Privacy Policy

Stax Labs collects various types of information in connection with the Service, including information you provide directly, information generated through your use of the Service, and information from other sources.

1.1 Information You Provide

• Account registration information (name, email, profile data)
• Authentication credentials and identifiers
• Communications you send to Stax Labs
• Survey responses and feedback
• Any other information you choose to provide

1.2 Information Generated Through Use

• Strategies, parameters, configurations, and settings
• Backtest results, simulations, and outputs
• Queries, inputs, and interactions with the Service
• Usage data, behavioral patterns, and engagement metrics
• Performance data and analytical outputs
• Preferences, customizations, and user-generated content

1.3 Automatically Collected Information

• Device identifiers, browser type, and operating system
• IP address and approximate geographic location
• Log data, access times, and referring URLs
• Cookies, pixels, and similar tracking technologies
• Mobile device information and app usage data

1.4 Information From Other Sources

Stax Labs may receive information about you from third-party sources, including authentication providers, analytics services, marketing partners, data brokers, publicly available sources, and other users of the Service. Stax Labs may combine this information with other information collected about you.

Stax Labs reserves the right to collect additional categories of information as needed to operate and improve the Service.

Stax Labs uses the information collected for various purposes, including but not limited to:

• Service Operations — providing, maintaining, operating, and improving the Service and business operations
• AI & Technology Development — training, developing, and improving machine learning models, algorithms, artificial intelligence systems, and related technologies
• Analytics & Insights — creating aggregated, de-identified, or anonymized data for analytics, benchmarking, research, and commercial purposes
• Communications — sending service notifications, updates, marketing communications, and promotional materials
• Security & Compliance — protecting the Service, detecting fraud, enforcing the Terms of Service, and complying with legal obligations
• Advertising — delivering, measuring, and improving the effectiveness of advertising and marketing efforts

Stax Labs may use your information for any other purpose disclosed at the time of collection or with your consent. Stax Labs reserves the right to use information for any lawful purpose consistent with this Privacy Policy.

Stax Labs may share your information in the following circumstances:

• Service Providers — with vendors, consultants, and service providers who perform services on behalf of Stax Labs, including hosting, analytics, payment processing, customer support, and marketing.
• Affiliates & Partners — with affiliates, subsidiaries, parent companies, and business partners for purposes consistent with this Privacy Policy.
• Business Transactions — in connection with any merger, acquisition, financing, sale of assets, bankruptcy, or other transaction involving all or a portion of the business, your information may be transferred to the acquiring entity.
• Legal & Safety — when Stax Labs believes disclosure is necessary to comply with law, protect rights, property, or safety, or respond to government requests, legal process, or law enforcement.
• Aggregated & De-Identified Data — Stax Labs may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you, without restriction, for any purpose.
• With Consent — Stax Labs may share information with your consent or at your direction.

The Service integrates with or relies on various third-party services to operate. The following is a list of key third-party services that may process or interact with user data:

• Supabase — database, user authentication, OAuth (Google, GitHub sign-in), and data storage
• Stripe — payment processing and subscription billing (Stax Pro membership)
• Cloudflare — website hosting (Pages), content delivery (R2 CDN), and API proxying (Workers)
• OpenRouter — AI language model API powering the Buddi chat assistant (processes user queries)
• Mistral AI — AI-powered sentiment analysis and trade analysis
• Resend — transactional email delivery (waitlist invites, account notifications)
• Financial Modeling Prep (FMP) — market data, fundamental metrics, and analyst ratings (no user PII)
• Google / GitHub — OAuth authentication providers (via Supabase Auth)
• Analytics and error monitoring services — for usage analytics, event tracking, and service reliability

This list may be updated from time to time. Each third-party service operates under its own privacy policy. Stax Labs encourages users to review the privacy policies of these services. Stax Labs is not responsible for the privacy practices of third parties. Your use of third-party services is at your own risk.

Stax Labs uses cookies, local storage, and similar technologies to collect information, personalize your experience, and analyze usage. By using the Service, you consent to the use of these technologies.

The following technologies are used by the Service:

• Supabase auth cookies (sb-* prefixed cookies) — session management, JWT authentication tokens, and refresh tokens
• Stripe cookies — payment session cookies set during checkout flows
• IndexedDB — browser-side persistent storage used for caching market data, strategy data, and price history (~50MB limit) to improve performance
• localStorage — user preferences, onboarding state, theme settings, and UI state
• OPFS (Origin Private File System) — used for caching Parquet data files for the backtesting engine
• Analytics cookies — usage analytics and event tracking cookies when analytics services are enabled
• Essential cookies — session persistence, CSRF protection, and core authentication functionality

You may adjust your browser settings to refuse cookies, but this may limit your ability to use certain features of the Service. By continuing to use the Service, you consent to the use of tracking technologies.

Stax Labs implements reasonable administrative, technical, and physical safeguards designed to protect information. However, no method of transmission or storage is completely secure.

STAX LABS CANNOT AND DOES NOT GUARANTEE THE SECURITY OF YOUR INFORMATION. You acknowledge that you provide information at your own risk. Stax Labs is not responsible for circumvention of any privacy settings or security measures contained on the Service, or for any unauthorized access to your information.

You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account.

Stax Labs retains information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Stax Labs may retain certain information indefinitely for legitimate business purposes, including analytics, research, archival, backup, legal compliance, and fraud prevention. Aggregated, anonymized, or de-identified data may be retained indefinitely without restriction.

Even after account deletion, Stax Labs may retain information as required by law, for legitimate business purposes, or where deletion is not technically feasible. Retention of information pursuant to licenses granted in the Terms of Service survives account termination.

Depending on your location and applicable law, you may have certain rights regarding your information. These rights may be subject to limitations and exceptions. Available rights may include:

• Access — request information about the personal data Stax Labs holds about you
• Correction — request correction of inaccurate or incomplete personal data
• Deletion — request deletion of certain personal data, subject to retention rights and legal obligations
• Data Portability — request a copy of your personal data in a structured, commonly used format
• Marketing Opt-Out — unsubscribe from marketing communications (Stax Labs may still send transactional and service-related messages)
• Cookie Preferences — adjust browser settings to refuse or manage cookies and similar technologies
• Do Not Track — Stax Labs notes that there is currently no uniform standard for responding to Do Not Track signals
• Account Deactivation — deactivate or request deletion of your account through the Service or by contacting Stax Labs
• Restrict Processing — request restriction of processing of your personal data in certain circumstances
• Withdraw Consent — withdraw consent for processing where consent is the legal basis, without affecting the lawfulness of prior processing

Limitations on Rights

Your rights are subject to applicable law and may not apply in all circumstances. Stax Labs may decline requests that are unreasonable, repetitive, require disproportionate technical effort, jeopardize the privacy of others, are impractical, or for which access is not required by law. Stax Labs may charge a reasonable fee for manifestly unfounded or excessive requests. Stax Labs reserves the right to verify your identity before processing requests.

Important: Exercising your rights does not affect licenses previously granted to Stax Labs. Aggregated, de-identified, or anonymized data derived from your information is not subject to deletion requests.

To submit a request, email [email protected]

Stax Labs is based in the United States. Your information may be transferred to, stored, and processed in the United States or any other country where Stax Labs or its service providers operate. These countries may have data protection laws that differ from your jurisdiction.

By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this Privacy Policy. Stax Labs will take reasonable steps to ensure your information is treated securely and in accordance with this Privacy Policy.

Home Base Transfer Notice: If Stax Labs relocates its primary operations to a different jurisdiction, users will be notified and this Privacy Policy will be updated to reflect the new jurisdiction and any applicable changes to data handling practices.

The Service is intended for users who are 18 years of age or older. Users between the ages of 13 and 17 may use the Service only with verifiable parental or guardian consent. Stax Labs may require documentation of parental or guardian approval before granting or continuing access for users under 18.

Stax Labs does not knowingly collect personal information from children under 13 years of age. If Stax Labs learns that personal information has been collected from a child under 13 without verifiable parental consent, Stax Labs will take steps to delete such information.

If you believe that a child under 13 has provided personal information to Stax Labs, please contact Stax Labs at [email protected].

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and other California laws. Stax Labs collects the categories of personal information described in Section 1, which may include identifiers, commercial information, internet activity, geolocation data, and inferences drawn from this information. Stax Labs uses and discloses personal information for the business purposes described in Sections 2 and 3. Stax Labs may share certain information with third parties in ways that could be considered a "sale" or "sharing" under California law. You may have the right to opt out of such sharing.

Other U.S. State Regulations

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with consumer privacy laws may have additional rights, including the right to access, correct, delete, and opt out of the sale of personal data. Stax Labs encourages users in these states to review applicable state law and contact Stax Labs to exercise any available rights.

International Regulations

Users subject to the European Union General Data Protection Regulation (GDPR), the United Kingdom Data Protection Act (UK DPA), or other international data protection laws may have additional rights regarding the processing of their personal data. Stax Labs encourages all users to review the privacy laws applicable in their jurisdiction and to contact Stax Labs with any questions regarding the exercise of their rights.

To exercise your privacy rights under any applicable regulation, contact Stax Labs at [email protected]. Stax Labs will not discriminate against you for exercising your rights, though some features may require data processing to function.

Stax Labs may update this Privacy Policy from time to time in its sole discretion. When changes are made, the "Last updated" date at the top of this page will be updated.

For material changes, Stax Labs will make reasonable efforts to provide notice through a prominent in-app notice, email notification, or in-app notification at least 30 days before material changes take effect, where practicable.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy. Stax Labs encourages you to review this Privacy Policy periodically.

This Privacy Policy is provided for informational purposes and does not create any contractual or legal rights beyond what is required by applicable law. Stax Labs makes no representations or warranties regarding the completeness, accuracy, or adequacy of this Privacy Policy.

To the fullest extent permitted by law, Stax Labs disclaims all liability arising from or related to this Privacy Policy or its privacy practices. Liability for any privacy-related claims shall be limited as set forth in the Terms of Service.