Open Account

Privacy Policy

Last updated: February 17, 2026 · Effective: February 17, 2026

1. Introduction

DrifTrade, LLC ("DrifTrade," "we," "our," or "us") is committed to protecting your privacy and the security of your personal information. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard your information when you access or use our trading platform applications (Windows, macOS, iOS, and Android), website, and related services (collectively, the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with these practices, you should not use the Service. We encourage you to read this policy carefully and contact us with any questions.

2. Information We Collect

2.1 Information You Provide Directly

  • Account Registration: Full name, email address, display name, and password (hashed with bcrypt, never stored in plaintext) when you create an account.
  • Profile Information: Timezone, display preferences, notification settings, and trading experience level.
  • Broker Credentials: OAuth tokens, API keys, and account identifiers for connected brokerage accounts. All broker credentials are encrypted at rest using AES-256-GCM with unique per-record initialization vectors.
  • Payment Information: Subscription and credit pack billing is processed exclusively through Stripe. We do not receive, process, or store your full credit card number, CVV, or bank account details. Stripe provides us only with the last four digits of your card and billing address for transaction records.
  • Trade Journal Data: Trade entries, notes, tags, screenshots, and strategy documentation you create within the platform.
  • Communications: Messages, inquiries, and feedback you submit through our contact form, support channels, or email correspondence.
  • Agentic Trainer Data: Your interactions with the AI trading coach, including practice trades, strategy selections, coaching preferences, and training progress. This data is used exclusively to personalize your training experience.

2.2 Information Collected Automatically

  • Device Information: Device type, operating system version, application version, browser type (for web access), screen resolution, and unique device identifiers.
  • Usage Analytics: Features accessed, actions performed, session duration, navigation paths, and interaction timestamps. We use this data in aggregate to improve the Service.
  • Log Data: IP address, access times, referring URLs, pages viewed, and error logs for security monitoring and troubleshooting.
  • Performance Metrics: Application load times, API response times, and crash reports to maintain service quality.

2.3 Information from Third Parties

  • Brokerage Data: When you connect a broker, we receive account balances, positions, order history, and transaction data through authorized API access.
  • Market Data Providers: Real-time and historical price data, company fundamentals, and news feeds from licensed third-party data providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Delivery: Provide, operate, and maintain the platform, including displaying market data, executing trades, and managing your portfolio.
  • AI Analysis: Generate trade signals, sentiment analysis, portfolio optimization recommendations, and personalized market insights using machine learning models.
  • Agentic Training: Power the AI trading coach to analyze your trading patterns, provide personalized coaching, simulate paper trading scenarios, and adapt training content to your skill level.
  • Account Management: Process subscription billing, manage credit allocations, and maintain your account.
  • Trade Execution: Route and execute orders to your connected brokerage accounts as instructed.
  • Communications: Send service-related notifications (security alerts, billing confirmations, feature updates) and respond to your inquiries.
  • Security & Fraud Prevention: Detect, investigate, and prevent unauthorized access, fraudulent activity, and abuse of the Service.
  • Service Improvement: Analyze usage patterns in aggregate to improve features, fix bugs, and develop new capabilities.
  • Legal Compliance: Comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

  • Contract Performance: Processing necessary to provide the Service you have requested (account management, trade execution, AI analysis).
  • Legitimate Interest: Processing necessary for our legitimate business interests (security, fraud prevention, service improvement), balanced against your rights.
  • Consent: Processing based on your explicit consent (marketing communications, optional analytics).
  • Legal Obligation: Processing necessary to comply with legal requirements.

5. Data Sharing and Disclosure

We do not sell your personal information. We share information only in the following circumstances:

  • Brokerage Partners: We transmit order data and account identifiers to your connected brokers (e.g., Charles Schwab, Alpaca) to execute trades on your behalf. Each broker has its own privacy policy governing how they handle your data.
  • Payment Processor: Stripe processes all billing transactions. Stripe's privacy policy governs their handling of your payment information.
  • AI Infrastructure: We use third-party AI services to generate trade signals and analysis. Data sent to these services is anonymized and does not include personally identifiable information or broker credentials.
  • Cloud Infrastructure: The Service is hosted on secure cloud infrastructure. Our hosting providers process data solely on our instructions and are contractually bound to protect your data.
  • Legal Requirements: We may disclose information if required by law, subpoena, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

6. International Data Transfers

DrifTrade is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate. These countries may have data protection laws that differ from those of your jurisdiction.

For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms as required by applicable law.

7. Data Retention

  • Account Data: Retained for the duration of your active account, plus 30 days after account deletion to allow for recovery.
  • Trade Journal: Retained for the duration of your account. Exported upon request before deletion.
  • Broker Credentials: Encrypted credentials are deleted immediately upon broker disconnection or account deletion.
  • Usage Analytics: Aggregated and anonymized after 24 months. Individual-level data is purged.
  • Payment Records: Retained for 7 years as required for tax and accounting compliance.
  • Support Communications: Retained for 3 years after resolution for quality assurance.
  • Agentic Trainer Data: Training progress and coaching history are retained for the duration of your account. Practice trade data is purged 90 days after generation.

8. Data Security

We implement institutional-grade security measures to protect your information:

  • Encryption at Rest: AES-256-GCM encryption for all broker credentials, with unique initialization vectors per record. Sensitive data fields are encrypted in our database.
  • Encryption in Transit: TLS 1.3 enforced for all communications between clients, APIs, and third-party services.
  • Authentication: SHA-256 hashed session tokens (no plaintext storage), bcrypt password hashing, and optional multi-factor authentication.
  • Access Controls: Role-based access control (RBAC) for all internal systems. Employee access to production data requires multi-factor authentication and is logged.
  • Audit Logging: All authentication events, broker connections, trade executions, and administrative actions are logged with immutable audit trails.
  • Infrastructure: Network segmentation, automated vulnerability scanning, and regular penetration testing by independent third parties.
  • Incident Response: We maintain a documented incident response plan and will notify affected users within 72 hours of discovering a confirmed data breach, as required by applicable law.

9. Cookies and Tracking Technologies

Our web properties use the following:

  • Essential Cookies: Required for authentication, session management, and security. These cannot be disabled.
  • Preference Cookies: Store your theme selection (dark/light mode), language, and display preferences.
  • Analytics Cookies: Collect anonymous usage data to help us improve the Service. You may opt out of analytics cookies through your browser settings.

We do not use third-party advertising cookies or tracking pixels. We do not participate in cross-site tracking or sell data to advertising networks.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your account and personal data ("right to be forgotten").
  • Portability: Request your data in a structured, machine-readable format.
  • Restriction: Request restriction of processing under certain circumstances.
  • Objection: Object to processing based on legitimate interests.
  • Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.
  • Non-Discrimination: Exercise your privacy rights without discriminatory treatment.

To exercise any of these rights, contact us at privacy@driftrade.com. We will respond to verified requests within 30 days (or sooner as required by applicable law).

11. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • The right to know what personal information we collect, use, and disclose.
  • The right to delete your personal information.
  • The right to opt out of the sale or sharing of personal information. We do not sell or share your personal information.
  • The right to correct inaccurate personal information.
  • The right to limit the use of sensitive personal information.

You may designate an authorized agent to make requests on your behalf. We may require verification of your identity before fulfilling requests.

12. European Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

  • The right to lodge a complaint with your local data protection authority.
  • The right to receive information about the safeguards relating to international data transfers.
  • The right to obtain human intervention in automated decision-making processes.

13. Automated Decision-Making and AI

DrifTrade uses AI and machine learning models to generate trade signals, risk assessments, portfolio recommendations, and coaching feedback through the Agentic Trainer. These systems process market data, technical indicators, and (where applicable) your trading history to produce their outputs.

Important: AI-generated outputs are informational tools designed to assist your decision-making. They do not constitute financial advice, and no automated system makes trading decisions on your behalf without your explicit instruction. You retain full control over all trade executions.

You have the right to request information about the logic involved in automated processing that significantly affects you, and to request human review of such processing.

14. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will promptly delete such information.

15. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated by posting the updated policy on this page, updating the "Last updated" date, and (for significant changes) sending an email notification to registered users at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of changes constitutes your acceptance of the revised policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

  • Email: privacy@driftrade.com
  • General Inquiries:Contact Form
  • Data Protection Requests: privacy@driftrade.com (include "Data Protection Request" in the subject line)

We will acknowledge your request within 5 business days and provide a substantive response within 30 days.