Privacy Policy

The data controller for the personal data collected through the AlphaBattle service (the “Service”) is FLOKO TECHNOLOGIES SRL, with registered office at Piazza Borgo Pila 39, 16129 Genoa (GE), Italy, VAT no. 03043870991 (the “Controller”). For any request concerning the processing of your personal data, you can contact us at privacy@alphabattle.ai.

This notice describes how we process the personal data of users who browse the Service or create an account to register their trading algorithms on the AlphaBattle platform, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection law.

• Browsing data: browsing the public pages of the Service (leaderboard, algorithm detail, public user pages) does not involve collecting identifying data beyond what is technically necessary to serve the page (see “Cookies” below).
• Registration data: if you create an account, we collect your email address, your password (securely managed by our authentication provider, AWS Cognito, and never visible to or accessible by the Controller in cleartext), and a public username (nickname) you choose.
• Google sign-in data: if you choose “Continue with Google”, we receive your email address and a name to use as an initial username from your Google account; we never receive or store your Google password.
• Registered algorithm data: if you register a trading algorithm in your Camp, we collect the bot name, its identifier (Bot ID), its description, and the API keys of your Alpaca paper-trading account (never live-trading keys), needed to read your algorithm’s simulated performance.
• Published content: any public notes you add to your algorithm’s transactions.
• Technical cookies: cookies required for the Service to function (see “Cookies” below).

We do not collect payment instrument data, banking data, or real trading data: the Service operates exclusively in simulated “paper trading” mode.

We process your personal data for the following purposes:

• provide the Service, create and manage your account, let you register and monitor your algorithms (legal basis: performance of a contract to which you are party, Art. 6(1)(b) GDPR);
• authenticate you securely via AWS Cognito, including Google sign-in where applicable (legal basis: performance of the contract);
• publicly display your username, the algorithms you register, and their simulated performance on the platform, consistent with the public, competitive nature of the Service (legal basis: performance of the contract / your consent implicit in registering an algorithm);
• respond to support requests or requests to exercise your rights (legal basis: the Controller’s legitimate interest in providing support);
• comply with legal obligations, where applicable (legal basis: Art. 6(1)(c) GDPR).

We do not use your data for direct marketing, and we do not sell or share it with third parties for advertising purposes.

We retain your account and registered-algorithm data for as long as your relationship with the Service lasts — i.e., until you request deletion of your account or data — subject to any longer retention required by applicable law. Technical logs and the market/performance data cache (based on hourly windows) are retained only as long as necessary to operate the Service.

Your data is processed through Amazon Web Services (AWS) cloud infrastructure, specifically in the eu-central-1 European region (Frankfurt, Germany), which acts as a data processor on the Controller’s behalf. We do not sell, share, or otherwise disclose your data to third parties for commercial or advertising purposes.

If you connect your algorithm using Alpaca API keys, the Service communicates with Alpaca’s infrastructure (Alpaca Securities LLC / AlpacaDB, Inc.) solely to read your account’s paper-trading data, using credentials you voluntarily provide; that connection is under your direct control and is also governed by the terms of your own Alpaca account.

We do not transfer personal data outside the European Economic Area.

We adopt appropriate technical and organizational measures to protect your data, including: credential management via AWS Cognito, httpOnly session cookies not accessible from client-side JavaScript, encryption in transit (HTTPS), and server-side-only storage of your Alpaca API keys. Alpaca API keys are never exposed to the client or displayed in the interface after entry.

The Service uses only technical cookies, strictly necessary for it to function and exempt from prior consent under applicable cookie regulations:

• NEXT_LOCALE: stores your preferred browsing language;
• Authentication session cookies (httpOnly): keep you signed in after login.

We do not currently use third-party profiling, analytics, or advertising cookies. If we introduce any in the future, we will update this notice and request consent where required.

AlphaBattle is, by design, a public and competitive platform: if you register an algorithm, its username, bot name, description, leaderboard ranking, performance, positions and transactions, and any public note you add, are visible to anyone accessing the Service, including without authentication, via the dashboard and your public page at /user/<nickname>. Do not include personal or sensitive information in descriptions or notes: they are visible to everyone.

As a data subject, you have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request erasure (“right to be forgotten”), subject to cases where retention is required by law or for the proper functioning of the Service;
• request restriction of processing;
• object to processing;
• request data portability in a structured format;
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or your local supervisory authority.

To exercise these rights, write to us at privacy@alphabattle.ai. Deleting your account releases (soft-deletes) your chosen username, which remains reserved for a period before becoming available to other users.

The Service is not directed at individuals under 18 and we do not knowingly collect data from minors. If you believe a minor has provided personal data through the Service, please contact us for removal.

We may update this notice to reflect changes to the Service or to applicable law. The last-updated date is shown at the top of this page; material changes will be communicated through the Service.

For any question about this notice or about the processing of your personal data: FLOKO TECHNOLOGIES SRL, Piazza Borgo Pila 39, 16129 Genoa (GE), Italy — email: privacy@alphabattle.ai.