Legal

Privacy Policy

Last updated: [DATE]

1. Who controls your data

[LEGAL ENTITY NAME] of [REGISTERED ADDRESS], [JURISDICTION], is the data controller for personal data collected through Verity. Contact: akytrades@gmail.com. [If you appoint a Data Protection Officer or EU/UK representative, name them here.]

2. What we collect

• Account data — email address and password (stored hashed, never in plain text), account creation date
• Mentor listing data — everything submitted in Creator Studio: name, handle, contact email, biography, markets and strategies, pricing, clip links, and any images uploaded as payout or broker-statement evidence
• Verification data — identity documents and supporting evidence submitted for verification, plus our internal review notes
• Purchase data — what you bought, when, and the amount
• Review content — reviews you write, shown publicly with your chosen display name
• Support messages — anything you send us, including chat messages if AI support is enabled
• Technical data — IP address, browser type, and basic usage information collected by our hosting and infrastructure providers

We store some information in your browser's local storage (for example your wishlist and comparison selections). This stays on your device and is not sent to us.

3. Why we use it, and our lawful basis

• To run your account and deliver purchases — performance of a contract
• To verify Mentors and police unrealistic claims — legitimate interests in marketplace trust and consumer protection; where identity documents are involved, your explicit consent at submission
• To show public listings and reviews — performance of a contract and legitimate interests
• To handle support requests — legitimate interests
• To meet legal, tax, and accounting obligations — legal obligation

We do not sell your personal data, and we do not use it for advertising profiling.

4. Who we share it with

• Supabase — database, authentication, and file storage [confirm your project region]
• [Payment processor, e.g. Stripe] — payment processing; they handle card details directly and we never receive or store full card numbers
• [Hosting provider] — serving the website
• Anthropic — only if AI support chat is enabled, and only the messages you send to it
• Mentors — a Mentor can see that you purchased their product and any review you publish, but not your other activity on Verity
• Authorities — where legally required

5. International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. [Confirm the mechanism with each provider and your lawyer.]

6. How long we keep it

• Account and listing data — while your account is active, then [X] days after closure
• Identity/verification documents — [recommend deleting promptly after the check is complete; confirm the minimum you can justify]
• Purchase and payment records — as required by tax law, typically [6–7] years
• Published reviews — retained while the listing exists, and may be anonymised rather than deleted

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your data, to receive a portable copy, and to withdraw consent. Residents of the EU and UK may also complain to their local data protection authority; California residents have rights under the CCPA including the right to know and delete.

To exercise any of these, email akytrades@gmail.com. We aim to respond within one month.

8. Security

Data is stored with access controls that restrict each account to its own records, passwords are hashed by our authentication provider, and traffic is encrypted in transit. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as required by law.

9. Children

Verity is not intended for anyone under 18 and we do not knowingly collect their data.

10. Changes

We'll post updates here and, for material changes, notify you by email or on the site.

[TODO before launch: fill in every bracketed item, confirm your Supabase project region, decide your identity-document retention period (keep it short), add a cookie notice if you introduce analytics, and have this reviewed by a lawyer.]