Privacy policy

Last updated: June 8, 2026 · Draft pending attorney review

Information we collect

• Account: your email address and name (via Google Sign-In or the email you provide), and a derived user id.
• Configuration: the agents you enable, broker choice, paper/live mode, approval mode, and risk-disclosure acknowledgements (versioned, timestamped).
• Broker credentials: API keys you paste to connect a brokerage (e.g. Alpaca). Stored encrypted at rest (Fernet via a server-side key) and used only to operate the features you enabled. We never see your brokerage username/password.
• Activity & audit: per-account audit logs (signals evaluated, orders placed/skipped, approvals, access grants) and position/P&L records needed to render your dashboard.
• Waitlist: the email you submit, with a source tag and timestamp.
• Technical: a session cookie (sign-in state) and standard server logs (IP, user agent, timestamps) from our hosting provider. No advertising trackers, no third-party analytics scripts.

How we use information

• Operate the service: run the agents you enabled, place orders you authorized, render your dashboard, mint your MCP token.
• Safety and integrity: enforce risk limits, audit what the system did, prevent abuse.
• Communications: transactional messages about your account. If we ever send marketing, it will be opt-in with one-click unsubscribe.
• Legal compliance and record-keeping.

We do not sell or rent personal information, and we do not share it with third parties for their own marketing.

The public model account vs. your account

AgentVest broadcasts the trades of its own model account to the public dashboard, Telegram, and X. Your trades, positions, and P&L are private to your dashboard and are never published.

Who processes data on our behalf

• Fly.io — application hosting and storage (US region).
• GitHub Pages — serves this static site.
• Google — sign-in (OAuth); we receive your email/name, never your password.
• Alpaca / your broker — executes trades in your account under your API keys.
• Anthropic (Claude) / AI providers — used for research enrichment (e.g. scoring news headlines). Headlines and market data are sent; your personal data is not.
• Stripe — payment processing if/when paid tiers launch; card details go directly to Stripe and never touch our servers.

Retention and deletion

We keep account data while your account is active. Disconnecting your broker deletes the stored keys' usefulness immediately; you can request full account deletion (including encrypted credentials, configuration, and dashboard data) by emailing hello@agentvest.ai from your account email. Audit records may be retained where required for legal or dispute-resolution purposes.

Security

• TLS everywhere; secure session cookies.
• Broker keys encrypted at rest; secrets held in the hosting provider's secret store, never in source control.
• Per-user data isolation with path-traversal guards and redacted logging.

No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by applicable law.

Your rights

Depending on where you live (e.g. California, EU/UK), you may have rights to access, correct, export, or delete your personal information, and to non-discrimination for exercising them. Email hello@agentvest.ai and we will honor verified requests. We do not respond to browser "Do Not Track" signals because we do not track you across other sites.

Children

The service is not directed to anyone under 18, and we do not knowingly collect data from minors.

Changes to this policy

We will update this page as the service evolves; the "Last updated" date reflects the current version. Material changes to how we handle existing data will be notified to account holders by email.

Contact

Privacy questions or requests: hello@agentvest.ai.