This Privacy Policy (“Policy”) describes how Loculus (“Loculus”, “we”, “our”, or “us”) collects, uses, stores, and shares personal data when you access or use our website, applications, and related tools, services, features, and functionalities (collectively, the “Services”).
Loculus operates an agentic trading marketplace: a non-custodial software interface through which users may discover automated trading strategies (“Agents”) published by third-party creators (“Creators”) and authorize such Agents to execute trades through the user’s own account on supported third-party trading venues.
For the purposes of applicable data protection laws, Loculus acts as the data controller. References to “you” or “your” mean you as a user of the Services.
Please read this Policy carefully to understand how we process your personal data and what rights you have. If you do not agree with this Policy, you should not access or use the Services.
1. Personal Data We Collect, Why We Collect It, and Legal Basis
A. Information You Provide to Us
This may include:
- Basic account information (such as name, email address, profile image) when you sign up or log in using third-party authentication providers (e.g. Google);
- Wallet addresses and related public blockchain identifiers you choose to connect;
- Third-party trading venue account identifiers you choose to link to the Services (e.g. your Yellow.pro account reference); we do not collect your venue passwords or private keys;
- Agent selections, activation instructions, and risk parameters you configure;
- If you are a Creator: profile information, Agent descriptions, and content you publish to the marketplace;
- Competition registrations and related information where you choose to participate;
- Communications you send to us (e.g. support requests or feedback).
We process this information to:
- Create and manage your account;
- Provide and operate the Services, including connecting Agents to your linked venue account under your instructions;
- Operate the Creator marketplace and display Creator content;
- Administer competitions and reward programs you enter;
- Perform our contract with you;
- Respond to inquiries and support requests.
Legal basis: performance of a contract; legitimate interests.
B. Trading and Performance Data
When you link a venue account and/or activate an Agent, we may process:
- Account performance data made available by the connected venue (such as portfolio value, positions, trade history, PnL, fees paid);
- Agent activity data (which Agents you activate, when, and with what parameters);
- Derived performance metrics, rankings, and statistics.
We process this data to:
- Operate the core functionality of the Services (Agent execution monitoring, performance display, Creator compensation calculation);
- Compile leaderboards, rankings, and benchmarking metrics;
- Administer competitions, determine results, and distribute rewards;
- Detect and prevent manipulation, wash trading, and abuse.
Public display: Leaderboards and competition results display performance information associated with a username or display name chosen by you, or a partially masked wallet/account identifier. We do not display legal names or full account identifiers. Where you can choose a display name, you control how identifiable you are.
Legal basis: performance of a contract; legitimate interests (marketplace integrity, fraud prevention); consent where required for public display in identifiable form.
C. Information We Collect Automatically
When you access or use the Services, we may automatically collect:
- IP address;
- Date and time of access;
- Device, browser, operating system, and user-agent information;
- Language and general location (country-level);
- Usage and interaction data (pages visited, features used, session duration);
- API requests and technical logs.
This data is processed to:
- Enable access to and operation of the Services;
- Maintain security, stability, and fraud prevention;
- Monitor performance, debug issues, and optimize functionality;
- Conduct analytics and internal statistical analysis.
Legal basis: legitimate interests; in some cases, legal obligations.
D. AI and Behavioral Data
When you interact with Loculus’ AI-powered features, we may process:
- AI interaction data (such as prompts, preferences, and feature usage);
- Behavioral signals related to platform usage.
This data is used to:
- Provide AI-driven features and user experience;
- Improve the Services and user experience;
- Generate aggregated, anonymized, or de-identified analytics.
Any improvement or analytics processes are conducted on anonymized or aggregated data where possible.
Legal basis: legitimate interests and, where required, your consent.
E. Automated Execution (Important)
The core function of the Services involves automation: when you activate an Agent, that Agent executes trades on your linked venue account automatically, without per-trade human review, within the parameters you set.
This automated execution:
- occurs only on the basis of your explicit activation instruction, which you may withdraw (deactivate) at any time with prospective effect;
- is driven primarily by market data and the Agent’s strategy logic, operating within your chosen parameters;
- can have significant financial effects, which is why activation requires your explicit and informed authorization.
Where such processing constitutes automated decision-making under applicable law (including Art. 22 GDPR), it is carried out on the basis of your explicit consent and/or because it is necessary for the performance of the contract between you and Loculus. You have the right to withdraw your authorization at any time by deactivating the relevant Agent, and to contact us to express your point of view or contest the operation of the Services using the details below.
Legal basis: performance of a contract; explicit consent.
F. Blockchain and Wallet Data
Certain Services may require you to connect a third-party wallet. When you do so, we may process:
- Public wallet addresses;
- Public transaction metadata relevant to the Services.
We do not control or store private keys and do not access wallet credentials. Please note that public blockchain data is, by design, public and immutable; we cannot alter or erase data recorded on a blockchain.
Use of third-party wallets is governed by the privacy policies and terms of those wallet providers. Loculus is not responsible for their practices.
Legal basis: performance of a contract; legitimate interests.
2. How We Use Your Data
We use personal data to:
- Provide, operate, and maintain the Services;
- Execute your Agent activation instructions and monitor Agent activity;
- Operate the Creator marketplace, including calculating any Creator compensation;
- Compile and display leaderboards, rankings, and competition results;
- Detect and prevent fraud, manipulation, and abuse (including wash trading and multi-accounting);
- Personalize features, content, and user experience;
- Improve platform security and reliability;
- Comply with legal obligations;
- Enforce our Terms of Service and protect our rights.
We may also create aggregated or anonymized datasets that no longer identify you.
3. Cookies and Tracking Technologies
We may use cookies and similar technologies to:
- Enable core functionality;
- Analyze usage and performance;
- Improve user experience.
Where required by law, cookies will be subject to your consent.
4. Sharing of Personal Data
We may share your personal data in limited circumstances, including:
- Connected trading venues: to operate the Services, we may exchange data with the venue you link (e.g. transmitting Agent instructions you authorized; receiving your account performance data). The venue processes your data under its own privacy policy;
- Creators: Creators receive only aggregated or statistical information about the use and performance of their Agents. We do not share your identity or individual account details with Creators;
- Service providers and vendors (e.g. hosting, analytics, cloud infrastructure, AI infrastructure providers);
- Professional advisors (legal, accounting, security);
- Regulators or authorities, where required by law;
- Affiliates, where applicable and in our legitimate interests;
- Business transactions, such as mergers or restructurings.
We do not sell your personal data.
5. International Data Transfers
Your data may be processed in countries outside your country of residence, including outside the EEA or UK.
Where required, we implement appropriate safeguards, such as:
- Standard Contractual Clauses (SCCs);
- Other legally recognized transfer mechanisms.
6. Data Retention
We retain personal data only for as long as necessary to:
- Provide the Services;
- Maintain records of Agent authorizations, trading activity, and competition results for dispute resolution and integrity purposes;
- Fulfill legal or regulatory obligations;
- Resolve disputes or enforce agreements.
Retention periods depend on data type and purpose.
7. Your Rights
Depending on your location, you may have rights to:
- Access your personal data;
- Correct inaccurate data;
- Request deletion;
- Object to processing;
- Restrict processing;
- Data portability;
- Withdraw consent (including deactivating any Agent at any time);
- Lodge a complaint with a supervisory authority.
Requests can be made using the contact details below. We may need to verify your identity.
Please note: deletion rights do not extend to data recorded on public blockchains, which we do not control, and certain trading records may be retained where required for legal, regulatory, or dispute-resolution purposes.
8. Children’s Privacy
The Services are not intended for individuals under the age of 18.
We do not knowingly collect personal data from children.
9. Security
We implement reasonable technical and organizational measures to protect personal data.
However, no system can guarantee absolute security, and use of the Services is at your own risk.
10. Third-Party Links and Services
The Services may contain links to third-party websites or tools.
We are not responsible for their privacy practices or content.
11. Updates to This Policy
We may update this Policy from time to time.
Material changes will be reflected by updating the “Last Revised” date and, where appropriate, notified within the Services.
12. Contact
For questions or requests regarding this Policy or your personal data, contact us at:
support@loculus.xyz