Privacy Policy · AgentHC

1. Overview

This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices you have. It covers:

this website, app.traderhc.com (accounts, subscriptions, alerts, the daily brief and the Ask AgentHC tool);
the public developer API at api.traderhc.com; and
the AgentHC Discord server, where our bot collects market-data agreement records.

The newsletter at www.traderhc.com / traderhc.substack.com is hosted, emailed and billed by Substack. Substack collects and handles subscriber information there under its own privacy policy; that site is not covered by this Policy.

By using the Service you agree to this Policy and to our Terms of Service.

2. Information we collect

Account and sign-in information (this website)

Email address: used to create your account, to sign you in (a one-time emailed link, or Discord sign-in), to match an existing paid subscription to your account, and to email you one-time sign-in links (including the link we send after a purchase so you can reach your account) and a confirmation of a purchase (the plan, the amount charged, the renewal terms and how to cancel).
Discord information, only if you choose "Continue with Discord": your Discord user ID, your Discord display name, and the verified email address on your Discord account. We request only the Discord permissions "identify" and "email".
Subscription plan (Free or Pro) and your Stripe customer identifier.
Eligibility attestation: your confirmation, required on the sign-in form and on the checkout form, that you are a United States resident and at least 18 years old, recorded with its version, the date and time, and the IP address it came from.
Agreement records: for each agreement or notice you accept (the advisory and risk terms, the OPRA non-professional data agreement, and the Terms and Privacy Policy notice on the sign-in form), the document version, the date and time, and the IP address recorded at acceptance.
Checkout agreement: when you start a purchase you must tick a box agreeing to the Terms of Service and this Policy and authorising the recurring charge. We record that agreement with the Terms version, the date and time, the IP address it came from, the plan, price and billing term you chose, and the Stripe checkout reference. If you start a purchase without being signed in, this record (and your eligibility confirmation, which is also required there) is kept under the Stripe checkout reference and attached to your account when the payment completes; if the purchase is not completed, it is deleted automatically after 30 days. We also keep, against the Stripe checkout reference, a note of whether the confirmation email and the sign-in email for that purchase were sent, so that neither is sent twice.
Preferences: the notification toggles and the watchlist symbols you save in your alert settings.
Sign-in sessions: when each session was created, when it expires and when it was last used. The session token itself is stored only as a SHA-256 hash.

OPRA non-professional subscriber information (website and Discord)

To provide live OPRA-derived market data (real-time NBBO bid/ask and live Greeks/implied volatility), the OPRA Subscriber Agreement (Form B-1) requires us to collect and keep subscriber identifying information: your full legal name, street address, city, state and postal code, country, and email address, together with your non-professional attestation. We collect this in two places, and each keeps its own record:

on this website, on the agreement forms in your account and on the alerts page; and
in our Discord server, when you run the /agreement command and submit the form the bot opens. The Discord record also holds your Discord user ID and username and the date and time you agreed.

This information is used only to administer market-data entitlements and to meet OPRA/exchange recordkeeping requirements. We do not use it for marketing.

Billing information

Payments for Pro are made on a checkout page hosted by Stripe. Stripe collects your payment card details, name and billing email; we never receive or store card numbers. We send Stripe the plan and billing term you chose, the versions of the Terms and of this Policy that you agreed to at checkout and, if you are signed in, your AgentHC account ID and email address. Stripe sends us your email address, your Stripe customer identifier, and the status of your subscription. When you sign in with a verified email address we also ask Stripe whether that address has an active subscription, including a paid Substack subscription that is billed through our Stripe account, so that paid access carries over.

Questions you type into Ask AgentHC

Ask AgentHC answers are written by an AI language model. The question you type (up to 500 characters) is sent from this website to our own API and from there to our AI model provider, which generates the answer. The website does not save your questions or the answers to your account. Our API holds each question in a temporary processing queue while the answer is produced. Please do not include personal information in a question.

Public developer API (api.traderhc.com)

If you or your software register for or use the API, it stores:

Agent record: the agent name and description you supply, an optional callback URL, an optional owner contact, an optional Lightning address, your tier, the dates the record was created and last used, and usage and payment totals. API keys are stored only as SHA-256 hashes.
Rate-limit counters keyed by API key or, for anonymous and registration requests, by IP address.
Lightning payment records: for each paid invoice, the payment hash, the amount in satoshis, the settlement time, the invoice memo and the API module it paid for. Lightning payments are received by a node we operate ourselves; we do not receive your name or a card number with a Lightning payment.

Usage and device information

Our web server keeps a standard access log of each request: IP address, browser user-agent, the page requested, and the time. We also keep simple first-party counts of visits to the main steps of the site (home, pricing, sign-in, checkout). Those counts record the step and the page path only: no IP address, no email address, no account ID and no cookie or other identifier.

We do not use any third-party analytics, advertising tag, tracking pixel or session replay tool on this website, and no script from another company is loaded on any page.

We do not sell your personal information.

3. How we use information

operate, secure, and improve the Service and your account;
authenticate you and keep you signed in;
process subscriptions and recurring billing through Stripe, and recognise an existing paid subscription when you sign in;
grant and remove the Discord roles that go with your plan and your OPRA agreement status, if you signed in with Discord;
provide live OPRA-derived market data under the OPRA non-professional agreement and administer market-data entitlements;
answer the questions you put to Ask AgentHC;
send transactional email (one-time sign-in links and purchase confirmations);
operate, meter and rate-limit the public API and account for Lightning payments;
maintain compliance and recordkeeping (eligibility attestations, agreement versions, and acceptance timestamps); and
comply with law and enforce our Terms.

We do not send marketing or newsletter email from this website. The newsletter is sent by Substack to people who subscribe on Substack.

4. Third-party processors and sharing

We share personal information with the service providers below, only as needed to provide the Service:

Recipient	Purpose	Data involved
Stripe	Hosted checkout, subscription billing, billing portal	Email, name and payment method (entered on Stripe's page), plan and billing term, the Terms and Privacy Policy versions agreed to at checkout, your AgentHC account ID, subscription status. When you cancel or resume a subscription on the Billing page we send Stripe that instruction.
Brevo	Sending the one-time sign-in link email and the purchase confirmation email	Your email address and the content of those emails (the confirmation states your plan, the amount charged and the renewal and cancellation terms)
Discord	Optional sign-in; granting and removing member roles; the /agreement form in our Discord server	Discord gives us your Discord user ID, display name and verified email; we send Discord your Discord user ID to set roles; what you type into the bot's form passes through Discord
xAI (AI model provider)	Generating Ask AgentHC answers and the AI-written commentary on the site	The text of the question you type into Ask AgentHC
DigitalOcean (hosting)	The servers that run this website, the API, our databases and logs	Everything described in section 2, stored on servers we control
OPRA / options exchanges / our market-data vendor	Market-data entitlement administration and audits under the OPRA agreement	Non-professional subscriber name, address, email and attestation, when they require it

Substack is not on this list because we do not send it your information: you give your email address to Substack directly if you subscribe to the newsletter there. We may also disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of users and the public. We do not sell personal information.

5. Data retention

These are the retention rules our systems apply:

Data	How long it is kept
One-time sign-in links	Valid for 30 minutes and usable once. The record (which holds your email address) is deleted when the link is used; unused links are deleted after they expire, the next time anyone requests a sign-in link or the service restarts.
Sign-in sessions	30 days from sign-in (12 hours for administrator sessions), or until you log out, whichever comes first; then deleted.
Ask AgentHC questions	Not saved to your account. Held in our API's temporary processing queue for up to about one hour.
Web server access logs	14 days.
Server backups	The backup copies our own scheduled backup job makes are deleted after 7 days. Our hosting provider may also hold disk-level backups or snapshots of the server on its own schedule. Information you ask us to delete can remain in a backup until that backup is removed.
Account record, preferences, eligibility and agreement records	Kept while you have an account. We do not delete these automatically; we delete them when you ask us to (section 6), subject to the OPRA rule below.
API agent records, rate-limit counters and Lightning payment records	Not deleted automatically. To have an agent record removed, email us (section 6). Payment records are kept as financial records.

OPRA RETENTION Subscriber identifying information collected for OPRA market-data entitlements (name, address, email and your non-professional attestation, plus agreement versions and acceptance records), whether collected on this website or through the Discord /agreement command, is retained for a minimum of three (3) years to satisfy OPRA/exchange and applicable regulatory recordkeeping requirements, even if you close your account before that period ends. These records are not deleted automatically.

The website used to keep email addresses typed into its newsletter sign-up box as unconfirmed requests. That box has been removed, this website never emailed those addresses or added them to a mailing list, and the stored addresses are deleted automatically.

6. Your privacy rights and how to request deletion

Depending on where you live, you may have rights to access, correct, port, or delete your personal information, to opt out of certain processing, and to not be discriminated against for exercising these rights (for example under the California CCPA/CPRA). We honor verified requests to the extent the law requires.

To request deletion or a copy of your information, email privacy@traderhc.com from the email address on your account (for the API, tell us the agent name or API key prefix). We will verify that the request comes from you before acting on it. When we delete a website account we remove your account record, sign-in sessions, any unused sign-in links, your saved preferences and your agreement records, cancel or delete your Stripe customer record on request, and remove your Discord roles. The exception is described below.

DELETION vs. LEGAL HOLD Even where you request deletion, we may retain certain information when an exception applies, in particular information subject to a legal hold or to mandatory recordkeeping obligations. OPRA subscriber records and other records we are required to keep (for example for the OPRA three-year minimum, or while subject to litigation, audit, or regulatory hold) are not deleted until the retention period or hold ends. Payment records held by Stripe are kept by Stripe under its own obligations.

Newsletter. The newsletter is sent by Substack, not by this website. To stop receiving it, use the unsubscribe link in any newsletter email or your Substack account settings. The sign-in link emails this website sends are transactional and are sent only when a sign-in link is requested for your address or after a purchase made with it.

7. Cookies

These are all of the cookies this website sets:

Cookie	Purpose	When it is set	Lifetime
ahc_session	Strictly necessary. Keeps you signed in and binds form-security (CSRF) tokens to your session.	When you sign in	30 days (12 hours for administrator sessions); removed when you log out
ahc_oauth	Strictly necessary. Protects the Discord sign-in round trip against forgery.	When you start "Continue with Discord"	10 minutes; removed when the round trip completes

All of these are first-party cookies set with the HttpOnly and SameSite=Lax attributes and, on HTTPS, the Secure attribute. If you install the site as an app, your browser also stores a copy of the site's style sheet, scripts, font and icons so it loads faster; that storage holds no information about you.

We do not use advertising or cross-site tracking cookies, and no analytics cookie. Earlier versions of this site set two other cookies, "ahc_fsid" (an anonymous visit identifier) and "ahc_gclid" (a Google Ads click identifier). The site no longer sets or uses either one, and it tells your browser to delete them if they are still present.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information. Session tokens, sign-in link tokens and API keys are stored only as SHA-256 hashes, connections to the site use HTTPS, and payment card data is handled by Stripe rather than stored on our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is intended only for United States residents who are at least 18 years old. The sign-in form and the checkout form each require you to confirm this, and this website creates an account only through one of those two forms. An account that was created before this confirmation was required is asked for it before it can use the signed-in parts of the site. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has created an account or given us information, email privacy@traderhc.com. When we learn that an account belongs to a minor we close it and delete the information we hold about that person.

10. Changes to this Policy

We may update this Policy. When we do, we change the "Last updated" date and version at the top of this page. If you have an account, your account page shows a notice that the Policy has changed until you next sign in through the sign-in form or agree to the Policy on the checkout form; either one records that you continued under the new version. Your continued use after changes take effect constitutes acceptance of the updated Policy.

11. Contact

Questions or requests? Contact us at privacy@traderhc.com. Sky Manor Trading LLC, 13025 Fenway Blvd N, Suite 300, Hugo, MN 55038.