Privacy Policy
This Privacy Policy explains how Vanquish AI processes personal data when you use our platform. We aim to collect only what we need to run a secure, self-directed trading-automation service, and we never take custody of your funds.
1. Controller & DPO
The controller is Vanquish AI B.V., the Netherlands. For privacy questions or to exercise your rights, contact privacy@vqs.ai. Our Data Protection Officer can be reached at dpo@vqs.ai.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | Username, email (with verification status), optional mobile, password hash, 2FA secret, invite code | You |
| Broker connection | Encrypted broker API tokens/keys, broker account identifier, connection status | You / your broker (OAuth) |
| Strategy & config | Bots, strategy logic, parameters, risk settings, backtests | You |
| Trading activity | Signals, orders, fills, positions metadata, logs and system events generated by your bots | Generated by your bots / your broker |
| Billing | Subscription status, plan, payment token/reference (no full card data), invoices | You / Mollie |
| Technical & usage | IP address, device/browser, log timestamps, feature usage, and — with consent — analytics | Automatically |
| Support | Messages and correspondence with us | You |
We do not intentionally collect special categories of personal data. Please do not include such data in your strategies or messages.
3. Purposes & legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account; provide the platform and run your bots | Performance of a contract (6(1)(b)) |
| Connect your broker and execute the instructions your bots generate | Contract (6(1)(b)) and your explicit authorisation/consent for live trading |
| Process subscriptions and payments; keep invoices | Contract (6(1)(b)); legal obligation for accounting (6(1)(c)) |
| Secure the platform, prevent abuse, ensure reliability and audit logs | Legitimate interests (6(1)(f)) |
| Communicate service and security notices | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Privacy-respecting analytics and non-essential cookies | Consent (6(1)(a)) |
| Comply with legal obligations and respond to lawful requests | Legal obligation (6(1)(c)) |
4. Broker credentials
Broker API credentials are sensitive. They are encrypted at rest and in transit, scoped to least privilege, isolated per user, and used only to operate your bots and connection. You can disconnect your broker at any time, which revokes our access. Full technical detail is in our Data-Security & Credential-Handling Statement.
5. Automated processing & bot activity
Your bots place orders automatically based on the logic and parameters you define and the live deployment you explicitly authorise. This automation acts on your own brokerage account at your instruction; Vanquish AI does not make investment decisions for you. We do not carry out automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR using our profiling of you. Because the activity involves financial data and user-configured automation, we maintain a Data Protection Impact Assessment.
6. Recipients & sub-processors
We share personal data only with processors and partners needed to run the service — including hosting, payment processing (Mollie), email delivery, AI features (Anthropic), and your connected broker as required to execute your instructions — under data-processing agreements. We do not sell personal data. See the Sub-processor List. We may disclose data where required by law.
7. International transfers
Where a sub-processor processes data outside the EEA (for example, Anthropic in the United States), we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, supplementary measures. Details and the transfer mechanism per sub-processor are listed in the Sub-processor List.
8. Retention
We keep personal data for as long as your account is active and as needed to provide the service. Trading and audit logs are retained for 24 months for security, audit and dispute-handling. Invoices and accounting records are kept for the statutory period (in the Netherlands, generally 7 years). On account deletion we erase or anonymise personal data, except where retention is legally required.
9. Your rights
Subject to conditions in the GDPR, you have the right to: access; rectification; erasure; restriction; data portability; object to processing based on legitimate interests; and withdraw consent at any time (without affecting prior processing). To exercise these, contact privacy@vqs.ai. You also have the right to lodge a complaint with your supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
10. Security
We implement appropriate technical and organisational measures, including encryption of credentials, access controls, isolation, logging and monitoring. No system is perfectly secure; we maintain incident-response procedures and will notify you and the supervisory authority of personal-data breaches where legally required.
12. Changes & contact
We may update this policy; material changes will be communicated in-app or by email. Contact: privacy@vqs.ai.