/ Privacy

Scope

This Privacy Policy explains how Ceres AI, operated by Rugged I/O LLC, collects, uses, discloses, and protects information when you access https://ceresalgo.com/, use the application environment in the application environment, create an account, subscribe, contact support, connect third-party services, or otherwise use the Services. This Privacy Policy is incorporated into the Terms.

Information We Collect

• Account information: name, email address, username, password hash, account settings, verification status, and authentication details.
• Billing information: subscription plan, invoices, payment status, tax information, and limited payment details provided by payment processors.
• Usage and device data: IP address, browser, device identifiers, log data, pages viewed, feature usage, diagnostics, cookies, and similar technologies.
• Trading and integration data: brokerage connection metadata, API status, symbols, watchlists, alerts, portfolio or strategy information you choose to connect or submit, and third-party service responses needed to provide the Services.
• User Content: prompts, comments, files, feedback, messages, settings, support requests, and other content you provide.

How We Use Information

We use information to:

• Provide, secure, operate, personalize, troubleshoot, and improve the Services.
• Create accounts, authenticate users, process subscriptions, send invoices, and manage billing.
• Connect third-party services at your direction and display related data inside the Services.
• Generate analytics, AI outputs, alerts, product insights, and support responses.
• Monitor abuse, prevent fraud, enforce Terms, protect rights, and comply with legal obligations.
• Send service notices, security alerts, policy updates, and marketing communications where permitted. You may opt out of marketing emails.

Cookies and Tracking

We use cookies, local storage, pixels, and similar technologies for authentication, security, preferences, analytics, performance, and product improvement. You can control cookies through your browser settings, but disabling certain cookies may limit functionality.

How We Share Information

We do not sell personal information in the ordinary meaning of selling data for money. We share information with the categories of service providers and processors listed below. We may also share information when you direct us to connect a third-party service, during a business transfer, to comply with law, to enforce our rights, or to protect users and the public.

Third-party processors we use today

• Large-language-model providers (process your prompts and AI outputs):
  • Kimi (Moonshot AI) — hosted in China; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • MiniMax — hosted in the United States and Singapore; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • Google Gemini — hosted in the United States (with EU/UK sub-processing); processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • OpenAI ChatGPT — hosted in the United States; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • Anthropic Claude — hosted in the United States; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • Perplexity AI — hosted in the United States; processes prompt text and live web-grounded queries for market research and commentary.
  • xAI Grok — hosted in the United States; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  • DeepSeek — hosted in China; processes prompt text for market sentiment analysis, strategy review, and trading commentary.
  Where required, transfers to these providers are governed by the EU-US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses (SCCs). To keep costs and response times down, an AI analysis generated for one account may be reused for another account that requests an equivalent analysis (same analysis type and symbol) within a limited period. A reused analysis may reflect the strategy context of the account it was first generated for, but never includes that account's name or contact details.
• Brokerage & Execution: OANDA Corporation / OANDA v20 API (US). Transmits trade instructions, retrieves account balances, and syncs position data at your direction, including through algorithms you enable.
• Payments: Stripe, Inc. (US). Processes card details, subscription state, invoices, refunds, and chargebacks. Subject to PCI-DSS.
• Security, IP Geolocation & Content Moderation: IPInfo.io (processes signup/login IP addresses for security and fraud prevention), Google reCAPTCHA (processes signup and sign-in challenge tokens and device signals to block automated abuse), and Sightengine (processes user-uploaded images for automated safety and nudity/scam moderation).
• Analytics, error monitoring, voice & real-time messaging: Google Analytics (measures site and page usage on every visit; it runs regardless of your cookie-banner choice), Bugsnag (SmartBear Software — receives error stack traces, request metadata, environment data, the database query values involved in an error, and, when you are signed in, your account profile details such as name, email address, IP address, and billing identifier; used only to diagnose and fix errors), our self-hosted real-time broadcast server for in-app notifications (its browser client library is loaded from Pusher's content delivery network), voice-assistant integrations you choose to link (process your voice requests and spoken portfolio/strategy summaries), and Discord / Slack webhooks (delivers user-configured trade notifications and support alerts).
• Hosting, email delivery & newsletter intake: AWS (including Amazon S3 for public user avatars, cover images, and post media) / GCP / equivalent cloud providers in the United States; transactional and notification email delivery via Mailtrap; and our internal newsletter intake service (library.paulkamau.com) when you subscribe to product updates.
• Market and reference data: OANDA pricing data, plus market data and public filing providers configured for strategy evaluation (including Financial Modeling Prep, AlphaVantage, TwelveData, Marketstack, TradingView, and public regulatory disclosure feeds). Subject to their own terms.

Security and Retention

We use administrative, technical, and organizational safeguards designed to protect information. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security.

Retention categories and periods. We retain different categories of information for different periods, summarised below. "Account" means the user PII we associate with your login (name, email, password hash, billing details). "Content" means algorithmic trading strategies, condition rules, recurring symbol lists, entry snapshots, trade logs, strategy execution records, AI insights, AI request logs, and any other user-configured parameters you have produced inside the Services.

• Account PII (name, email, password, billing tokens): retained while your account is active; hard-deleted or irreversibly anonymised within 30 days of account closure.
• Content (strategy configurations, condition rules, entry snapshots, execution logs, AI insights, prompts): retained while your account is active. After account closure, identifying fields are removed; algorithmic performance and execution metadata are retained in anonymised form for platform analytics and our legitimate interest in operating the platform. Anonymised content is not linked back to a natural person.
• Billing records (invoices, Stripe events): retained for at least 7 years to satisfy tax, accounting, and AML obligations.
• Audit and security logs: retained for at least 1 year for fraud detection and incident response.
• Support correspondence: retained for at least 2 years for service quality and legal defence.

Your Choices and Rights

Depending on where you live, you may have rights to access, correct, export, restrict, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing is based on consent. To make a request, contact support@ruggedx.ai. We may need to verify your identity before completing a request.

Account closure and PII deletion. You can request account closure at any time through account settings. We will hard-delete or irreversibly anonymise your Account PII within 30 days. Note that anonymised algorithmic metadata and execution logs are retained per §6 for platform analytics.

International Processing

Information may be processed in the United States and other jurisdictions where Ceres AI or its service providers operate. Those jurisdictions may have data protection laws different from those in your location.

Children's Privacy

The Services are not directed to children or anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor provided information to us, contact support@ruggedx.ai.

Changes to This Policy

We may update this Privacy Policy by posting a revised version on this page or otherwise providing notice. Continued use of the Services after an update means the revised policy applies to information collected after the effective date, subject to applicable law.