync status, and integration logs.
• If you connect supported broker or exchange integrations, credentials or tokens may be stored in encrypted form and used only to provide the requested integration.
• API sync traces, environment selection, account names, import batch IDs, duplicate IDs, and diagnostic metadata needed to troubleshoot imports.

Billing Data

• Stripe customer IDs and, for Android purchases, Google Play and RevenueCat subscription identifiers, product, entitlement, status, expiry, environment, and payment-event metadata.
• We do not store full card numbers. Stripe or Google Play processes the payment credentials for purchases made through that provider.

Usage and Device Data

• IP address, browser type, pages visited, timestamps, session identifiers, event logs, error logs, rate-limit data, and security telemetry.

Communications and Marketing Data

• Support messages, transactional emails, newsletter subscription status, consent timestamps, unsubscribe tokens, email delivery/open metadata where available, and user email preferences.

3. How We Use Personal Data

1. To create and manage your account.
2. To provide journaling, analytics, dashboards, imports, exports, integrations, the Pro API, alerts, and the suggestions you ask for (section 6).
3. To calculate metrics such as win rate, PnL, expectancy, Kelly Criterion, Risk-of-Ruin, drawdown, and tax estimates.
4. To process and synchronize subscriptions through Stripe, Google Play, and RevenueCat.
5. To secure the Service, prevent abuse, enforce rate limits, investigate incidents, and protect users.
6. To respond to support requests, legal requests, and data-rights requests.
7. To send service, security, billing, legal, and account messages.
8. To send newsletters or product updates only where you have subscribed or where otherwise permitted by law, with unsubscribe options.
9. To improve the Service using aggregated, de-identified, or anonymized analytics where possible.

4. GDPR Legal Bases

1. Contract: processing needed to provide the Service, account access, support, subscriptions, and requested integrations.
2. Legitimate interests: platform security, fraud prevention, product improvement, service reliability, and abuse detection.
3. Consent: optional communications, optional public profile or leaderboard features, and any processing where consent is legally required.
4. Legal obligation: tax, accounting, compliance, dispute, and regulatory recordkeeping where applicable.

5. Legitimate Interests

Where we rely on legitimate interests, those interests include operating a secure SaaS platform, preventing fraud and abuse, maintaining reliable integrations, improving product quality, diagnosing errors, protecting users and our business, and understanding aggregated product usage. You may object to processing based on legitimate interests where GDPR gives you that right.

6. AI Processing and Data Accuracy

VantageGrid sends data to an AI provider only for the features below, and only when you ask for one of them:

1. Column matching for an unrecognised CSV. When the import does not recognise a file's layout and you choose to have its columns matched, the file's column headers and at most five of its rows are sent to the AI provider to work out which column holds which field. You see the result before any trade is saved.
2. Tags from your Close my day note. When you press Read my note under a saved review, the note you wrote, your commitment for the next session and the day's totals (how many trades, how many followed your rules, the net result per currency and the names of the rules broken) are sent to the AI provider to suggest up to three tags. No account name, account number or individual trade is sent. The suggestion is stored with the review; a tag is added to that day's trades only when you choose it.
3. Reading a pasted plan on the Rules page. When you press Read my plan, the text you pasted is sent to the AI provider to fill in the rules VantageGrid can check. The answer only fills the form: nothing is saved until you press Save, and the pasted text is not stored.
4. The Pro API. The Pro API sends nothing to an AI provider. Your own client or assistant requests your data with an API key you create, can make read-only, and can revoke; each call is counted on that key. If you add an outbound webhook, VantageGrid sends a trade.closed event to the address you set.
5. For each feature, the text is sent to the AI provider to produce the suggestion. Each request is recorded with your account (the feature, the model and the amount of text, not the text itself), and each feature has a monthly limit per account.
6. AI suggestions may be inaccurate or incomplete. They are not financial advice and do not guarantee future results; you check each one before it is used.
7. AI providers process the text and the answer as processors or subprocessors under their data processing terms. We do not use AI features to make legal, credit, employment, insurance, or similarly significant automated decisions about you.

7. Automated Decision-Making and Profiling

VantageGrid may calculate risk scores, churn indicators, usage metrics, prop-firm warnings, suggested tags, and performance insights. These outputs are product features and operational signals. We do not use them to make decisions with legal or similarly significant effects under GDPR Article 22 without human involvement or a separate lawful basis.

8. API Keys, Broker Credentials, and Encryption

1. API keys, broker credentials, and integration secrets are treated as sensitive data.
2. Where stored, these secrets are protected using encryption and access controls designed to prevent unauthorized access.
3. You should revoke and rotate keys immediately if you suspect compromise.
4. We will never ask you for passwords or secrets outside the secure product flows intended for that integration.

9. Sharing and Processors

We do not sell your personal data or trade data. We may share data with service providers only as needed to operate VantageGrid, including:

• Stripe for billing, checkout, invoices, and subscription management.
• Google Play and RevenueCat for Android purchases, entitlement validation, restoration, and subscription management.
• AI API providers for the suggestions you ask for: column matching for an unrecognised CSV, tags from a review note, and reading a pasted plan (section 6).
• Email providers for account, security, support, and billing messages.
• Hosting, database, logging, security, and infrastructure providers.
• Broker, exchange, market-data, and integration providers where you connect or request those integrations.
• Professional advisers, authorities, or courts where required by law or necessary to protect rights.

10. International Transfers

Some processors may operate outside the European Economic Area. Where required, we use appropriate safeguards such as Standard Contractual Clauses, data processing agreements, adequacy decisions, or equivalent transfer mechanisms.

11. Cookies and Similar Technologies

1. We use essential cookies for authentication, session security, CSRF protection, and account access.
2. When you arrive through an affiliate or partner link carrying a referral parameter, an essential first-touch attribution cookie records the referring partner. It is set immediately (contractual attribution, not measurement) and is not gated on cookie consent; it contains no contact or account data, is never used to target ads, and expires within 30 days.
3. Strictly functional local storage may be used without consent when needed for the page to work as designed — for example remembering your dark/light theme, your dashboard layout, and a local content-order assignment on our pricing page used to run an in-house page experiment. This data stays in your browser, contains no personal, contact, or trade data, is never shared, and is never used for tracking or advertising. Other preference cookies are stored only after you accept them.
4. We use first-party analytics identifiers only after you accept analytics cookies.
5. After you separately accept marketing measurement, we may retain an allowlisted Google Ads click identifier and campaign parameters for up to 90 days and record only generic verified-signup, trial-started, and first-payment-confirmed milestones for a separate offline uploader.
6. Google Ads does not receive trade data, P&L, broker details, account or contact identifiers, Stripe data, payment amounts, or a conversion value. No Google advertising tag runs in your browser.
7. Functional, analytics, and marketing choices can be accepted or rejected independently through Cookie settings. Withdrawing marketing consent revokes the first-party attribution record.

12. Retention

1. Account and trade data are retained while your account is active.
2. Billing, invoice, tax, and accounting records may be retained for the period required by applicable accounting and tax law.
3. Security logs, abuse-prevention logs, and audit records may be retained for a reasonable period needed to protect the Service, investigate incidents, and establish or defend legal claims.
4. Newsletter and consent records are retained while you are subscribed and for a reasonable period after unsubscribe where needed to prove consent or suppression status.
5. To prevent a later recurring event from being mislabeled as a first conversion, we retain a minimal internal once-per-account marker for verified signup, trial start, or first payment while the account remains active. It contains no click identifier, payment value, Stripe identifier, or trade data, is not itself uploaded, survives marketing-consent withdrawal, and is deleted with the account.
6. After account deletion, we aim to delete or anonymize personal data within 30 days unless longer retention is required for legal, accounting, security, backup, dispute, or fraud-prevention purposes. Backups may take longer to expire from rotation.
7. Aggregated or anonymized analytics may be retained indefinitely where they no longer identify you.

13. Security

1. We use technical and organizational measures designed to protect personal data, including HTTPS/TLS, password hashing, encryption for sensitive secrets, access controls, logging, rate limiting, and security monitoring.
2. No online service can guarantee absolute security. You are responsible for strong passwords, device security, and protecting your account credentials.
3. If we identify a personal data breach requiring notice, we will notify affected users and regulators as required by applicable law.

14. Your GDPR Rights

Subject to legal conditions and limitations, you may have the right to:

• Access your personal data.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data.
• Restrict or object to processing.
• Receive a portable copy of certain data.
• Withdraw consent where processing is based on consent.
• Complain to a supervisory authority, including the Dutch Autoriteit Persoonsgegevens.

To exercise these rights, use the authenticated deletion control in the Android app, visit Delete your account, or contact privacy@vantagegrid.pro. We may need to verify your identity before completing a request.

15. International Privacy Rights

1. If you are outside the EEA, you may have additional privacy rights under local law, including UK GDPR, Swiss data protection law, California privacy law, or other state and national privacy laws.
2. Where such laws apply to us, we will honor applicable access, deletion, correction, portability, opt-out, appeal, and non-discrimination rights.
3. We do not sell your personal data. We also do not share personal data for cross-context behavioral advertising as understood under California privacy law.
4. We do not knowingly collect, sell, or share the personal data of minors. The Service is intended only for adults aged 18 or older.
5. You can contact privacy@vantagegrid.pro to make a privacy request. We may verify your identity and may ask authorized agents to provide proof of authorization where required.

16. Email and Marketing Rules

1. Transactional emails, such as account, security, billing, legal, and service messages, are sent as needed to operate the Service.
2. Marketing emails, newsletters, product updates, and campaign emails are sent only where we have a lawful basis. They include an unsubscribe mechanism where required.
3. We maintain suppression records so we can honor unsubscribe requests and avoid sending marketing messages to unsubscribed addresses.

17. Public Features

If you opt into public profiles, leaderboard visibility, shared links, or similar public features, selected information may become visible to other users or the public. You can disable optional public features where available in your account settings.

18. Business Customer Data

Where a business customer uses VantageGrid to process personal data on behalf of that customer, the business customer may be the controller and VantageGrid may act as processor for that customer data. The Data Processing Agreement describes those processor terms.

19. Children

The Service is not intended for persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us so we can review and delete the account where appropriate.

20. Mobile App

The VantageGrid app for Android uses the same account as the website, and everything above applies to it. This section adds what is specific to the app.

Push Notifications

• When you turn on alerts, the app gets a push token for your device from Expo, which delivers notifications to Android devices through Firebase Cloud Messaging (Google). The app sends us that token and the platform name.
• We store the token with your account and use it only to send the alerts you chose. To deliver an alert, Expo and Firebase Cloud Messaging receive the token and the alert's title and text.
• When you turn alerts off, we stop sending them. When you sign out of the app, the token is marked inactive and is no longer used. Token records are deleted when you delete your account.

Signing In with Google

• If you sign in with Google, Google sends us your name, your email address, your Google account identifier, and whether the email address is verified. We keep the email address and the Google account identifier with your account, and your name when the sign-in creates the account. We never receive your Google password.
• You can disconnect Google from your account; the Google account identifier is then removed.

Camera and Photos

• The app asks for camera access only when you choose to take a chart photo for a trade. Photos are picked with the Android photo picker; the app asks for photo access only on a device where that picker does not work.
• Only the image you pick is uploaded, as a screenshot of that trade (PNG, JPEG or WebP, up to 5 MB, at most five per trade). The app does not read your photos in the background.
• Screenshots are kept private to your account and are deleted when you delete the screenshot, the trade, or your account.

Subscriptions

• Subscriptions bought in the app are sold and paid through Google Play. RevenueCat manages them for us: it receives a random store identifier for your account (not your email address or our account number) and your purchase history from Google Play, and tells us which subscription is active. The billing identifiers we keep are listed under Billing Data in section 2.

Broker and Exchange Connections

• If you connect a broker or exchange account in the app, the app sends the login details or API key you enter to us over HTTPS. Some connections are made on the provider's own page instead; we then receive only the access token or key that provider issues. We use these only to import your trades.
• Passwords, API keys, secrets, passphrases and access tokens are stored encrypted; credentials saved today use AES-256-GCM. The login name or email address and the account number of the connection are stored without encryption.
• Removing a Tradovate, TradeLocker, cTrader or exchange connection deletes its stored credentials. Disconnecting SnapTrade asks SnapTrade to delete your user there; the encrypted SnapTrade key we hold is then no longer used and is deleted with your account. Deleting your account deletes all stored credentials.

AI in the App

• The app has no AI chat and no chart reading: it sends no question, conversation, trade summary or chart image to an AI provider. Earlier versions of the app had both; a report on one of their answers is handled as described below. Section 6 lists what is sent to an AI provider, and when.

Reported AI Answers

• You can report an AI answer or a notification from the app. A report sends us the reason you chose, your comment if you add one, the reported text, the question that produced it, and whether it came from the chat or a chart read. We store it with your account and the time it was sent.
• Reports are read only by VantageGrid staff who review AI answers, to check the answer you reported. They are not sent to an AI provider or used for advertising.
• Reports are deleted 12 months after they are sent, or sooner when you delete your account.

On Your Device

The following describes how the app behaves on your phone:

• So that it opens quickly and works offline, the app keeps a copy of your dashboard, your trades and your app preferences in its private storage. This copy is excluded from Android cloud backup and is removed when you sign out.
• Your sign-in session is kept in storage protected by the Android Keystore.
• If you turn on the app lock, your PIN is stored only on the device, as a derived value in Keystore-protected storage, and fingerprint or face unlock is handled by Android. Your PIN and your biometric data never leave the device.

21. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email, in-app notice, or a prominent website notice where appropriate. Continued use of the Service after the effective date means the updated policy applies.

22. Contact

For privacy questions or data requests, contact privacy@vantagegrid.pro. For general support, contact support@vantagegrid.pro. Business customers can review our Data Processing Agreement template.