Privacy Policy
Effective October 8, 2026
1. Scope
This Privacy Policy explains how Biscayne Funding LLC (operator of AlphaLab) collects, uses, shares, and protects personal information when you use the Service. It does not cover third-party websites linked from the Service.
2. Information We Collect
Account information: name, email address, and authentication details (including if you sign in with a third-party provider such as Google). Content: strategies, simulated trades, positions, watchlists, lesson progress and quiz scores, and files you upload for ticker import. Usage data: pages viewed, features used, device and browser type, IP address, approximate location, and timestamps. Payment information: if you buy a paid plan, our payment processor collects your card details directly; we receive only limited details such as your name, billing country, card type, last four digits, and payment status. Communications: messages you send us, such as support requests and feedback. We do not collect bank account or brokerage information, and we do not collect Social Security numbers or other government ID numbers.
3. How We Use Information
To provide, operate, and secure the Service; authenticate you; save your simulated portfolios; fetch market data, news, and filings relevant to your holdings; process uploaded files to extract tickers; process payments and manage subscriptions; track your curriculum progress and quiz scores; analyze and improve the Service; communicate with you about your account and changes to our policies; and comply with legal obligations.
4. AI and Third-Party Processing
Ticker symbols, headlines, uploaded files, and AI Assistant messages may be sent to third-party AI and data providers to generate the features you request (for example sentiment analysis, calendars, ticker extraction, and assistant answers). These providers act as processors on our behalf. The Service is built and hosted on a third-party app platform, which also routes requests to AI model providers. A list of our main service providers is available on request.
4A. Use of Your Data to Train AI (On by Default Outside the EEA, UK, and Switzerland)
UNLESS YOU OPT OUT, YOUR CONTENT (SUCH AS STRATEGIES, SIMULATED TRADES, AND AI ASSISTANT CONVERSATIONS) MAY BE USED TO IMPROVE AND TRAIN AI MODELS USED IN THE SERVICE. This setting is on by default, except for users in the European Economic Area, the United Kingdom, and Switzerland. For those users, it is off unless they turn it on, and we use their content for training only with their consent. You can change it at any time, free of charge and without losing any features, using the "Use my data to train AI" switch in the sidebar or on the AI Assistant page. Your choice is saved to your account and applies going forward; data already used before you opted out may not be removable from previously trained models.
4B. Who Can See Your Data
Your data is walled off from other users: no other user of the Service can see your strategies, trades, positions, watchlists, alerts, notifications, or conversations. Your data is not hidden from us, the app developer and operator. We and our hosting provider can technically access stored data, and we access it only as needed to operate, secure, support, and maintain the Service, to act on your choices (such as the AI training setting), and to comply with law. We do not share it with other users or sell it.
5. How We Share Information
We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only with service providers who host, operate, and support the Service, including payment processors; with professional advisers; when required by law, subpoena, or to protect rights and safety; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.
6. Data Retention
We keep personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You can delete your strategies and watchlist items at any time, and you can delete your account at any time in account settings. When you delete your account, we delete or de-identify your personal information within [30] days. Backup copies are deleted within [90] days. We keep information longer only where we must for legal, tax, billing, or security reasons; for example, billing records are kept for up to [7] years. Data already used to train AI models may not be removable from those models.
7. Security
We use reasonable administrative, technical, and physical safeguards, including encrypted transport and private storage of uploaded files. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected users and regulators of security breaches as required by applicable law, including the laws of Florida, New York, and other U.S. states.
8. Your Rights
Depending on where you live (including California under the CCPA/CPRA and other U.S. state privacy laws, or the EEA/UK under the GDPR), you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, and to not be discriminated against for exercising these rights. To make a request, email veritas73@gmail.com. We will verify your identity before responding.
8A. GDPR and UK GDPR: Controller and Legal Bases
For users in the EEA, the UK, and Switzerland, Biscayne Funding LLC is the data controller of your personal data. We rely on the following legal bases: (a) performance of a contract, to create your account, provide the Service, and process payments for paid plans; (b) legitimate interests, to secure, maintain, analyze, and improve the Service and prevent abuse, balanced against your rights; (c) consent, where we ask for it, including the use of your content to train AI models and any non-essential cookies, which you may withdraw at any time without affecting prior processing; and (d) legal obligation, where processing is required by law, such as keeping tax and billing records. Providing account information is necessary to use the Service; other information is optional.
8B. Your GDPR Rights
Subject to applicable conditions and exceptions, you have the right to: access your personal data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability, receiving your data in a structured, machine-readable format; object to processing based on legitimate interests, including profiling; withdraw consent at any time; and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not make such decisions). You can delete your account and associated data directly within the Service, or email veritas73@gmail.com. We respond within one month, extendable by two further months for complex requests as permitted by law. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).
8C. EU and UK Representative
Where required by Article 27 of the GDPR or the UK GDPR, we will appoint a representative in the EU and/or UK and publish their contact details in this Policy. Until then, please direct all privacy inquiries to veritas73@gmail.com.
8D. Other International Privacy Laws
We also aim to honor rights granted under other comparable laws, including Canada's PIPEDA and Quebec's Law 25, Brazil's LGPD, Switzerland's revised FADP, Australia's Privacy Act, Japan's APPI, South Korea's PIPA, Singapore's PDPA, South Africa's POPIA, and India's Digital Personal Data Protection Act. Depending on your jurisdiction, these may include rights to access, correct, delete, or port your data, to withdraw consent, and to complain to your local regulator. Submit requests to veritas73@gmail.com. For users in Québec, the person in charge of the protection of personal information is [name, title], who can be reached at [email].
8E. U.S. State Privacy Rights
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws may request access to, correction of, deletion of, or a copy of their personal information, and may opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not sell or share personal information for cross-context behavioral advertising, and we honor Global Privacy Control signals as opt-out requests where required. You may appeal a denied request by replying to our decision; if your appeal is denied, you may contact your state attorney general. You may use an authorized agent, subject to verification. In the past 12 months, we collected these categories of personal information: identifiers (such as name, email, and IP address); commercial information (such as plans purchased); internet and device activity; approximate location; and content you provide. We collect them from you, your device, and sign-in providers, for the purposes in Section 3, and disclose them only to the recipients in Section 5. We do not collect sensitive personal information as defined by these laws, and we do not knowingly sell or share the personal information of anyone under 16.
9. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
10. Children and Age Gating
The Service is not directed to or intended for individuals under 18, and we do not knowingly collect personal information from anyone under 18. By creating an account, you confirm that you are at least 18 years old (or the age of majority where you live, if higher). We use an age confirmation step at registration and on first use to reinforce this requirement. If we learn that someone under 18 has registered or provided us information, we will delete that information and terminate the account. If you believe a minor has provided us information, contact us at veritas73@gmail.com and we will delete it.
11. International Transfers
Your information may be processed in the United States and other countries whose data protection laws may differ from those where you live. For transfers of personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), the EU-U.S. Data Privacy Framework where our providers are certified, or other lawful mechanisms. You may request a copy of the relevant safeguards by contacting us.
11A. Data Breach Notification
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the GDPR requires, and notify affected users without undue delay as required by applicable law.
12. Changes
We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you through the Service.
13. Contact
Questions or requests regarding privacy may be sent to: Biscayne Funding LLC, 777 NW 2nd Avenue, Unit 1013, Miami, Florida 33132. Email: veritas73@gmail.com.