Privacy Policy — Cortex Trade

1. Who We Are

Cortex Trade ("Cortex Trade", "we", "us", or "our") operates the automated AI trading platform available at https://cortextrade.pocketpass.app. Cortex Trade is the data controller for personal data processed under this policy.

For privacy enquiries, contact us at wecare@pocketpass.app.

2. Data We Collect

2.1 Account Data

When you register, we collect your email address, chosen display name, and a hashed password (if you use password authentication). If you sign in with a hardware passkey, we store the public-key credential and device metadata — no password is ever stored.

2.2 Broker Credentials

To connect your Capital.com account, we collect your Capital.com API key and account password. These are encrypted at rest using AES-256 (Fernet) with a key derived via HKDF-SHA256 from our server secret; they are never stored in plain text and are never transmitted to any third party other than Capital.com for the purposes of executing your instructions.

2.3 Trading & Agent Data

We record positions, orders, trade history, and the full decision log produced by the AI agent pipeline (analyst outputs, debate transcripts, trader decisions, risk check results). This data is used to power your dashboard and audit log.

2.4 Usage Data

We collect standard server logs including IP address, browser type, operating system, referring page, pages visited, and timestamps. These are used for security monitoring, debugging, and aggregate analytics. We do not sell or use this data for behavioural advertising.

2.5 Billing Data

Subscription payments are processed by PayPal. We receive a PayPal subscription ID and billing status but do not store your card number, bank account details, or PayPal login credentials.

2.6 Communications

If you contact our support team, we retain those communications to resolve your query and improve our service.

3. How We Use Your Data

Purpose	Lawful basis
Providing and operating the Cortex Trade platform	Contractual necessity
Executing trades via Capital.com on your instruction	Contractual necessity
Processing subscription payments via PayPal	Contractual necessity
Securing your account (MFA, passkeys, anomaly detection)	Contractual necessity / Legitimate interest
Debugging, improving reliability, and monitoring performance	Legitimate interest
Sending transactional emails (trade alerts, billing receipts)	Contractual necessity
Complying with legal obligations	Legal obligation

We do not use your data for targeted advertising or sell it to third parties.

4. Shared AI Analysis & Your Privacy

Cortex Trade's AI pipeline caches instrument-level market signals — technical indicators, news sentiment scores, and fundamental analysis outputs computed for a given financial instrument — and reuses those aggregated signals across multiple users watching the same market. This is market data about the instrument, not data about you.

Your personal data is never shared with or visible to other users. Your individual execution path — your risk rules, position limits, portfolio composition, and broker orders — always runs privately and in isolation using only your own settings and credentials.

AI analysis prompts sent to Anthropic (Claude) contain only market data (price history, news headlines, indicator values). They never include your name, account details, broker credentials, portfolio positions, or any personally identifying information. See Section 5 for Anthropic's data processing terms.

5. Third Parties We Share Data With

Third Party	Purpose	Data Shared
Anthropic (Claude AI)	AI market analysis	Aggregated market-level data only (price history, news, indicators). No personal data.
Capital.com	Trade execution & account sync	Your encrypted credentials (decrypted only at the moment of API call); order instructions you have configured.
PayPal	Subscription billing	Your email address; subscription plan and billing interval. Payment credentials are held by PayPal, not Cortex Trade.
Hosting / Infrastructure provider	Platform hosting	All platform data (processed under data-processing agreements with appropriate safeguards).

We require all third parties to maintain appropriate data protection standards and only process your data on our instructions. We do not sell personal data to any third party.

6. Data Security

We implement industry-standard technical and organisational measures to protect your data:

Encryption at rest: Broker API keys and session tokens are encrypted with AES-256 (Fernet) using an HKDF-SHA256-derived key. The encryption key is never stored alongside the encrypted data.
Encryption in transit: All connections use TLS 1.3. Plain-HTTP connections are rejected.
Authentication: We support hardware passkeys (WebAuthn) and TOTP two-factor authentication. We recommend enabling both.
Access controls: Database access is limited to application processes and authorised staff. Staff access to production data requires multi-factor authentication.
Monitoring: We monitor for anomalous authentication attempts and unusual trading activity.

No security measure is infallible. If you believe your account has been compromised, contact us immediately at wecare@pocketpass.app.

7. Data Retention

Data type	Retention period
Account information	Duration of account, then 2 years after deletion request
Trade history & agent decision logs	Duration of account
Broker credentials	Deleted immediately on disconnection or account deletion
Billing records	7 years (legal / tax obligation)
Server access logs	90 days
Support correspondence	3 years after resolution

You may request earlier deletion subject to our legal obligations (e.g., billing records we must retain for tax purposes).

8. Your Rights

Depending on your jurisdiction, you may have the following rights over your personal data. To exercise any of them, email wecare@pocketpass.app from the address associated with your account.

Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten"): Request deletion of your account and personal data, subject to legal retention requirements.
Data portability: Receive your trade history and account data in a machine-readable format (JSON or CSV).
Restriction of processing: Ask us to pause processing while a dispute is resolved.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Where processing relies on your consent, withdraw it at any time.

We will respond to verified requests within 30 days. If you believe we have mishandled your data, you have the right to lodge a complaint with your local data protection authority.

9. Cookies & Tracking

We use cookies solely for the following purposes:

Session cookie — maintains your authenticated session. This cookie is strictly necessary and cannot be opted out of while using the platform.
CSRF token cookie — protects against cross-site request forgery. Strictly necessary.
Preference cookies — remember your UI preferences (e.g., dark/light mode). These expire after 1 year.

We do not use advertising cookies, tracking pixels, or third-party analytics services. We do not share cookie data with any advertising networks.

10. Children's Privacy

Cortex Trade is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us and we will delete the account promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice within the platform at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions, data requests, or concerns:

Cortex Trade — Data Privacy

wecare@pocketpass.app

We aim to respond to all privacy requests within 5 business days.