Privacy Policy

How personal data is processed on the Terminal® platform.

1. Introduction and Data Controller

This Privacy Policy (the “Policy”) describes how Bursaly Group LLC, a limited liability company organized under the laws of the State of Delaware, United States of America (“Terminal”, “we”, or the “Controller”), collects, uses, stores, transfers and protects the personal data of Users who access the platform available at terminalapp.ai and its associated services.

This Policy forms an integral part of the Terms of Service and must be read together with the Cookie Policy and the Refund Policy.

• Controller: Bursaly Group LLC.
• Domain: terminalapp.ai.
• Privacy contact: [email protected].
• Address: 16192 Coastal Highway, Lewes, Delaware, 19958, USA.
• Territorial scope: Users worldwide, with specific provisions for residents of the European Union, the United Kingdom, Mexico and California.

2. Personal Data Collected

We collect only the data necessary to provide the Service, bill Users and comply with legal obligations. The categories are:

2.1. Registration and account data

• Full name or alias.
• Verified email address.
• Hashed password. Terminal never stores the password in plaintext.
• Preferred language and time zone.
• Profile picture (optional).

2.2. Subscription and billing data

• Plan purchased (Pro, Premium) and subscription status.
• Payment history, billing dates and amounts.
• Credit- or debit-card data is processed and stored directly by Stripe, Inc. Terminal does NOT store the full card number or CVV.
• Billing country and, where applicable, tax identification required by local law.

2.3. Platform usage data

• Access logs (date, time, IP address, browser type, operating system).
• Actions performed on the Platform (queries to Lumia™, Lumia Research reports generated, dashboards viewed, token consumption).
• User preferences and settings.

2.4. User-generated content

• Lumia Research reports, notes, comments and Trading Journal data voluntarily entered.
• Queries submitted to the Lumia™ assistant.

2.5. Anti-fraud data

• Device fingerprint generated by FingerprintJS, used to prevent trial abuse and the creation of multiple accounts.
• IP address and approximate location via IP geolocation.

2.6. Affiliated broker integration data

• Linking identifier (partner link / UID) when the User registers an affiliated broker account through Terminal.
• Monthly traded-lot volume (aggregate information received from the affiliated broker Partners API).
• Terminal does NOT receive data on individual trades, positions, balances or instruments traded by the User.

2.7. Terminal Partners Program data

When a User participates in Terminal’s Partners Program (section 18 of the Terms of Service), we additionally collect:

• Unique referral link assigned to the User and attribution records (30-day last-click cookie, IP and device fingerprint of the referred visitor at the time of signup).
• Program activity metrics: number of Referred Users, Active Referred Users, Commissions generated, Commissions in pending and available status.
• USDT wallet address (Tron network, TRC20) provided by the Partner to receive withdrawals.
• Withdrawal history: amount, request date, processing date, transaction hash on the Tron network.
• Tax identification or additional information that may be required when the cumulative volume of payments to the Partner reaches thresholds triggering regulatory reporting obligations in the applicable jurisdiction.

2.8. Communication data

• Emails exchanged with support and ticketing.
• Responses to voluntary surveys.

3. Purposes of Processing

Personal data is processed for the following purposes:

4. Legal Basis for Processing

Data processing is based on the following legal grounds, as applicable depending on the User’s jurisdiction:

• Performance of contract: when processing is necessary to provide the contracted Service.
• Consent: for non-essential cookies, commercial communications and optional processing. The User may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, anti-fraud or authority requirements.
• Legitimate interest: for Platform security, fraud prevention, Service improvement and defense against claims, where the rights of the data subject do not prevail.

5. Processors (Third-Party Sub-Processors)

To provide the Service, we share strictly necessary data with the following processors, which act under a data-processing agreement and with the safeguards described in Section 6:

The list of processors may be updated. The current version is always available at terminalapp.ai/legal/privacy.

6. International Data Transfers

Some processors are established outside the User’s country of residence, including the United States. In such cases, transfers rely on the following mechanisms:

• European Commission Standard Contractual Clauses, when the data subject resides in the European Union or United Kingdom.
• Processing agreements with equivalent safeguards, for data subjects in Mexico and other Latin American countries.
• Providers adhering to recognized certification frameworks (for example, the EU–U.S. Data Privacy Framework), where applicable.

7. Retention Periods

Data is retained only for as long as necessary for the purposes underlying its processing or for the minimum periods required by law:

8. Data-Subject Rights

Under applicable law, the User may exercise the following rights over personal data:

• Access: learn what data we process about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure or deletion: request deletion when the data is no longer necessary, subject to limitations arising from legal obligations.
• Objection: object to processing based on legitimate interest.
• Restriction of processing: request that processing be restricted while a controversy is resolved.
• Portability: receive your data in a structured, machine-readable format and transfer it to another controller where technically feasible.
• Withdrawal of consent: withdraw at any time consent previously given.
• Not to be subject to automated decision-making: request human intervention when a decision with significant effects is based solely on automated processing.

8.1. Specific provisions for residents of the European Union and United Kingdom (GDPR / UK GDPR)

In addition to the foregoing rights, data subjects residing in the EU or UK may file a complaint with the competent supervisory authority (for example, the Spanish Data Protection Agency, the French CNIL, or the UK ICO).

8.2. Specific provisions for residents of Mexico (LFPDPPP)

Data subjects residing in Mexico may exercise their ARCO rights (Access, Rectification, Cancellation and Opposition) by sending a request to [email protected]. They may also file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

8.3. Specific provisions for California, USA residents (CCPA/CPRA)

California residents have the right to know what categories of personal information are collected, request its deletion, and opt out of its sale. Terminal does NOT sell personal information within the meaning of the CCPA/CPRA.

8.4. Procedure to exercise rights

All requests must be sent to [email protected], identified with the email associated with the Account. We will respond to requests within thirty (30) calendar days, extendable by another thirty (30) days when complexity warrants, with notice to the data subject of any extension.

9. Minors

The Service is not directed at persons under the age of eighteen (18). Terminal does not intentionally collect data from minors. If we identify that an Account belongs to a minor, we will delete it immediately and notify the legal representative when possible.

10. Security Measures

Terminal applies reasonable technical and organizational measures to protect personal data, including:

• Encryption in transit using TLS 1.2 or higher.
• Password encryption via salted hash functions.
• Role-based access control and least-privilege principles.
• Regular backups.
• Continuous security monitoring and internal audits.
• Internal confidentiality policies and training.

No system is invulnerable. In the event of a security incident affecting personal data, Terminal will notify the User and the competent authorities within the timeframes legally established.

11. Cookies and Similar Technologies

The use of cookies, pixels and similar technologies is governed by the Cookie Policy, available at terminalapp.ai/legal/cookies, which forms an integral part of this Policy.

12. Changes to the Policy

Terminal may modify this Policy at any time. Substantive changes will be notified to the User by email or via a visible notice on the Platform, with at least fifteen (15) calendar days’ advance notice. The current version is always available at terminalapp.ai/legal/privacy, with its date of last update.

13. Data Controller Contact

For any inquiry, request or claim regarding personal-data processing, the User may contact us at:

• Bursaly Group LLC
• Email: [email protected]
• Suggested subject: “Privacy — [type of request]”
• Address: 16192 Coastal Highway, Lewes, Delaware, 19958, USA.

Last updated: May 1, 2026