1. Company Information

NexTick360 LLC — a New Mexico Limited Liability Company, United States.

Primary Data Residency: United States (Microsoft Azure — Central US).

Contact: Contact Us

2. Information We Collect

A. Account Information

When you create an account, we collect:

• Name
• Email address
• Authentication provider identifier (Google, Microsoft, or email/password)
• Tenant ID
• Subscription status

We do not collect or store payment card numbers.

B. Social Login (OAuth)

If you sign in using Google or Microsoft, we receive your name, email address, and a unique provider identifier. The authentication provider may receive information that you are signing into NexTick360 as part of the OAuth redirect flow. We do not receive or store your Google or Microsoft password. Social login is governed by the respective provider's privacy policy.

C. Execution Platform Credentials (Local Only)

If you connect NexTick360 to a supported execution platform (e.g., Rithmic):

• Your username and password are stored only on your local Windows machine.
• Credentials are encrypted using Windows DPAPI (user-scoped encryption).
• Credentials are never transmitted to NexTick360 servers.
• Credentials are never stored in the cloud.

We do not have access to your execution platform credentials.

D. Trade & Execution Data

We collect and process trading analytics data including per-trade data (symbol, side, quantity, entry/exit prices, timestamps, realized PnL, commissions, fees, slippage metrics, MFE/MAE, strategy tags, and user notes), per-fill data (fill price, quantity, timestamp, bid/ask/spread at fill), and execution quality metrics such as slippage, mark-outs, aggression score, and market regime context.

This data is stored locally in SQLite on your device and is synchronized to Azure SQL databases using per-tenant isolation. Synchronization is a core function of the Service and is not optional: the web application's analytics, coaching, journalling and reporting operate on the synchronized copy of this data. You may export or delete your data at any time, and deleting your account deletes it from our cloud databases.

E. Market Data Handling

NexTick360 does not operate as a market data redistributor. To measure the quality of your executions, the desktop application works with the market context around each of your trades — the prices at and around your fills — spanning from approximately one minute before entry until fifteen minutes after exit, which is the longest interval our execution measurements require. That context is held on your own device while it is being measured, for up to twenty-four hours. What is stored in our cloud is your trades, the metrics we derive from them, and point-in-time market context snapshots recorded alongside them. Users must maintain valid market data entitlements through their execution platform provider.

F. Journal & Psychology Data

If you use journaling features, we collect journal titles and markdown content, mood/stress/focus scores, day ratings, goals, rules violated, behavioral scoring metrics, and chart image URLs. This data is stored in Azure SQL databases with per-tenant isolation.

G. AI-Powered Features

When you use AI-powered features (e.g., Quick Ask or Strategy Builder), relevant trade summary context and your question text may be sent to OpenAI or Microsoft Azure OpenAI for processing. When using the Strategy Builder, your conversation history (questions and AI-generated responses) is stored in our cloud database for continuity and audit purposes. Execution platform credentials are never transmitted to AI providers. AI-generated responses are informational only and are not financial advice.

Third-party AI providers process data under their own privacy policies.

H. Device, Telemetry & Audit Data

Telemetry is disabled by default and requires explicit opt-in. If enabled, we may collect application version, performance metrics, and session events.

Audit logging may occur independently of telemetry settings for security and compliance purposes. Audit records may include machine name, IP address, user ID, and event type.

We use Google Analytics (website usage analytics), Azure Application Insights (cloud service telemetry), and Sentry (sales website error reporting only). We do not use advertising trackers, behavioral advertising systems, or session recording tools.

I. Payment Processing

Payments are processed exclusively by Stripe. We share your email, display name, and tenant reference with Stripe. We receive subscription status and customer/subscription identifiers from Stripe. We never receive or store full credit card numbers.

3. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. We use two categories:

• Strictly necessary cookies — required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies — set by Google Analytics to measure website usage. These are non-essential.

We do not use advertising, cross-site tracking, or behavioral advertising cookies. You can control or delete cookies at any time through your browser settings, though disabling some cookies may affect how the Service functions. Where required by law, we request your consent before setting non-essential cookies, as described in the EEA & UK section below.

4. How We Use Information

We use collected information to:

• Provide execution analytics and performance metrics
• Deliver behavioral and discipline insights
• Generate AI-assisted performance summaries
• Maintain secure account access
• Improve product reliability and performance
• Manage subscriptions and billing
• Detect and prevent misuse of the Service

We do not sell personal information.

5. Automated Processing & Profiling

A core purpose of the Service is to analyze your trading activity. We use automated processing to generate execution-quality metrics, behavioral and discipline insights, strategy-adherence scoring, and AI-assisted summaries. These outputs are informational decision-support tools intended to help you understand your own trading.

This processing does not produce legal or similarly significant effects, and we do not use it to make automated decisions about you without human involvement. You may ask questions about, or object to, this processing as described in the sections on your rights below.

6. Third Parties & Subprocessors

We do not sell your personal information. We share it only with the service providers (“subprocessors”) that help us operate the Service, each contractually bound to protect it and to use it only for the purposes we specify:

• Stripe — payment processing. We share your email, display name, and tenant reference, and receive subscription and customer identifiers. Stripe never shares your full card number with us.
• OpenAI and Microsoft Azure OpenAI — AI-powered features (Quick Ask, Strategy Builder). We send relevant trade-summary context and your question text. Execution platform credentials are never sent.
• Microsoft Azure — cloud hosting, database storage, and application telemetry, in the United States (Central US region).
• Google — Google Sign-In (name, email, and a provider identifier if you choose Google login) and Google Analytics (website usage).
• Microsoft — Microsoft Sign-In (name, email, and a provider identifier if you choose Microsoft login).
• Sentry — error reporting for our sales website only.

We do not share your locally stored execution platform credentials, which never leave your device. We may also disclose information where required by law or to protect our legal rights.

7. Data Storage & Security

Cloud infrastructure is hosted in Microsoft Azure (Central US region). Production storage uses geo-redundant replication within the United States. All data resides within the United States. Each tenant is logically isolated. Individual customers share a common database in which every record carries a tenant identifier, and separation is enforced both by the application and independently by the database itself, so a request scoped to one tenant cannot read or write another tenant's records. Organizational customers, such as trading rooms and proprietary trading firms, may be provisioned a dedicated database. A copy of trading data captured on the desktop application is retained locally on the user's device in addition to being synchronized to our cloud databases.

We implement reasonable technical and organizational safeguards to protect user data, including encryption in transit (TLS) and at rest.

8. Data Retention

We retain account and trading data for as long as your account remains active. Upon account termination, cloud data may be deleted after a reasonable retention period (typically 30 days). Local data remains under user control. AI conversation history stored in our cloud database is deleted with your account data.

9. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users within a reasonable timeframe and in accordance with applicable law.

10. Your Rights

You may:

• Access your stored data
• Request correction of inaccurate data
• Request account and data deletion
• Disable telemetry features
• Export your trading data

To exercise these rights, contact us.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the personal information we collect, use, and disclose.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information to third parties.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us.

12. EEA & UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, this section applies to you and supplements the rest of this Policy.

Data Controller

NexTick360 LLC is the controller of your personal information. You can reach us through our contact form.

Legal Bases for Processing

• Performance of a contract — to provide the Service you subscribe to.
• Legitimate interests — to secure, maintain, and improve the Service and prevent misuse, balanced against your rights.
• Consent — for optional features such as telemetry and non-essential cookies, which you may withdraw at any time.
• Legal obligation — where we must process information to comply with applicable law.

Your GDPR Rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal information; the right to data portability; and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

International Data Transfers

Your personal information is processed and stored in the United States. Where we transfer personal information from the EEA or UK to the United States, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, a copy of which you may request.

Right to Lodge a Complaint

You may lodge a complaint with your local data protection authority. In the United Kingdom, this is the Information Commissioner's Office (ICO). To exercise any of these rights, contact us.

13. Children's Privacy

The Service is not intended for individuals under 18 years of age.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted with a revised Effective Date. We will notify users of material changes via email or in-app notification.

15. Contact Information

NexTick360 LLC — Contact Us