Privacy Policy

SOVEREIGN TRADING CAPITAL, INC.

Effective Date: May 10, 2026 Last Updated: May 10, 2026

This Privacy Policy describes how Sovereign Trading Capital, Inc. ("Sovereign," "we," "us," or "our") collects, uses, protects, and shares information about users of our website at sovereigntrading.ai and our algorithmic trading services.

1. INFORMATION WE COLLECT

Information you provide to us: - Name, email address, phone number - Date of birth, identity verification information - Mailing address (for tax reporting and compliance) - Payment information (processed and stored by Stripe, not Sovereign) - Brokerage authorization tokens (stored encrypted) - Communications with our support team - Information you provide when responding to surveys or feedback requests

Information collected automatically when you use our service: - Browser type, operating system, device identifiers - IP address and approximate geographic location - Login times, session duration, pages viewed - Device fingerprint for security purposes - Customer dashboard interactions - Email open and click data (for service-related emails)

Information from third parties: - Brokerage account balance, positions, and trade data via Tastytrade API (with your authorization) - Payment status, fraud signals, and dispute information from Stripe - Email delivery status from our email service provider - Identity verification results from third-party verification services

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Provide the algorithmic trading service you have requested
• Calculate and bill fees accurately based on your actual capital and selected strategies
• Authenticate and secure your account
• Communicate with you about your account, including service updates, security notices, and transactional emails
• Comply with legal and regulatory obligations including tax reporting, anti-money-laundering requirements, and securities regulations
• Detect and prevent fraud, unauthorized access, or abuse of our service
• Improve our service through aggregated and anonymized analysis
• Conduct internal audits and quality assurance

We do NOT use your information for:

• Targeted advertising on third-party platforms
• Selling to third-party data brokers
• Profiling for purposes unrelated to providing the service
• Training third-party artificial intelligence models

3. INFORMATION WE SHARE

We share information only with:

Service providers under strict data processing agreements:

• Stripe, Inc. — for payment processing
• Tastytrade — for brokerage operations (only data you originate or authorize)
• Resend — for transactional email delivery
• Render Services — for cloud hosting infrastructure
• Twilio — for SMS notifications (where enabled by you)

Each service provider is contractually limited to using your information solely to provide their service to Sovereign and is prohibited from using your data for other purposes.

Legal requirements:

• Court orders, subpoenas, or other lawful legal requests
• Regulatory examinations by the U.S. Securities and Exchange Commission, FINRA, the Internal Revenue Service, state securities regulators, and equivalent foreign authorities
• To protect our legal rights or the rights and safety of others
• In connection with a corporate transaction such as merger, acquisition, or sale of assets

We do NOT share your trading data, account balance, or financial information with third parties for marketing or advertising purposes.

4. HOW WE PROTECT YOUR INFORMATION

We implement industry-standard protections including:

• Brokerage OAuth tokens encrypted at rest using application-layer encryption
• Customer passwords stored as bcrypt hashes (cost factor 12)
• HTTPS/TLS encryption for all data transmission
• Two-factor authentication required for accounts with capital above $250,000
• Detailed audit logs of all administrative access to customer data
• Role-based access controls limiting which Sovereign personnel can view what data
• Regular security reviews and dependency audits
• Annual encryption key rotation
• Append-only audit logs that cannot be modified or deleted

While we implement these protections, no system is perfectly secure. In the event of a confirmed data breach affecting your information, we will notify you within seventy-two (72) hours and provide guidance on protective steps you can take.

5. YOUR RIGHTS

You have the right to:

• Access the information we hold about you
• Correct inaccurate information
• Request deletion of your information (subject to retention obligations under securities and tax law)
• Receive a copy of your data in machine-readable format
• Opt out of non-essential email communications
• Object to certain processing activities

To exercise these rights, contact privacy@sovereigntrading.ai. We will respond within thirty (30) days.

6. CALIFORNIA PRIVACY RIGHTS

California residents have additional rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"):

• Right to know what personal information we collect, the sources, the purposes, and the categories of recipients
• Right to delete personal information (subject to exceptions for legal compliance and ongoing service provision)
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights
• Right to designate an authorized agent to exercise these rights on your behalf

We do not knowingly sell or share the personal information of California residents. To exercise these rights or to ask questions, contact privacy@sovereigntrading.ai or call +1 (424) 777-4553.

7. DATA RETENTION

We retain your information for the periods required by securities regulations, tax law, and our operational needs:

• Account information: while your account is active and seven (7) years after closure
• Trading records: seven (7) years from each trade date
• Audit logs: seven (7) years
• Communication records: seven (7) years
• Tax-related records: seven (7) years per IRS requirements
• Anti-money-laundering records: five (5) years from account closure
• Marketing data (if any): retained until you opt out

After applicable retention periods expire, we delete or anonymize your information.

8. INTERNATIONAL USERS

Sovereign currently serves only United States residents. If you access our website from outside the United States, please be aware that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our service, you consent to such transfer and processing.

9. CHILDREN'S PRIVACY

Sovereign's services are not intended for individuals under 18. We do not knowingly collect information from individuals under 18. If we become aware that we have collected such information, we will delete it. If you are a parent or guardian and believe your child has provided us with personal information, contact privacy@sovereigntrading.ai.

10. COOKIES AND TRACKING

Our use of cookies and similar tracking technologies is described in our separate Cookie Policy, which is incorporated by reference.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a prominent notice on our website. Continued use of the service after the effective date of the updated policy constitutes acceptance.

12. CONTACT US

Questions or concerns about this Privacy Policy:

• Email: privacy@sovereigntrading.ai
• Phone: +1 (424) 777-4553
• Address: Sovereign Trading Capital, Inc., 9350 Wilshire Boulevard, Suite 203, Beverly Hills, California 90212

Sovereign Trading Capital, Inc. 9350 Wilshire Boulevard, Suite 203 Beverly Hills, California 90212 +1 (424) 777-4553 sovereigntrading.ai