Privacy Policy

Rix Trade LLC is a Pennsylvania limited liability company with its principal address at 502 W 7th St, Ste 100, Erie, PA 16502, USA. We operate RixTrade, a simulated trading and evaluation platform. We are the data controller for personal information we collect through the Services, except where we expressly act as a processor for a Partner Firm or other customer.

We collect the following categories of information:

(a) Account and Profile Information

When you sign up, we collect your email address, password (stored only as a salted hash), legal first name, legal last name, phone number, country of residence, postal address (street, city, state or region, postal code), and email-verification status. This information is required so that we can authenticate you, comply with market-data licensing rules (including the Options Price Reporting Authority, or "OPRA"), and meet applicable recordkeeping obligations.

(b) Subscriber Agreement and Attestations

When you accept our agreements, we record the agreement version and content hash, the timestamp of acceptance, the IP address and user-agent string used to accept, and your responses to each attestation (for example, that you are a natural person and a non-professional subscriber). These records form an audit trail we are obligated to retain.

(c) Identity and Compliance Information

Where required, we may collect or verify additional identity information, including government-issued identification, date of birth, selfie or liveness data, proof of address, tax forms, sanctions and watchlist screening results, and verification outcomes. This processing may be performed by third-party identity verification providers acting on our behalf.

(d) Trading and Account Activity (Simulated)

We collect and store all activity associated with your simulated accounts, including simulated balances, orders, fills, positions, ledger entries, dividends and adjustments, profit-and-loss history, performance metrics, account statuses (active, disabled, failed, archived), risk events, rule violations, and related events. These records are essential to operating the Services, generating statements, enforcing our rules, and cooperating with Partner Firm programs.

(e) Payment Information

If you pay for any portion of the Services, our third-party payment processors collect and process your payment instrument information directly. We receive limited transaction metadata, such as billing name, last four digits of your card, transaction status, amount, and timestamps. We do not store full card numbers on our systems.

(f) Device, Technical, and Usage Data

When you access the Services, we automatically collect technical information, including IP address, approximate location derived from IP, device identifiers, browser type and version, operating system, referring and exit pages, pages and screens accessed, time stamps, performance metrics, error logs, session identifiers, and other interaction telemetry. We use this information to operate, secure, debug, and improve the Services.

(g) Communications

When you contact us through email, support tickets, in-product messages, social media, or other channels, we collect the contents of your communication and any attachments, plus metadata such as date, time, and channel.

(h) Partner Firm Data

If you are routed to RixTrade through a Partner Firm or otherwise participate in a Partner Firm program, we may receive identifiers and program data from the Partner Firm, including your trader identifier, account configuration, program rules, evaluation stage, payout eligibility, and risk events. See Section 6.

(i) Cookies and Similar Technologies

We and our service providers use cookies, local storage, web beacons, and similar technologies as described in Section 8.

We use information for purposes including:

• Providing, operating, maintaining, securing, and improving the Services, including authenticating users, restoring access, issuing JWTs and session tokens, and processing single sign-on from Partner Firms.
• Complying with market-data licensing rules, including OPRA non-professional categorization, recordkeeping, and reporting to data providers.
• Verifying your identity and screening for fraud, abuse, money laundering, sanctions, and other compliance obligations.
• Administering Partner Firm programs, including reporting your simulated trading activity, performance, status, and risk events to the Partner Firm whose program you are enrolled in.
• Enforcing our Terms of Service, protecting our rights and the rights of others, and cooperating with law enforcement and regulators.
• Processing payments, billing, refunds (where applicable), and responding to chargebacks and disputes.
• Communicating with you about your account, transactions, security, policy updates, support requests, and (where permitted) marketing.
• Performing internal research, analytics, debugging, capacity planning, machine-learning model training, and product development. To the maximum extent permitted by law, we may perform these activities using identifiable, pseudonymized, de-identified, or aggregated data, including data derived from your simulated trading activity, in any lawful manner and for any lawful business purpose.
• Any other purpose disclosed at the point of collection or to which you separately consent.

Where the EU or UK General Data Protection Regulation applies, we process personal data on one or more of the following legal bases: (a) the performance of a contract with you (for example, providing the Services you requested); (b) compliance with a legal obligation (for example, recordkeeping and sanctions screening); (c) our legitimate interests, including operating, securing, and improving the Services and protecting against fraud and abuse, where those interests are not overridden by your fundamental rights; and (d) your consent, where required.

We may share information in the following circumstances:

• Service Providers. With vendors and contractors who perform services on our behalf, including hosting, infrastructure, email and SMS delivery, identity verification, payment processing, market-data provision, analytics, error monitoring, customer support, and security. These providers are bound by contract to use information only as we direct.
• Partner Firms. With the Partner Firm whose program you are enrolled in, as described in Section 6.
• Market Data Providers. With OPRA Participant exchanges, Theta Data, and other licensors as required by market-data agreements, including for non-professional categorization, audits, and enforcement of license terms.
• Legal and Safety. With law enforcement, regulators, courts, and other parties when we believe in good faith that disclosure is necessary or appropriate to (i) comply with applicable law, legal process, or a binding request from a public authority, (ii) protect our rights, property, or safety, or those of our users, employees, or others, (iii) detect, prevent, or address fraud, security, or technical issues, or (iv) enforce our Terms or other agreements.
• Business Transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider.
• With Your Consent. With other parties when you have given us your specific consent to do so.

We do not sell your personal information for monetary consideration, and we have not sold personal information of any consumer in the preceding 12 months.

If you are enrolled in a Partner Firm program, that Partner Firm may issue you a one-time login link that allows you to enter RixTrade without separately re-entering your password. By following such a link or by completing signup through a Partner Firm flow, you authorize RixTrade to share with the Partner Firm information about your RixTrade account that is reasonably necessary to administer the program, including your account identifier, the email used at signup, simulated balances, simulated orders and fills, position history, performance metrics, account status (including failed, disabled, or archived states), rule violations and risk events, and audit information related to single sign-on.

Partner Firms are independent businesses with their own privacy policies. We are not responsible for the privacy practices of any Partner Firm. We encourage you to read the Partner Firm's policies before participating in any Partner Firm program.

To the maximum extent permitted by applicable law, we may de-identify, pseudonymize, aggregate, hash, or otherwise process information collected through the Services so that it can no longer reasonably be linked back to you, and we may use, share, disclose, license, sell, or otherwise commercialize such de-identified, pseudonymized, or aggregated data for any lawful business purpose, including research, analytics, benchmarking, product development, model training, and marketing. We commit to maintain and use de-identified data only in de-identified form and not to attempt to re-identify it, except as permitted by applicable law (for example, to test the effectiveness of de-identification).

We and our service providers use cookies, local storage, session tokens, web beacons, pixels, SDKs, and similar technologies to operate and secure the Services, remember your preferences, authenticate you, measure performance, detect and prevent fraud, and analyze traffic patterns. Some of these technologies are strictly necessary to provide the Services and cannot be disabled without breaking core functionality, including login.

We may use third-party analytics and error-monitoring providers, which receive technical information described in Section 2(f). These providers act as our service providers and are bound by contract to use the information only as we direct.

You may control cookies through your browser settings. Disabling cookies may impair the operation of the Services. Where required by law, we present a cookie banner and honor any applicable opt-out signals, including Global Privacy Control.

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including providing the Services, maintaining audit and security logs, enforcing our agreements, resolving disputes, and meeting legal, tax, accounting, and regulatory obligations. Subscriber agreement records, market-data licensing records, identity verification records, financial records, fraud-prevention records, and trading-activity records may be retained for extended periods as required by applicable law or contractual obligation. When retention is no longer required, we delete or de-identify the information.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), hashed and salted passwords, access controls, network segmentation, monitoring, and vendor due diligence. No system is perfectly secure, however, and we cannot guarantee the security of any information you transmit to us or store with us. You are responsible for keeping your account credentials confidential and notifying us promptly of any suspected unauthorized access.

We are based in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, processed, and stored in the United States and other countries that may have data protection laws different from those in your country. Where required, we use lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

The Services are not directed to and are not intended for use by anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, please contact us at [email protected] so we can delete it.

Depending on your jurisdiction, you may have rights with respect to personal information we hold about you, including the right to request access, correction, deletion, restriction or objection to processing, portability, or withdrawal of consent. You may also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at [email protected]. We may verify your identity before responding. We will respond within the timeframe required by applicable law.

If you are a Pennsylvania resident, the Pennsylvania Unfair Trade Practices and Consumer Protection Law (UTPCPL) and the Breach of Personal Information Notification Act (73 P.S. Section 2301 et seq.) may apply to the handling of your personal information. We will provide notification of any data breach affecting Pennsylvania residents' personal information in accordance with applicable law.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), provides you with specific rights, including:

• The right to know what personal information we collect, use, disclose, and (if applicable) sell or share, and to receive a portable copy.
• The right to delete personal information, subject to exceptions.
• The right to correct inaccurate personal information.
• The right to limit the use and disclosure of sensitive personal information.
• The right not to receive discriminatory treatment for exercising your rights.

We do not sell or share personal information as those terms are defined under the CCPA, and we do not knowingly sell or share personal information of consumers under 16. To exercise your CCPA rights, contact us at [email protected]. You may designate an authorized agent. We will verify your request as required by law before responding.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under applicable data protection laws, including the right to access, rectification, erasure, restriction, objection, and portability of your personal data, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority. To exercise these rights, contact us at [email protected].

We may use automated systems to evaluate program rule compliance, simulated risk events, fraud signals, and similar operational determinations. These systems do not make decisions that produce legal or similarly significant effects on you without human review, and we do not use sensitive categories of personal information for automated profiling.

The Services may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third parties, and we are not responsible for their content, privacy practices, or security. We encourage you to review the privacy policies of any third party before providing personal information.

We may update this Privacy Policy from time to time. The "Last updated" date above will reflect the most recent revision. For material changes we will provide additional notice by email, in-product notice, or other reasonable means and may require re-acceptance before you continue using the Services. Your continued use of the Services after the effective date of any update constitutes your acceptance.

For all privacy-related questions, requests, or complaints, please contact: