Privacy Policy

Last updated: 5 November 2026

1. Introduction

This Privacy Policy explains how Exeq ("Exeq", "we", "us" or "our") collects, uses, shares and protects personal information when you use the Exeq website, web application and related services (the "Services").

It applies to all users, wherever they live. Where privacy laws give you specific rights, such as the GDPR in Europe and the UK, the CCPA and similar laws in US states, or PIPEDA in Canada, Section 11 explains them.

2. Who We Are

The company responsible for your personal information (the "controller") is Liquid Stelvio S.r.l., a limited liability company (società a responsabilità limitata) under Italian law, VAT and tax code 01097460149, registered with the Companies Register of Sondrio under the same number, with its registered address at Piazza Giuseppe Garibaldi 5, 23100 Sondrio, Italy.

The person accountable for personal information is our Chief Executive Officer, reachable at the address below. For any privacy question, or to use your rights, email team@getexeq.com with the subject line "Privacy Request".

3. Scope and Eligibility

The Services are only for people aged 18 or over. We do not knowingly collect information from anyone under 18, and we delete accounts of users we find to be under 18.

Exeq is software that turns a trading idea you describe into fixed, readable rules (an "Agent"), lets you test those rules with hypothetical results, and lets you connect your own brokerage account. What we process depends on where you live:

• Everywhere. You can create Agents, run backtests and simulations, put Agents on paper or in the practice account, and connect a brokerage account through a third-party account-aggregation provider (the "Aggregator") to view it. Outside the United States and Canada, connected accounts are read-only: we read account data, and no real order is ever placed.
• United States and Canada. You can also run an Agent live on your connected brokerage account. A real order is sent only in the ways described in Section 6.

4. Information We Collect

4.1 Information you give us

• Account information: your name and email address.
• Country of residence: the country you declare, which decides whether you can use live execution (United States and Canada only). We log every change to it.
• Your ideas and Agents: the trading ideas you type, the Agents created from them, their versions and settings (such as money caps and approval or automatic mode), and your answers to any question we ask before building.
• Ask panel: the questions you ask in the Ask panel and the answers given.
• Messages to us: what you write when you email us.
• Billing: handled by our payment processor, Stripe. We do not receive or store full card numbers.

4.2 Information from your broker, through the Aggregator

When you connect a brokerage account, you sign in to your broker directly through the Aggregator's secure page. We never receive your broker username or password. The Aggregator gives us an encrypted credential for you, and through it we receive your balances, positions, orders and order status.

4.3 Information we generate

• Backtests, alternative-reality simulations, paper and practice-account results for your Agents.
• Records of orders proposed, approved, expired, sent and filled for live Agents, and the notices we sent you about them.
• Records of when Agents were paused, stopped or switched between approval and automatic mode, and of your consent to automatic mode.

4.4 Information collected automatically

• Sign-in records: when and how you signed in with the email link we sent you.
• Basic usage logs: server and application logs, such as IP address, browser type, the time of requests and errors, used for security, debugging and abuse prevention.

Market-data providers send us prices and other market data. They do not receive any personal information about you.

5. How We Use Your Information

We use personal information only for the purposes below. Where the GDPR applies, the legal basis is shown in brackets.

• To create and run your Account and sign you in (contract).
• To provide the Services: building Agents, running simulations and paper, answering Ask questions, connecting your broker and, where you are eligible, sending orders you have authorised (contract).
• To check your eligibility for live execution from your declared country of residence and enforce our geographic limits (contract; legal obligation, namely sanctions compliance).
• To take payments and manage subscriptions (contract; legal obligation).
• To send service emails, such as sign-in links, order approval requests, order notices and important changes (contract).
• To send you product updates and newsletters, only if you opt in (consent; you can unsubscribe at any time).
• To improve the Services and produce aggregated, anonymised statistics (legitimate interests).
• To keep the Services secure, fix problems and prevent fraud and abuse (legitimate interests).
• To meet legal, tax and accounting duties (legal obligation).
• To establish or defend legal claims (legitimate interests).

We do not use your information for purposes that are materially different from these without telling you first. We do not sell your personal information and do not use it for advertising.

6. AI Processing

6.1 What the AI does

We use AI models from a third-party AI provider, acting as our processor. They turn the idea you type into an Agent's rules, may ask you one question about the idea, gather and summarise market information and news from public and official sources, and answer questions in the Ask panel. To do this, they receive the text you type and the Agent and page content needed for the task, which for a live Agent can include account data shown on its page, such as positions and cash. They never receive your Aggregator credential.

We use the commercial API of our AI provider, under terms that do not allow your inputs and outputs to be used to train its models.

6.2 You stay in control

The AI compiles an Agent's rules once. It never decides a trade while the Agent runs, and it never places an order on its own. A real order happens only in one of these ways:

• Approval mode (the default): you approve that specific order on the Agent's page. We email you when an order is waiting. If you do not approve it, it expires shortly before the market close and is not placed.
• Automatic mode: you have switched that Agent to automatic mode after a separate, specific consent. Orders its rules call for are then sent without asking you each time, and we notify you of them.

You can also tell an Agent yourself to sell every position it holds. You can pause an Agent, switch it back to approval mode, or stop it at any time.

Outside the United States and Canada, the Services are read-only and no real order is ever placed.

6.3 Automated decisions

Where an Agent in automatic mode counts as automated decision-making under Article 22 of the GDPR or similar laws, it happens at your request, follows rules you have seen and accepted, and is needed to provide the service you asked for. You can switch to approval mode or stop the Agent at any time, and you can ask for human review, give your view or contest a result by emailing team@getexeq.com.

7. How We Share Your Information

We share personal information only as described here. We do not sell it, and we do not share it for cross-context behavioural advertising as defined in the CCPA.

7.1 Our processors

These service providers process personal information on our behalf, under contracts that require them to protect it:

• Our AI provider: AI models that build Agents' rules, summarise information and answer Ask questions. Name available on request.
• The Aggregator: currently SnapTrade (Passiv Inc., Canada): connecting your brokerage account, reading account data and, where you are eligible, sending orders you have authorised.
• Amazon Web Services: hosting of the application and databases, in Frankfurt, Germany (AWS eu-central-1).
• Resend: sending sign-in links, approval requests and other service emails.
• Stripe: payments and subscriptions.

Stripe and SnapTrade also act as independent controllers for their own purposes, such as fraud prevention, their own legal duties and the services they provide to you, under their own privacy policies.

7.2 Your broker and the Aggregator

When you connect a brokerage account, you sign in directly with your broker through the Aggregator. Your broker, and the Aggregator for its own services, also handle your data under their own privacy policies, which we encourage you to read.

7.3 Legal reasons

We may disclose information if we believe in good faith that we must, in order to obey the law, a court order or a lawful request from a public authority; enforce our Terms; detect or stop fraud or security problems; or protect the rights, property or safety of Exeq, our users or others.

7.4 Business transfers

If we are part of a merger, acquisition, financing or sale of assets, your information may be transferred to the parties involved, under confidentiality duties and with this Policy (or an equally protective one) continuing to apply.

7.5 With your consent

We may share information with others when you clearly ask us to.

8. International Data Transfers

Our hosting is in Frankfurt, Germany (AWS eu-central-1). Some processors process data outside the European Economic Area, and we rely on these safeguards: SnapTrade (Canada): the European Commission's adequacy decision for Canada; Stripe (United States): the EU-US Data Privacy Framework, to which Stripe is certified; our AI provider (United States): the European Commission's Standard Contractual Clauses; Resend (United States): the European Commission's Standard Contractual Clauses. For UK users, the UK extension to the Data Privacy Framework or the UK International Data Transfer Addendum applies in the same way. You can ask us for copies at team@getexeq.com.

9. Security

We use reasonable technical and organisational measures to protect your information, including:

• encryption of all traffic to and from the Services;
• encryption of databases and storage at rest;
• storing the credential we receive from the Aggregator encrypted, decrypting it only when an operation you have authorised needs it, and never writing it to logs in plain text. We never receive your broker username or password;
• sign-in by one-time email links, so we store no password for you; and
• limiting access to production systems to authorised staff who need it.

No system is completely secure, so we cannot guarantee absolute security. Please keep your email account secure, because it is how you sign in. If a breach affects you, we will notify you and the authorities where the law requires.

10. Data Retention

We keep personal information only as long as needed for the purposes in this Policy:

• Account information and country of residence: while your Account is open, then deleted within 30 days of deletion, except records listed below that we must keep.
• Ideas, Agents, versions and simulation results: while your Account is open; deleted when you delete them or your Account.
• Ask questions and answers: while your Account is open; deleted with your Account.
• Aggregator credential and broker connections: until you disconnect the broker; deleted, together with your user at the Aggregator, when you delete your Account.
• Live order records, mode changes, automatic-mode consents and residence changes: 10 years after the event, the ordinary limitation period under Italian law (Article 2946 of the Civil Code), to handle disputes and legal claims.
• Billing records: as long as tax and accounting law requires.
• Sign-in records and usage logs: up to 12 months.
• Records needed for a legal claim: until the claim is resolved or the limitation period ends.

After that, we delete the information or anonymise it so it can no longer identify you.

11. Your Rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• have your information deleted;
• restrict or object to some uses, including uses based on our legitimate interests;
• receive your information in a portable format;
• withdraw consent at any time, without affecting what was done before; and
• not be treated differently for using these rights.

Europe and the UK (GDPR). You have the rights above. Our lead supervisory authority is the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it). You can also complain to the data-protection authority where you live or work, or, in the UK, to the Information Commissioner's Office.

United States. We honour the rights to know, access, correct and delete, and the right not to be discriminated against, for all US users, whether or not a state privacy law such as the CCPA formally applies to us. We do not sell or share personal information for advertising, and we use financial account information only to provide the Services you asked for. In the last 12 months we have collected identifiers (name, email, IP address), financial information (brokerage data through the Aggregator, subscription history), internet activity (usage logs) and your declared country of residence, and disclosed them only to the processors in Section 7.1 for the purposes in Section 5. You may use an authorised agent; we will verify both you and the agent.

Canada (PIPEDA). You can access and correct your information, withdraw consent, and ask about our practices. You can complain to the Office of the Privacy Commissioner of Canada. The Services are not offered to residents of Quebec.

To use any of these rights, email team@getexeq.com with the subject "Privacy Request". We may need to confirm your identity, usually by using the email linked to your Account. We will reply within the time the law requires, normally one month.

12. Cookies

We use only cookies and similar storage that are strictly necessary to run the Services, such as keeping you signed in and protecting your session. We do not use advertising cookies. Because these cookies are essential, they do not require your consent.

13. Children

The Services are not meant for anyone under 18, and we do not knowingly collect their information. If you think a child has given us personal information, email team@getexeq.com and we will delete it.

14. Changes to This Policy

We may update this Policy. If a change is material, we will tell you by email or in the Services at least 30 days before it takes effect, unless the law requires a shorter period. The date at the top shows the current version.

15. Contact Us

If you have any question about this Policy or how we handle your information:

• Email: team@getexeq.com (subject: "Privacy Request")
• Post: Liquid Stelvio S.r.l., Piazza Giuseppe Garibaldi 5, 23100 Sondrio, Italy