Your privacy.

Who is responsible and how to contact us

LUMINOVA AI TWIN INC. operates ATAI.ca and is responsible for personal information under its control. This notice explains the information used to provide ATAI accounts, payments, analytical tools, licences and trading journals. It does not replace the privacy policies of your broker, payment provider or a website you visit through a link.

For a privacy question, access/correction/deletion request, consent withdrawal or complaint, email support@atai.ca with the subject "Privacy request". We may verify your identity proportionately before releasing or changing account information. Do not email passwords, identity documents or recovery phrases unless a secure and necessary verification process has first been explained.

Information we collect

Account and contact information: the name, email address and password credentials used for registration, verification status, optional profile details, security preferences and records of account access. Passwords are stored as password hashes rather than readable account passwords.

Purchases and rewards: orders, invoices, product access, licence/account bindings, payment status, payment-provider references, cryptocurrency transaction references and relevant wallet addresses, discounts, ATAI Coin entries and referral attribution. Public blockchains may reveal transaction amounts, addresses and timing to anyone.

Journal and analysis data: broker/platform and server information, trading account identifier and the connection credential you supply; imported trades, positions, balances, equity, deposits and withdrawals, account currency, timestamps, notes, strategy/emotion tags, charts and screenshots, prompts, generated reviews and sync records. Trading information can be sensitive; share only what is needed.

Support and technical information: messages and attachments you send us, notification subscriptions and browser push endpoints, consent records, IP address and device/browser information where recorded for security or service operation, request timestamps, error logs and page/service activity. Information may arrive directly from you, from your authorised account connection or from a payment and infrastructure provider.

Why information is used

We use relevant information to create and secure your account, authenticate requests, deliver purchased services and licences, confirm payments, operate rewards/referrals, import and organise trades, calculate statistics, provide requested or automatic reviews, respond to support requests, deliver notifications, prevent abuse and meet accounting or legal duties.

Optional marketing and optional analytics are separate from messages and processing needed to operate your account and orders. We obtain consent where required. We will not treat acceptance of the Terms as unlimited consent for unrelated uses; a materially new purpose or disclosure requires the notice and consent required by law.

Trading account credentials and imported data

The journal asks for Investor/read-only access. The credential is encrypted in storage and used by the account-connection service to authenticate with the broker and retrieve data. It is not included in the statistics or chart context sent to the analysis model. Do not submit a trading password when a read-only credential is available or the form requires it.

Disconnecting an account stops further imports and removes the active stored connection credential. Trades, notes and earlier reports remain in your workspace unless separately deleted or removed through a request. A credential removed from the active system may remain in protected backups until those backups rotate out. You can also revoke or change it directly with your broker.

Private customer accounts are not automatically included in public performance demonstrations. Public reference-account examples are labelled and use specifically authorised data, with account credentials and private notes excluded. The public demonstration is separate from your private portfolio.

AI reviews, screenshots and user content

Analysis uses the data needed for the selected feature: for example, calculated trading statistics, your questions, trade notes, strategy/emotion labels or a submitted chart image. Journal inference currently runs on ATAI-operated infrastructure. Hosting and infrastructure providers still support the systems that store and process this information.

Only upload charts or documents you are authorised to use. Remove unnecessary names, account numbers or third-party information from screenshots. An AI output may be inaccurate and should not be treated as a verified fact about you, a diagnosis or an investment recommendation. Contact support to correct inaccurate source information or discuss a review.

Access to user content is limited to service delivery, security, support and other purposes described here. Making your account public, using private content for a materially different purpose, or transferring it to a new external analysis provider requires the applicable notice and consent; it is not implied by a public demo link.

Payments and service providers

When you select a card payment, Stripe processes the card transaction under its own privacy and security practices. ATAI receives relevant order, status and payment references; you should enter full card details only in the designated payment flow, not in journal notes or support messages.

For cryptocurrency payments, network nodes or blockchain data services may be used to verify a transfer using the public address, amount, asset, network and transaction reference. Blockchain entries are public and generally cannot be erased by ATAI. Never give us your wallet seed phrase or private key.

Hosting, storage, backup, email, security, payment, broker-connection and notification providers may process the information necessary for their role. Browser push delivery also involves the browser's push service. External links and embedded media or widgets, including Myfxbook or YouTube where displayed, may receive your IP address and browser request information when loaded. Their policies govern their independent services.

Disclosures and international processing

We may disclose relevant information to service providers supporting the purposes above, to professional advisers where necessary, or as required or permitted by law, such as responding to a valid legal request or addressing fraud and security threats. A corporate reorganisation or business transfer may require controlled disclosure subject to applicable privacy obligations and any required notice.

Information can be stored or processed in Canada and other countries where ATAI or its providers operate. Foreign courts, law enforcement or other authorities may have lawful access under those countries' laws. We remain responsible for appropriate protection of information under our control and use appropriate contractual and operational safeguards. Contact us for information about relevant service providers and processing arrangements.

Cookies, browser storage and analytics choices

Essential cookies and browser storage support sign-in sessions, form security, cart and referral attribution, trusted-browser verification, settings and security controls. Blocking them can prevent parts of the service from working. A trusted-browser preference lasts for the period described in your security settings; you can remove browser data or revoke trust where that control is offered.

Optional analytics, where offered, follows the choice recorded through Analytics preferences. You can review that choice at /privacy/analytics/. Essential operational and security logs are distinct from optional analytics and may remain necessary. Browser settings also let you manage cookies, local storage and push permissions.

A public webpage visit does not grant access to your brokerage account. An account connection requires the information and authorisation you supply through the connection form.

Email and browser notifications

Account verification, security alerts, purchase receipts, service-expiry notices and other necessary service messages may be sent to your account email. Optional marketing emails require consent where applicable and provide an unsubscribe method. Withdrawing marketing consent does not stop essential account or transaction messages.

You can adjust available email preferences in your profile. Browser notifications require permission and can be disabled through your browser or device settings. Delivery may be delayed or fail, and notification content can appear on a lock screen or shared device.

Retention and deletion

We retain information only for as long as needed for the stated purpose, your active services and reasonable operational needs, or as required for legal, accounting, fraud-prevention and dispute-resolution duties. The appropriate period depends on the record: an active connection credential, a saved journal, a security log and a financial transaction do not all have the same retention need.

You can request closure or deletion of your account and explain which data you want removed. We will explain any records that must be retained and the reason, and will restrict their use appropriately. Deletion from active systems may be followed by later removal through backup rotation. A restore may temporarily recover older records; applicable deletion requests must then be respected.

We cannot delete records independently held by your broker, Stripe, another service you use or a public blockchain. Contact those providers about their records. Cancelling a subscription alone does not necessarily delete your journal history.

Security and incident response

We use safeguards appropriate to the information, including encrypted connections, protected credentials, access controls and account-security measures. Access is limited according to operational need. No website, device or network can be guaranteed completely secure; use a unique password, protect your email account and report suspicious activity promptly.

Where a security incident triggers legal notification or reporting duties, we will follow those duties and provide the information and protective steps required. Please report suspected exposure to support@atai.ca without sending the exposed credentials in the message.

Access, correction and your other rights

You may request access to personal information we hold about you, information about its use and disclosure, and correction of inaccurate or incomplete records. You may request deletion or withdraw consent, subject to applicable legal limits. Some processing is necessary to supply a feature; withdrawing it may require disconnecting that feature or closing the account.

We respond within the period required by applicable law, explain any lawful refusal or extension, and identify an appropriate complaint route. You may contact the Office of the Privacy Commissioner of Canada or another competent privacy authority. Additional rights may apply depending on your location. This Policy does not limit those rights or require you to waive them.

Age and policy updates

ATAI is intended for people who can legally enter the service agreement, not children. If you believe a child has provided personal information without appropriate authority, contact us so we can investigate and address it.

We will update the effective date when this Policy changes. Material changes to privacy practices will be communicated as required, and additional consent will be obtained where required. A revised policy does not, by itself, authorise a use that otherwise needs your consent.