• Identity: name, date of birth, nationality, government ID and tax identification numbers.
• Contact: email address, phone number and residential address.
• Financial: income, net worth, investment experience, and bank and wallet details.
• Institutional clients: entity details, authorized users and beneficial owners.

• Device and usage data: IP address, browser, device identifiers, pages viewed and app activity.
• Cookies and similar technologies (see Cookies below).

• Identity verification and sanctions-screening providers.
• Brokerage, clearing, custody and banking partners.
• Fraud-prevention and credit reference agencies, where permitted.

• Open and operate accounts, and execute and settle transactions.
• Verify identity and meet KYC, AML and sanctions obligations.
• Provide advice and tailor your portfolio.
• Detect and prevent fraud, and keep our services secure.
• Send service messages and, where permitted, marketing you can opt out of.
• Improve our products and meet legal, tax and regulatory requirements.

[Legal bases for processing, for users in the UK, EU and Nigeria.]

We do not sell your personal information. We share it only as needed to provide our services or as required by law:

• Service providers acting on our behalf under contract.
• Brokerage, clearing, custody and banking partners, including Alpaca Securities LLC and [Prime partners].
• Regulators, law enforcement and tax authorities, where required.
• Affiliates, and a successor in a merger or acquisition.

We operate in the United States, Nigeria, the United Kingdom and Canada, and may transfer information between these and other countries. Where required, we use safeguards such as [standard contractual clauses].

We keep personal information while your account is open and afterwards for as long as the law requires, typically [at least six years] for brokerage and advisory records.

We protect your information with administrative, technical and physical safeguards. Our Security page explains how we protect your account and data.

We use essential cookies to run the site and, with your consent where required, analytics and marketing cookies. You can change your choices at any time in [Cookie settings].

Depending on where you live, you may have the right to access, correct, delete or port your information, to object to or restrict processing, and to withdraw consent. To close your account and delete your data, see Delete your account.

• United States: [state privacy rights, where applicable].
• United Kingdom and EU: rights under the UK GDPR and EU GDPR, including the right to complain to the ICO or your local authority.
• Nigeria: rights under the Nigeria Data Protection Act 2023.
• Canada: rights under PIPEDA and applicable provincial laws.

To make a request, contact [privacy@vantar.co]. We will verify your identity before we respond.

Our notice under Regulation S-P and the Gramm-Leach-Bliley Act explains how we share nonpublic personal information and how you can limit sharing. [Link to notice.]

Our services are not directed to anyone under 18, and we do not knowingly collect their information.

We may update this policy from time to time. We will tell you about material changes [by email or in the app] before they take effect.

[Data protection officer] · [privacy@vantar.co] · [Mailing address]