GDPR / UK GDPR Privacy Notice

This notice supplements our Privacy Policy with information required for data subjects in the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland. It reflects AlphaSmith, Inc. [legal entity TBD]’s obligations under the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, and the UK Data Protection Act 2018. Effective date: April 17, 2026.

Controller

For personal data processed through our Services, the Controller is AlphaSmith, Inc. You may contact us at privacy@alphasmith.ai. Our EU representative and UK representative will be designated where required [TBD: counsel input].

Data protection officer

A Data Protection Officer has not been formally designated at this time [to be appointed]. Privacy inquiries and data-subject requests are handled by the team reachable at privacy@alphasmith.ai.

Categories of personal data

The categories of personal data we process are described in our Privacy Policy and include account information, portfolio and trading information, billing information, usage information, and communications.

Lawful bases for processing

• Performance of a contract (Article 6(1)(b)) — to provide the Services you request, manage your account, and process payments.
• Legitimate interests (Article 6(1)(f)) — to secure the Services, prevent fraud, improve our products, and perform aggregate analytics. We balance these interests against your rights.
• Legal obligation (Article 6(1)(c)) — to comply with tax, accounting, and lawful-request obligations.
• Consent (Article 6(1)(a)) — for optional analytics cookies and certain marketing communications, where required. You may withdraw consent at any time.

Recipients of personal data

We share personal data with service providers and partners, as described in our Privacy Policy. For business customers, our Data Processing Addendum lists sub-processors.

International data transfers

Personal data is processed in the United States. Where we transfer data out of the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum as appropriate, together with supplementary measures. You may request a copy of the transfer mechanism by contacting privacy@alphasmith.ai.

Retention

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Details are described in our Privacy Policy.

Your rights

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure (the “right to be forgotten”), subject to legal retention obligations.
• Right to restriction of processing.
• Right to data portability for data you provided to us.
• Right to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent at any time, where consent is relied upon.
• Right not to be subject to solely automated decisions with legal or similarly significant effects.

To exercise these rights, email privacy@alphasmith.ai.

Supervisory authority

You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EEA, it is the data-protection authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

Automated decision-making

The Services include automated analytics and AI-generated predictions for informational purposes. These do not produce legal or similarly significant effects on you. The Services do not execute trades on your behalf; any investment or order decision is yours alone and is effected through the broker you independently choose.