Privacy Policy

1. Scope & Acceptance

This Privacy Policy describes how WheelPro Analytics LLC ("WheelPro", "we", "us", "our") collects, uses, shares, and protects information about you when you access or use the WheelPro web application at wheelpro.io and any related products or services (collectively, the "Service").

This Policy describes our data practices and accompanies the WheelPro Terms of Service. By using the Service, you acknowledge you have read and understand this Policy.

2. Definitions

• "Personal Information" (or "Personal Data") means any information that identifies, relates to, or could reasonably be linked to an identified or identifiable natural person.
• "Process" (or "Processing") means any operation performed on Personal Information, such as collection, storage, use, disclosure, or deletion.
• "Service Provider" (or "Sub-Processor") means a third party we engage to process Personal Information on our behalf under contract.
• "You" means the natural person about whom we hold Personal Information, including registered Subscribers and prospective customers.

3. Information We Collect

3.1 Information You Provide

• Account registration: name, email address, password (hashed by our authentication provider, never stored in plaintext), and optionally a display name.
• Billing & subscription: handled directly by Stripe. We receive a tokenized customer reference, subscription status, plan tier, last-four card digits, and billing zip; we do not store full card numbers, CVV, or full bank-account numbers.
• User content: watchlist symbols, portfolio positions you enter, trade-journal entries, custom alert preferences, and gate-threshold settings.
• AI interactions: the questions and messages you submit to Axle and other AI features, together with the AI-generated responses and related technical metadata (timestamps, feature used, token counts, and usage-meter state). Do not include sensitive personal information in AI questions.
• Brokerage connections (optional): if you connect a brokerage account, we receive the authorization tokens the broker issues and the account information the connection permits — for read-only connections, balances and positions. For OAuth-based connections (such as Robinhood), we never receive or store your brokerage username or password. Where a broker's connection method requires session credentials (such as Tastytrade), those credentials are encrypted at rest with AES-256-GCM and deleted when you disconnect the broker or delete your account. We never have the ability to move funds.
• Support & communications: emails or other messages you send us, including their contents.

3.2 Information Collected Automatically

• Device & connection: IP address, browser type and version, operating system, device type, screen resolution, language preference.
• Usage: pages visited, features used, buttons clicked, session duration, referrer URL, error logs.
• Authentication: session cookies / tokens issued by our authentication provider.
• Performance & security: request timing, error traces, and signals used to detect abuse, fraud, or unauthorized access.

3.3 Information from Third Parties

• Stripe shares back to us a tokenized customer ID, subscription status, plan tier, and billing events (successful charge, failed charge, refund, subscription cancellation).
• Google Firebase Authentication shares your verified email address (and Google account name if you sign in with Google) when you authenticate.
• Public market data providers (Tradier, Polygon, Yahoo Finance) provide market data about securities; this is not Personal Information about you.
• Brokerages you connect (currently Robinhood for read-only viewing, and Tradier or Tastytrade for portfolio sync) share the account data the connection permits, at your direction.

We do not buy data brokers' lists, scrape social media to enrich your profile, or otherwise collect Personal Information about you from sources outside the integrations listed above.

4. How We Use Information

We use Personal Information to:

• Provide the Service: authenticate you, render personalized dashboards, save your preferences, send transactional emails (account confirmation, password reset, payment receipts).
• Process payments: through Stripe, and to honor your subscription tier server-side.
• Communicate with you: respond to support inquiries; send service announcements (billing changes, security notices, terms updates); send opt-in marketing email or daily digests.
• Operate the AI features: transmit your question and relevant market context to our AI infrastructure providers to generate a response; log AI interactions to meter plan allowances, debug, grade output quality, and detect abuse. We do not permit our AI infrastructure providers to use your content to train their models.
• Operate brokerage connections: retrieve the balances and positions your connection permits, display them to you, and (for sync connections) reflect them in your portfolio tools.
• Personalize: remember your watchlist, portfolio, theme, and alert settings.
• Improve the Service: aggregate or de-identify usage to understand which features are valued, where users hit friction, and how to allocate engineering effort.
• Protect: detect, investigate, and prevent unauthorized access, fraud, abuse, and violations of our Terms of Service.
• Comply: meet legal, regulatory, accounting, audit, and tax obligations.

We do not use your Personal Information for automated decision-making with legal or similarly significant effects on you.

5. Legal Bases for Processing

We process Personal Information under one or more of the following legal bases:

• Performance of contract: processing necessary to provide the Service to you under our Terms.
• Legitimate interests: service improvement, security, fraud prevention, and aggregate analytics.
• Consent: for opt-in marketing email and any feature where we explicitly request consent.
• Legal obligation: tax, accounting, anti-fraud, and law-enforcement-response obligations.

6. How We Share Information

We share Personal Information only as described below:

• Service Providers / Sub-Processors (see Section 7) under written agreements that prohibit them from using your Personal Information for their own purposes;
• Legal compliance: when required by subpoena, court order, regulatory request, or other legal process; to protect our rights, property, or safety, or those of users or the public;
• Business transfer: in connection with a merger, acquisition, financing, or sale of all or substantially all of our assets, with reasonable notice and continued protection of your data;
• With your consent: in any other case where you direct us to share.

We do not share Personal Information with advertising networks, data brokers, or any third party for cross-context behavioral advertising or similar purposes.

7. Service Providers / Sub-Processors

The following third parties process Personal Information on our behalf as of the Last Updated date:

We may add, remove, or change Sub-Processors. The list at the URL above will be kept current.

8. We Do Not Sell Your Data

9. Data Retention

We retain Personal Information only as long as needed for the purpose for which it was collected, or as required by law:

• Active accounts: retained for as long as your account is open and active.
• After account closure: we delete or de-identify Personal Information within thirty (30) days, except as needed for legal, tax, accounting, audit, fraud-prevention, or dispute-resolution purposes.
• Billing records: retained for at least seven (7) years for tax compliance.
• Legal holds: data subject to a legal hold is preserved until the hold is released.
• AI interaction logs: retained on a two-stage schedule. The content of an AI interaction (your question and the response summary) is redacted no later than ninety (90) days after the interaction. The remaining non-content record (plan tier, model, token counts, cost, the ticker symbol queried, and abuse-prevention metadata) is deleted no later than four hundred (400) days after the interaction. Deleting your account deletes your account-linked AI interaction records — content and non-content alike — immediately, ahead of this schedule, subject to the legal-hold exception above and the backup-rotation window below.
• Screening-outcome records: the Service maintains a published track record of its own screening output and outcomes (see Terms §3). Where such a record carries a link to your account, account deletion de-identifies it — the account link is severed permanently — rather than deleting the market outcome itself, so that departures do not selectively remove results from the published record. Once de-identified, we maintain and use the record only in de-identified form, we commit not to attempt to re-identify it, and we require the same of any recipient.
• Brokerage tokens: deleted promptly when you disconnect a brokerage connection or close your account.
• Backups: backups may persist Personal Information for up to ninety (90) days after deletion before being overwritten in normal rotation.

10. Your Privacy Rights

Regardless of where you reside, WheelPro grants the following rights to all users of the Service:

• Right to know / access: request confirmation that we process your Personal Information and a copy of what we hold.
• Right to correct: request correction of inaccurate Personal Information.
• Right to delete: delete your account and its Personal Information yourself, at any time, directly in the app via Settings → Delete My Account (available on every plan, including trial and expired accounts) — deletion cancels any active subscription first, then removes your data as described in Section 9. You may also request deletion by email. Deletion is subject to the retention exceptions in Section 9.
• Right to portability: request a copy of your Personal Information in a structured, commonly used, machine-readable format.
• Right to opt out of marketing: unsubscribe from marketing emails or daily digests at any time using the link in any marketing email or by emailing us.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to non-discrimination: we will not deny you the Service, charge a different price, or provide a different quality of service because you exercised a privacy right.

10.1 How to Exercise

To exercise any of these rights, email support@wheelpro.io from the email address associated with your account, or contact us at the address in Section 18. We will respond within forty-five (45) days. We may need to verify your identity before completing your request; we may extend the response window by an additional 45 days for complex or numerous requests, with notice to you.

10.2 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written, signed authorization, and we may verify your identity directly.

10.3 Appeals

If we deny your request, you may appeal by replying to our denial email within sixty (60) days. We will respond to appeals within forty-five (45) days.

11. State-Specific Notices

Residents of certain U.S. states have additional rights under applicable state privacy laws. Because Section 10 grants those rights to all users, the substantive protections are the same regardless of residence. The following supplements explain how we comply with specific state laws.

11.1 California (CCPA / CPRA)

Categories of Personal Information collected in the past twelve (12) months: identifiers (email, IP), commercial information (subscription tier), internet activity (page-view logs), authentication credentials, user-provided content (including AI interaction content and, where you connect a brokerage, account balances and positions), and inferences derived from usage. We collect this information directly from you or automatically from your interaction with the Service. Purposes are described in Section 4. Recipients are described in Sections 6 and 7. We do not sell or share Personal Information for cross-context behavioral advertising. California residents have the right to know, delete, correct, port, opt-out (not applicable here, as we do not sell or share), and to limit use of sensitive Personal Information (we do not use sensitive Personal Information for any non-essential purpose).

11.2 Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Florida (FDBR), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA)

Residents of these states have rights to access, correct, delete, port, and opt-out of targeted advertising / sale / profiling that produces legal effects. As stated in Section 8, we do not engage in any of these activities. To exercise rights, email support@wheelpro.io from your account email. Appeals follow the process in Section 10.3.

11.3 Sensitive Data

We do not knowingly collect categories of "sensitive" Personal Information defined under state privacy laws (such as government identifiers, precise geolocation, biometric data, health, racial or ethnic origin, religion, sexual orientation, or union membership) for any purpose other than as strictly necessary to provide the Service or as permitted by law without consent.

12. Children's Privacy

The Service is not directed to children under eighteen (18) years of age, and we do not knowingly collect Personal Information from anyone under 18. If you believe a child under 18 has provided Personal Information, contact support@wheelpro.io and we will delete it promptly. The Service is not directed to children under 13, and we do not knowingly collect Personal Information from children under 13; if we learn that we have, we will delete it promptly. Independent of the Children's Online Privacy Protection Act ("COPPA"), no one under 18 is permitted to register.

13. Security

We protect Personal Information using industry-standard administrative, technical, and physical safeguards, including:

• TLS encryption in transit for all Service traffic (HTTPS only);
• Encryption at rest for stored credentials and tokenized payment references via our hosting and authentication providers, and application-level encryption for brokerage connection tokens;
• Server-side authentication via Firebase ID tokens (when enabled), with role-based access controls in Firestore Security Rules;
• Sensitive secrets (Firebase service-account keys, Stripe secret keys) stored in environment variables of the production hosting platform, never in source control;
• Principle of least privilege for staff access and Sub-Processor permissions;
• Logging and monitoring for unauthorized-access detection.

No system is perfectly secure. If we become aware of a security incident affecting your Personal Information, we will notify you and applicable regulators in accordance with applicable law.

14. International Data Transfers

The Service is hosted and operated primarily in the United States. If you access the Service from outside the United States, your Personal Information will be transferred to, processed, and stored in the United States. The Service is offered exclusively to U.S. residents (see Terms §7); we do not target or solicit users outside the U.S. By using the Service, you consent to this transfer.

15. Cookies & Tracking

The Service uses a small number of strictly necessary cookies and similar technologies:

• Authentication cookies / tokens: set by Google Firebase to maintain your signed-in session.
• Preference state: stored in localStorage for things like your selected theme, preferred broker for "Open in Broker" links, and remembered watchlist filters.
• Trial/paywall state: session data necessary to enforce trial expiration.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking. You can clear cookies and localStorage via your browser settings; doing so may sign you out and reset preferences.

16. Do Not Track & Global Privacy Control

Many browsers offer a "Do Not Track" ("DNT") signal or send a Global Privacy Control ("GPC") header. Because we do not engage in cross-context behavioral advertising or sell Personal Information, our processing is unaffected by DNT or GPC signals. We honor verified opt-out requests communicated through user-enabled privacy controls where applicable law requires.

17. Changes to This Policy

We may update this Policy from time to time. The Effective Date at the top of this page reflects the latest revision. If we make material changes that reduce your rights or expand our use of your Personal Information, we will:

• Post the updated Policy at wheelpro.io/privacy.html with a new Effective Date;
• Send an email notification to the address associated with your account at least thirty (30) days before the change takes effect.

Your continued use of the Service after the Effective Date constitutes acceptance of the updated Policy. If you do not agree, your sole remedy is to terminate your account.

18. Contact

For privacy-related questions, requests, or appeals:

WheelPro Analytics LLC
Attn: Privacy
Email: support@wheelpro.io
Web: https://wheelpro.io
Mailing address (legal notices): see WheelPro Terms of Service §19