Privacy policy

Vektor, Inc., a Delaware corporation ("Vektor," "we," "us," or "our"), operates the Vektor agentic trading platform at vektor.trade. This Privacy Policy explains what data we collect, how we use it, and the choices you have.

Account data: When you register, we collect your email address and a hashed password. We never store your password in plaintext.

Brokerage, digital asset, and identity data: Vektor provisions and operates brokerage and digital asset accounts on your behalf through Alpaca Securities LLC and, for cryptocurrency, Zero Hash LLC. To operate the trading pipeline, we access the positions, balances, and order history in those accounts. To open a live brokerage or digital asset account, you provide identity information required for regulatory identity verification, which may include your legal name, date of birth, residential address, and a government identifier such as a Social Security number or other tax identification number. We collect this information and transmit it to Alpaca and, where applicable, Zero Hash to open and maintain your account. Alpaca and Zero Hash govern the security of those accounts independently.

Platform activity: We store agent run history, approval decisions, risk profile settings, and pipeline output (reasoning chains, signals, confidence scores) associated with your account.

LLM training data (opt-in only): If you explicitly consent, we log the inputs and outputs of AI pipeline nodes to a private dataset used to fine-tune the Vektor LLM. This is strictly opt-in. Consent can be withdrawn at any time from Settings. We never share this data with third-party AI providers.

Payment data: Payments are processed by Stripe. Vektor does not store card numbers or bank account details. We receive and store non-sensitive billing metadata from Stripe (plan type, subscription status, renewal dates).

Usage and diagnostic data: We collect server logs, error reports, and aggregate usage metrics to operate and improve the service. These logs may include IP addresses, browser type, and request timestamps. Logs are retained for 90 days.

• To authenticate your account and maintain your session
• To operate the AI trading pipeline on your behalf
• To verify your identity and to open and maintain your brokerage and digital asset accounts with Alpaca and Zero Hash
• To store and display your run history, approvals, and portfolio snapshots
• To enforce your risk profile settings and credit quota
• To process subscription payments via Stripe
• To send transactional emails (trade executed, approval needed, billing alerts) via Resend
• To improve platform reliability through error monitoring and aggregate analytics
• To fine-tune the Vektor LLM, only if you have opted in

We do not use your data to train third-party AI models. When pipeline nodes call external LLM APIs (Anthropic, OpenAI, Google), only the specific prompt content is transmitted — never your email, account ID, or personally identifying information.

We do not sell your personal data. We share data only with:

• Alpaca Securities LLC — equities brokerage infrastructure; opens and maintains your brokerage account, executes trades, and receives the identity information required to do so
• Zero Hash LLC — digital asset infrastructure; opens and maintains your digital asset account, facilitates crypto transactions, and receives the identity information required to do so
• Stripe Inc. — to process subscription payments
• Resend Inc. — to deliver transactional email notifications
• Anthropic, OpenAI, Google — LLM API calls (prompt content only, no PII)
• Amazon Web Services — cloud infrastructure hosting your data in US regions
• Law enforcement or regulators — only when required by applicable law

Each third-party provider is subject to their own privacy policy and data processing terms.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, billing records required for tax purposes are retained for 7 years).

Agent run history and pipeline outputs are retained for 12 months and then automatically purged. LLM training logs (opt-in only) are retained for the duration of your consent and deleted within 30 days of withdrawal.

Vektor uses industry-standard security measures including TLS encryption in transit, bcrypt password hashing, JWT token blacklisting via Redis, and isolated database schemas per service. Sensitive configuration is stored in AWS Secrets Manager and never committed to source control.

No method of transmission over the internet is 100% secure. While we take reasonable precautions, we cannot guarantee the absolute security of your data.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent for LLM training data collection
• Export your run history and approval decisions in JSON format
• Lodge a complaint with a data protection authority

To exercise any of these rights, contact us at privacy@vektor.trade. We will respond within 30 days.

Vektor uses a single httpOnly session cookie to maintain your authentication state. This cookie is strictly necessary for the platform to function and is not used for tracking or advertising. We do not use third-party analytics cookies or advertising pixels.

Vektor is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us at privacy@vektor.trade and we will delete the account promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related questions or data requests, contact Vektor, Inc. at privacy@vektor.trade.