Privacy Policy

AlphaHouse (“we”, “us”) operates the website at alphahouse.ai and the trading automation platform behind it. The person responsible for deciding how and why your personal information is used — the data controller — is:

• AlphaHouse, operated as a sole proprietorship based in California, United States
• Privacy contact: privacy@alphahouse.ai

What we are not. AlphaHouse is a technology provider. We never take custody of your funds and we are not a regulated financial institution. Nothing here is financial advice.

Our infrastructure is in the United States. The Supabase database sits in AWS us-west-1 (California), and Vercel, Stripe, Resend, Google, PostHog and tawk.to all process data in the US or globally. If you are in the UK, EEA or Switzerland, your information is therefore transferred outside your home jurisdiction.

For those transfers we rely on the Standard Contractual Clauses published by the European Commission (and the UK International Data Transfer Addendum), which are incorporated into the data processing terms our providers publish. Several of these providers are also certified under the EU–US Data Privacy Framework.

• Encryption in transit (TLS) for all traffic, and at rest in the database.
• Exchange API credentials encrypted with a key held separately from the database, and decrypted only inside the server-side function that places an order.
• We require trade-only API permissions. We do not accept, and cannot use, keys with withdrawal rights — so a compromise of our systems cannot move your funds off the exchange.
• Row-level security in the database so one account cannot read another's data, enforced by the database rather than by application code.
• Passwords stored only as salted hashes. Administrative access is restricted and logged.
• Automated dependency vulnerability scanning and secret scanning in CI.

No system is perfectly secure. Please use a unique password, enable every protection your exchange offers, restrict your API key by IP where the exchange supports it, and revoke keys at the exchange first if you suspect a problem.

If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you without undue delay, describing what happened, what data was involved and what to do about it.

Report a vulnerability to security@alphahouse.ai. Please give us a reasonable opportunity to fix it before disclosing publicly.

You can ask us to:

• Give you a copy of the personal information we hold about you, and tell you how we use it.
• Correct anything inaccurate or incomplete.
• Delete your information, where we have no overriding obligation to keep it.
• Restrict how we use it while something is being checked or disputed.
• Port it — receive it in a structured, machine-readable format, or have it sent to another provider.
• Object to processing based on legitimate interests, and to profiling.
• Withdraw consent at any time, for anything based on consent. This does not affect what we did before you withdrew.
• Stop direct marketing. This one is absolute — we will always honour it, with no balancing test.

How to ask: use the privacy request form or email privacy@alphahouse.ai. You do not need an account. Exercising any of these rights is free and we will not treat you worse for it.

How we verify it is you. Before we disclose or delete anything we confirm your identity, normally by emailing the address on the account and, for higher-risk requests, asking you to confirm details only the account holder would know. We do not ask for photo ID or government documents — collecting identity papers to answer a privacy request creates more risk than it removes. If we genuinely cannot verify you, we will tell you why rather than refusing silently.

Timing. We respond within one month (45 days for California requests). Complex requests may be extended by a further two months; we will tell you before the original deadline if that happens.

Some rights have limits. We cannot run the trading service without the trading data, so a restriction request will pause execution. Billing records must be kept for tax purposes even after deletion. We will always explain which exception we are relying on.

We extend the rights set out in this section to California residents, whether or not the CCPA/CPRA applies to us.

Notice at Collection. The categories we collect, why, and for how long are set out in sections 2, 3 and 6 above, and are disclosed at or before the point of collection. In CCPA terms we collect: identifiers; customer records; commercial information; internet and network activity; approximate geolocation (from IP); inferences drawn from usage; and account log-in credentials, which count as sensitive personal information.

Sensitive personal information. We use your exchange API credentials solely to perform the service you asked for — that is, to place the trades you configured. We do not use them to infer characteristics about you, which is the use CPRA lets you limit. You can still submit a “limit the use of my sensitive personal information” request through the privacy request form.

Do not sell or share. We do not sell personal information for money and never have. Using Google Analytics and Google Tag Manager can constitute “sharing” for cross-context behavioural advertising under the CPRA, depending on how they are configured. Here is how ours are configured, and what you control:

• Analytics and Advertising are off unless you switch them on — Cookie Settings. Leaving Analytics off is what stops Google Analytics and Google Tag Manager loading at all.
• We honour Global Privacy Control as a valid opt-out of sale and sharing. If your browser sends it, the Advertising category is locked off and cannot be enabled here, and no advertising or ad-personalisation signals are sent to Google.
• You can submit an explicit opt-out via the privacy request form.

Your rights to know, correct, delete, opt out and limit are the same as those in section 8 and use the same form. We will not discriminate against you for exercising them. You may use an authorised agent; we will ask for proof of their authority.

The platform is automated by design, and you should understand exactly what that means. Our systems automatically generate trading signals and place orders on the exchange account you connect, without a human reviewing each trade. That automation acts on market data, not on an assessment of you as a person: the same signals are produced for every subscriber to a given system, sized to the capital and leverage you chose.

Because this processing is carried out to perform the contract you entered into, and because you choose which system to run, at what leverage, and can pause or disconnect at any moment, we consider it permitted under GDPR Art. 22(2)(a). You retain meaningful control: you can stop execution, revoke the API key at your exchange, or close positions yourself at any time.

We do not use automated decision-making to decide whether you may open an account, what you pay, or your creditworthiness. We do not profile you for advertising.

If you disagree with an automated outcome you can contact us for human review at support@alphahouse.ai. Please note we can explain and correct how the system operated — we cannot reverse a trade that has already executed on an exchange.

AlphaHouse is for adults only. You must be at least 18 to open an account, and the service is not directed at children. We do not knowingly collect information from anyone under 18.

We currently rely on the age confirmation in our Terms rather than on document-based age verification. If we learn that we hold information about a child, we will delete it and close the account. If you believe a child has given us information, contact privacy@alphahouse.ai.

Effective date: 1 August 2026. Last updated: 17 August 2026. Version 2.0.1.

If we make a material change we will email account holders and show a notice in the app before it takes effect. If the change affects cookies or tracking, we will ask for your consent again rather than carrying the old one over.

We will not treat your continued use of the site as agreement to a change that requires consent. The previous version of this policy said the opposite; that was wrong and has been removed.

• Privacy: privacy@alphahouse.ai
• Security reports: security@alphahouse.ai
• General support: support@alphahouse.ai

If you are unhappy with how we handled your information, please tell us first so we can put it right. You also have the right to complain to a data protection authority:

• EU/EEA: the supervisory authority where you live, work, or where the issue arose — directory at edpb.europa.eu.
• UK: the Information Commissioner's Office, ico.org.uk.
• California: the California Privacy Protection Agency, or the Attorney General's office.

You never need to go through us first, and complaining costs you nothing.