TradeRunner Privacy Policy
Contents
- Who We Are
- Scope
- Personal Information We Collect
- How We Use Personal Information
- Legal Bases (EU/UK)
- How We Share Personal Information
- International Data Transfers
- Data Retention
- Cookies and Tracking
- Security
- Your Privacy Rights
- Children
- California-Specific Notice
- Other State Privacy Laws
- Notice for Brokerage-Connected Users
- Do Not Track
- Changes to This Policy
- Contact
1. Who We Are
NURO.is, a Florida limited liability company doing business as TradeRunner (“TradeRunner,” “we,” “us,” or “our”), operates the platform available at traderunner.ai (production) and related domains, including traderunner.vercel.app (staging and preview deployments). In this policy “you” means any user, prospective user, or visitor.
TradeRunner.ai, c/o NURO.is
Attn: Privacy
8595 College Pkwy STE 350
Fort Myers, FL 33919
Email: [email protected]
2. Scope
This Privacy Policy covers the TradeRunner website and subdomains, the authenticated application, marketing and product emails, customer support, and any other interaction in which TradeRunner collects personal information from you.
It does NOT cover the privacy practices of your brokerage, third-party sites we link to, or information you publicly post about TradeRunner.
3. Personal Information We Collect
3.1 Information you give us
- Account information. Name, email address, password (stored as a hash), optional profile information.
- Subscription and billing. Plan, billing address, country, and the last four digits and card brand of your payment card. Full card numbers are handled by Stripe and never stored on our servers.
- Strategy and trading data. Parameters, watchlists, backtest inputs and outputs, paper-trading sessions, Trade Credit balance, live-trading session history once a brokerage is connected.
- Brokerage connection data. API keys, OAuth tokens, or other credentials. Stored encrypted at rest.
- Support and communications. Messages, tickets, emails.
- User-generated content. Custom templates, notes, labels.
3.2 Information collected automatically
- Device and usage data. IP address, browser, OS, device, referrer, screen size, pages viewed, clicks, session timing, crash logs.
- Cookies and similar technologies. See Section 9.
3.3 Information we receive from third parties
- Brokerage data. Balances, positions, order status, fills, transaction history, only when you authorize the connection.
- Market-data feeds. Real-time and historical prices.
- Payment processor. Tokenized payment info and transaction status from Stripe.
4. How We Use Personal Information
- Operate the service. Authentication, feature delivery, backtests, paper trading, live trading you have authorized, history storage.
- Communicate. Transactional emails (trial expiring, payment failed, password reset, security alerts), product updates, marketing emails to opted-in users.
- Process billing. Subscription fees, taxes, refunds.
- Provide support. Tickets, troubleshooting, improving help content.
- Protect the service. Fraud, abuse, security incidents, market-manipulation patterns.
- Comply with law. Court orders, subpoenas, regulatory requests.
- Aggregate and analyze. Improve features and inform roadmap.
- Conduct business operations. Accounting, audit, M&A, ordinary corporate functions.
We do not sell your personal information. We do not use your personal information to train third-party AI models without your explicit, separate consent.
5. Legal Bases (EU/UK Users)
| Activity | Legal basis |
|---|---|
| Account creation, authentication, service delivery | Contract |
| Subscription billing | Contract |
| Security, fraud prevention, anti-abuse | Legitimate interest |
| Analytics and product improvement | Legitimate interest, balanced against your rights |
| Marketing to existing customers about similar services | Legitimate interest |
| Marketing to prospects | Consent |
| Non-essential cookies | Consent |
| Legal and regulatory compliance | Legal obligation |
6. How We Share Personal Information
- Service providers under written agreements restricting their use of the data. Categories: hosting and infrastructure, database and storage, email delivery, payment processing (Stripe), error tracking, product analytics, customer support, market data.
- Your connected brokerage, only the order instructions, account-status queries, and credential validation you authorize.
- Government, regulators, courts, or law enforcement when legally required.
- A successor entity in a merger, acquisition, financing, reorganization, or sale of assets.
- With your express consent for any other purpose disclosed at the time of consent.
We never sell personal information to data brokers, advertisers, or any third party.
7. International Data Transfers
TradeRunner is operated from the United States. If you access from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where we or our service providers operate. For EEA, UK, or Swiss transfers, we use Standard Contractual Clauses and other safeguards as required.
8. Data Retention
| Data category | Retention |
|---|---|
| Active account data | For the life of the account |
| Paused or canceled account data | 90 days after pause or cancel, then archive or delete |
| Billing and tax records | 7 years from the transaction date |
| Support tickets | 3 years from ticket close |
| Trade and order logs (live brokerage) | 7 years from the trade date |
| Trade and order logs (paper / Trade Credit) | 90 days after account cancel |
| Marketing email opt-outs | Indefinitely, as a suppression list |
| Cookie data | Up to 13 months unless required to operate the service |
| Security logs and breach records | 3 years |
8.1 Deletion requests
You can delete your account at any time from the settings page. You can also email [email protected] and request deletion of personal information we hold about you.
When you delete your account, or when we receive a verified deletion request, we will:
- Remove your personal information from active production systems within 30 days.
- Purge your personal information from rolling encrypted backups within 90 days, as backups are overwritten on the standard rotation.
- Retain only the minimum information required to (a) meet tax, audit, and accounting obligations (7 years for billing records), (b) comply with a documented legal hold or active regulatory inquiry, (c) maintain marketing-suppression lists so we do not email you again, and (d) preserve aggregated, de-identified data that no longer references you.
Where retention beyond 30 days is legally required, the data is segregated and used only for the specific compliance purpose stated above. We will confirm in writing when your deletion request has been processed.
9. Cookies and Tracking Technologies
We use cookies and local storage for essential operation (authentication, theme preference, fraud detection) and limited analytics. We do not use advertising or behavioral-targeting cookies on the authenticated application. You can manage cookies through your browser. Blocking essential cookies will prevent the service from functioning.
EU/UK and California visitors will receive a consent banner on first visit.
10. Security
Encryption in transit. All connections between your browser, the TradeRunner application, our APIs, and our subprocessors use TLS 1.2 or higher with modern cipher suites. Public HTTP requests are redirected to HTTPS and enforced with HSTS.
Encryption at rest. Account credentials, brokerage API keys, OAuth tokens, password hashes, and other sensitive fields are encrypted at rest using AES-256. Brokerage credentials receive additional field-level encryption so they remain encrypted even within our database, with decryption keys held in a managed key-management service (KMS) accessible only to the production trading workers that need them.
Passwords. Passwords are never stored in plain text. We store only a salted hash using a memory-hard algorithm in the bcrypt or Argon2 family, and we never log or transmit your raw password after the moment you set it.
Payment data. Full payment card numbers are never received or stored by TradeRunner. Card data is collected directly by our PCI-DSS-compliant payment processor (Stripe, Inc.) and tokenized. We only see the last four digits and the card brand.
Operational controls. In addition to encryption, we apply:
- Role-based access controls and audit logging on all production data.
- Periodic vulnerability review and dependency scanning.
- Two-factor authentication for internal administrative tools.
- Network segmentation and least-privilege principles for production infrastructure.
- Encrypted, access-controlled rolling backups.
No security control is perfect. You are responsible for safeguarding your password and brokerage API keys. If we suffer a breach affecting your personal information, we will notify you and applicable regulators consistent with applicable law.
11. Your Privacy Rights
Depending on where you live, you may have rights to:
- Access personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete your account and associated personal data, subject to legal retention.
- Restrict or object to certain processing.
- Portability: receive a copy in a structured, machine-readable format.
- Opt out of marketing communications.
- California residents: opt out of any “sale” or “sharing” (we do not sell or share); request that we limit use of sensitive personal information; designate an authorized agent.
- Lodge a complaint with your local data protection authority.
Email [email protected] to exercise these rights. We will verify your identity before responding.
We will not discriminate against you for exercising your privacy rights.
12. Children
TradeRunner is not directed to children under 18 and we do not knowingly collect personal information from anyone under 18.
13. California-Specific Notice (CCPA / CPRA)
Categories of personal information collected in the past 12 months: identifiers, customer records, commercial information, internet or network activity, geolocation (general), inferences, and limited financial information from brokerage connections.
Sensitive personal information collected: account credentials (password hash, brokerage API keys). Used only to operate the service, not for inferences.
Sources: directly from you, automatically from your device, from your connected brokerage with authorization, from our service providers.
Business purposes: as described in Section 4.
Categories of third parties to whom we disclose: service providers (Section 6), your connected brokerage, government and regulators when legally required, successor entities in M&A.
Sale or sharing: we do not sell or share personal information as those terms are defined under CPRA.
Contact [email protected] or use the Do Not Sell or Share My Personal Information link to submit a request.
14. Other State Privacy Laws
Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have rights similar to those described in Sections 11 and 13. Contact [email protected].
15. Notice for Brokerage-Connected Users
Because TradeRunner connects to your brokerage account at your direction, also review your broker's privacy policy. Your broker is the data controller for information about your trades on its system. TradeRunner is a separate data controller for information you provide to us and for the brokerage-account information you authorize us to retrieve.
We do not use brokerage-account data to provide personalized investment advice. Brokerage data is used only to execute parameters you configured and to display your trading history in your TradeRunner dashboard.
16. Do Not Track
Some browsers send a “Do Not Track” signal. There is no industry standard for how to respond and we do not currently respond to DNT. We honor Global Privacy Control signals where required by applicable law.
17. Changes to This Privacy Policy
We may update this policy. Material changes will be announced by email and in-app notice at least 14 days before they take effect, with the “Last updated” date updated.
18. Contact
Privacy questions, rights requests, and security incidents: [email protected]
TradeRunner.ai, c/o NURO.is
Attn: Privacy
8595 College Pkwy STE 350
Fort Myers, FL 33919