1. Overview

FieldCrest Capital LLC ("Company," "we," "us," or "our") operates the Signa platform ("Service"). This Privacy Policy describes how we collect, use, store, disclose, and protect information in connection with your access to and use of the Service, including access via web interface, API, Model Context Protocol (MCP), or any Agent-to-Agent (A2A) integration.

This is version 1.4 of this Privacy Policy, effective October 31, 2026. Prior versions: version 1.3, version 1.2.

2. Information We Collect

2.1 Account and Registration Information

When you create an account, we may collect full name, email address, password (stored encrypted — we do not store plaintext passwords), phone number (for two-factor verification), and organization or firm name. If you sign in with Google, we receive your name, email address, and profile image from Google.

2.2 Usage and Activity Data

We automatically collect information about how you interact with the Service, including pages viewed, features accessed, Signal Outputs interacted with, timestamps and session activity, clickstream data, filter selections, screener parameters, and watchlist configurations.

2.3 Technical and Device Information

We may collect IP address and geographic region, browser type and version, device type and operating system, User-Agent string, and referring URLs and entry points.

2.4 API and Programmatic Access Data

If you access the Service via API, MCP Server, or any programmatic channel, we collect API keys and associated metadata (Agent-ID, User-Agent header), complete request logs including endpoint accessed, HTTP method, response status, and timestamp, usage patterns and request velocity, and any error codes generated by your requests. This telemetry data is used for security monitoring, abuse detection, rate limit enforcement, and compliance verification. You consent to this collection as a condition of programmatic access.

2.5 Broker and Third-Party Integration Data

If you connect third-party broker platforms (for example Alpaca, tastytrade, Coinbase Advanced Trade, or Hyperliquid), we may collect connection status and integration configuration, account identifiers and wallet addresses provided by the third-party platform, and API tokens or credentials, which are stored using industry-standard encryption. If you connect a brokerage account through our portfolio sync provider, SnapTrade, we receive the holdings, positions, and balances you authorize so we can show them in the Service. We do not control data collected by third-party brokers and are not responsible for their privacy practices.

2.6 Payment Information

Web subscriptions are sold through Link, a Stripe service, which acts as merchant of record and collects your payment details, billing address, and tax information under its own privacy policy. Mobile subscriptions are billed by Apple or Google, and we receive subscription status from them through RevenueCat. We never receive full card numbers. We retain billing status, subscription tier, billing country and region, transaction metadata, and customer IDs.

2.7 Communications and Support

We collect information you provide when contacting support, submitting inquiries, or engaging in enterprise discussions.

2.8 SMS and Mobile Notifications

If you provide a phone number and check the SMS consent box, we may send you one-time passcodes (OTP) for account verification and optional transactional account alerts (login notices, billing receipts, and account-status updates). Message frequency is occasional and transactional only. Standard message and data rates may apply. You may opt out at any time by replying STOP to any message. Reply HELP for assistance. Your phone number will not be shared with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes; text messaging originator opt-in data and consent are excluded from every category of information sharing in this policy and will not be shared with any third parties. SMS delivery is facilitated by Twilio, Inc. (a subprocessor), subject to their privacy policy at twilio.com/legal/privacy.

2.9 Content You Post

If you post in community features, set a display name or alias, or share charts and profiles, that content and your display name are visible to other users and, where you share publicly, to anyone with the link.

2.10 AI Features

When you use AI features, we collect your questions, the context we attach to them (such as tickers, watchlists, or portfolio holdings you have connected), and the responses, so we can answer, keep your history, and prevent abuse.

2.11 Mobile Apps

If you use a Signa mobile app and allow notifications, we collect a push notification token and basic device information so we can deliver alerts.

3. How We Use Information

We use collected information to: operate, maintain, and secure the Service; authenticate users; provide features and deliver Signal Outputs; monitor for abuse, fraud, and unauthorized access; improve platform performance and signal quality; develop new features; enforce our Terms of Use; communicate with users regarding accounts and security; and comply with legal obligations.

4. AI, Analytics, and Model Improvement

We may use aggregated, anonymized, or de-identified data derived from platform usage to improve system performance, analyze usage patterns, and enhance internal quantitative infrastructure. We do not use identifiable personal data to train external AI models without your explicit authorization.

To deliver AI features, we send your question and the context attached to it to Anthropic and OpenAI. They process that data to produce a response. Their handling of the data follows their own terms.

5. Data Sharing and Disclosure

We do not sell personal information. We do not share personal information for third-party advertising or marketing purposes. We may share information in the following limited circumstances:

5.1 Service Providers

We share data with vendors who assist in operating the Service, including hosting providers, analytics services, payment processors, and infrastructure vendors. These providers are contractually obligated to protect your data and may only use it for the specific purpose for which it was shared. Current categories of subprocessors include hosting and databases (such as Vercel, Supabase, and Railway), payments (Stripe and Link, Apple, Google, and RevenueCat), messaging (Twilio for SMS, and email delivery providers such as Resend and Beehiiv), Anthropic and OpenAI, which process data to deliver AI features, brokerage connectivity (SnapTrade and the brokers you connect), sign-in (Google), and analytics (Vercel Web Analytics, and PostHog for product events when you allow analytics).

5.2 Legal and Compliance Disclosures

We may disclose information to comply with applicable law, regulation, or legal process; in response to a valid court order, subpoena, or government request; to protect the rights, property, or safety of Company, its users, or the public; or to prevent fraud, investigate violations of our Terms, or enforce our legal rights.

5.3 Business Transfers

In connection with a merger, acquisition, or asset sale, user information may be transferred as part of the transaction. We will provide reasonable notice prior to personal information being transferred and becoming subject to a different privacy policy.

5.4 Enforcement and Abuse Prevention

We may use and disclose information — including API telemetry, request logs, and account fingerprints in API responses — to detect abuse, enforce contractual restrictions, investigate violations of our Terms of Use, and pursue available legal remedies.

6. Data Retention

We retain personal data only as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete the account and the records that are removed with it at that time. We do not keep account information for a fixed period after the account is closed. The windows below are the ones our cleanup jobs apply. See Delete your account.

• Security and audit logs are kept for up to two (2) years, then deleted.
• API usage records are kept for ninety (90) days, then deleted.
• One-time passcodes are deleted seven (7) days after they expire.
• Trading Buddy interaction records are kept for ninety (90) days, then deleted.
• Scored signals that are no longer the live signal for a ticker are kept for 365 days, then deleted. The current live signal for a ticker is not deleted on that schedule.
• Expired sign-in refresh tokens are deleted one (1) day after they expire.
• Stripe billing records are kept as required for tax and accounting. The Stripe customer is not deleted when you delete your account.
• Support correspondence is kept.
• Newsletter unsubscribe records are kept so we do not email an address that has opted out.
• Aggregated, anonymized usage data may be retained indefinitely, because it is not personal information.

Some records are kept with the account link removed and no fixed deletion schedule: paper trades, AI usage records, support escalations, feedback submissions, trade orders and their order events, and indicator access records. Support escalations may still contain the email address and message text. Feedback submissions may keep the email, message and IP address. You can ask support@getsigna.ai to delete these. The deletion audit record keeps the user id and an optional email HMAC. It does not keep the email address.

Processors keep their own copies of data they receive. Stripe keeps billing records as required for tax and accounting. Resend and Beehiiv, the email providers, keep newsletter unsubscribe records. Anthropic and OpenAI keep the questions and context sent to them to deliver AI features. Their handling of those copies follows their own terms.

7. Data Security

We implement reasonable administrative, technical, and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted storage of passwords and sensitive credentials, TLS/HTTPS encryption for data in transit, access controls and authentication requirements for internal systems, monitoring and logging of system activity, and regular security reviews.

You are responsible for maintaining the confidentiality of your account credentials and API keys. Report any suspected unauthorized access to support@getsigna.ai.

8. Third-Party Services and Integrations

The Service integrates with third-party services, including broker platforms and market data providers. We are not responsible for the privacy practices or security of any third-party service. Your use of third-party services is governed by those parties' own privacy policies and terms.

9. Your Rights and Choices

Regardless of jurisdiction, you may: access and update your account information through account settings; cancel your subscription at any time; delete your account in the Signa app from the Profile tab, where Delete Account asks you to verify again and then deletes the account immediately, or by emailing support@getsigna.ai; and opt out of non-essential marketing communications. Section 6 states what is deleted at that time and what is kept. We may require identity verification before fulfilling requests. See Section 16 for jurisdiction-specific rights.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain sessions, analyze usage, and improve platform functionality. Essential cookies are required for platform functionality and cannot be disabled without impairing the Service. We use Vercel Web Analytics, which does not set cookies, only if you allow analytics in Cookie Settings, and never when your browser sends a Global Privacy Control or Do Not Track signal. See our Cookie Policy for full details.

11. International Data Transfers

FieldCrest Capital LLC is based in the United States. If you access the Service from outside the United States, your personal data will be transferred to and processed in the United States. By using the Service, you acknowledge and consent to such transfer. Where required by applicable law, we implement appropriate safeguards including Standard Contractual Clauses.

12. Children

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected information from a minor, please contact support@getsigna.ai.

13. Limitation of Liability — Data and Privacy

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, COMPANY SHALL NOT BE LIABLE FOR: (i) UNAUTHORIZED ACCESS TO YOUR DATA BY THIRD PARTIES DESPITE REASONABLE SECURITY MEASURES; (ii) SECURITY BREACHES CAUSED BY YOUR FAILURE TO MAINTAIN ACCOUNT SECURITY; (iii) DATA LOSS OR CORRUPTION RESULTING FROM THIRD-PARTY INFRASTRUCTURE FAILURES; (iv) ACTIONS OF THIRD-PARTY SERVICE PROVIDERS OPERATING UNDER THEIR OWN PRIVACY POLICIES; OR (v) MISUSE OF INFORMATION BY OTHER USERS OR THIRD PARTIES.

14. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be communicated via email with at least 14 days' notice. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact

• Privacy requests: support@getsigna.ai
• Security reports: support@getsigna.ai
• Legal notices: support@getsigna.ai
• Mailing address: FieldCrest Capital LLC, 30 N Gould Street, Ste R, Sheridan, WY 82801

16. Additional Privacy Rights — GDPR & CCPA

16.1 Scope

This section applies to users located in: (i) the European Economic Area (EEA); (ii) the United Kingdom; and (iii) the State of California. It supplements the general Privacy Policy above. Residents of other U.S. states with consumer privacy laws, such as Colorado, Connecticut, Oregon, Texas, and Virginia, may exercise the same access, correction, deletion, and portability rights by emailing support@getsigna.ai. If we decline your request, you may appeal by replying to our decision with "Appeal" in the subject line, and we will respond within 60 days.

16.2 GDPR Rights — EU and UK Users

If you are located in the EEA or United Kingdom, you have the following rights under GDPR:

• Right of Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete personal data.
• Right to Erasure — Request deletion of your personal data, subject to our legal obligations.
• Right to Restriction — Request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability — Where processing is based on consent or contract, request your data in a structured, machine-readable format.
• Right to Object — Object to processing based on legitimate interests, including profiling.
• Right to Withdraw Consent — Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.

Contact support@getsigna.ai to exercise these rights. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

16.3 Legal Basis for Processing (GDPR)

• Contractual Necessity (Art. 6(1)(b)) — Account registration, service delivery, billing, and support.
• Legitimate Interests (Art. 6(1)(f)) — Security monitoring, abuse prevention, fraud detection, API telemetry, platform improvement, and enforcement of Terms.
• Legal Obligation (Art. 6(1)(c)) — Compliance with applicable laws and lawful government requests.
• Consent (Art. 6(1)(a)) — Analytics cookies and non-essential tracking technologies.

16.4 International Transfers (GDPR)

Your data may be transferred to and processed in the United States. Where such transfers occur, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission.

16.5 CCPA/CPRA Rights — California Users

California residents have the following rights under the CCPA as amended by the CPRA:

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom we share it.
• Right to Delete — Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct — Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing — We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Sensitive Data Use — We do not use sensitive personal information for purposes beyond providing the Service.
• Right to Non-Discrimination — We will not discriminate against you for exercising your California privacy rights.

To submit a California privacy request, contact support@getsigna.ai. You may designate an authorized agent to make requests on your behalf, subject to verification.

16.6 Data Categories (CCPA Disclosure)

In the preceding 12 months, we have collected: Identifiers (name, email, IP address); Internet activity information (usage data, API logs); Commercial information (subscription and billing data); and Professional information (organization name, if provided). We have not sold any of these categories.

17. Do Not Track and Global Privacy Control

We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly allow third parties to collect personal information about your activity across other websites through the Service. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a choice to turn off optional analytics.