
We are Squadron Technologies Ltd ("Squadron Technologies," "we," "our" or "us"). We respect your privacy and are committed to protecting the confidentiality of the information you provide to us. This Privacy Policy outlines how we handle your Personal data when you use our services on our MarketAlpha.ai websites and the MarketAlpha platform ("Website" and "Platform"). It is intended to help you understand your rights and how we use your data.
Squadron Technologies Ltd is the data controller responsible for your Personal data. We are the sole owner of the MarketAlpha.ai website ("Website"). This Privacy Policy applies to the Personal data we collect when you visit our Website, create an account, or use our applications or services ("you" or "your"). This policy details the types of Personal data we collect, the reasons for collecting it, the lawful basis for processing your Personal data, how we use and store it, and the ways in which we share this information.
EU representative (Article 27): We do not currently appoint an EU representative because we do not currently offer goods or services to, or monitor the behaviour of, individuals in the EEA in a way that triggers Article 3(2) GDPR. We periodically reassess this position and will appoint an EU representative and update this Privacy Policy if our launch, customer base, activities, or targeting change such that Article 27 applies.
"Personal data" refers to any information that relates to you and can directly or indirectly identify you.
This Privacy Policy explains how we collect, use, store, share, and protect your Personal data when you use our Website or Services. If you do not agree with our practices, you should stop using the Website and, where applicable, delete your account.
We may update this Privacy Policy from time to time by posting an updated version on our Website. If we make a material change to how we process Personal data, we will update the “Last Updated” date and, where required by applicable law or where appropriate in the circumstances, provide additional notice such as by email, in-app message, or website notice before the change takes effect.
We collect Personal data from you when you interact with our Platform, including but not limited to:
Analytics runs only if you consent. When enabled, we collect pseudonymous usage and performance data (not tied to your account and not used for advertising or profile building). We also implement consent controls (including Google Consent Mode and our own blocking/unloading logic) so analytics is off when you select Essential or Reject All. We collect only pseudonymous Personal data, ensuring that no PII is included in our analytics reports. This data is used to analyse and enhance our services and applications, as well as for ongoing development and testing. We utilize both internal analytics tools and third-party service providers to achieve these purposes.
We use Google Analytics (GA4) and Mouseflow. If you choose Essential or Reject All, we disable Google Analytics (no cookies, no hits) and block or unload Mouseflow and delete its cookies. When enabled, analytics is pseudonymous and is not linked to your account or used for targeted advertising or profile building.
Mouseflow is a website analytics tool that provides session replay, heatmaps, funnels, form analytics, feedback surveys, and similar features/functionality. Mouseflow may record your clicks, mouse movements, scrolling, form fills (keystrokes) in non-excluded fields, pages visited and content, time on site, browser, operating system, device type (desktop/tablet/phone), screen resolution, visitor type (first time/returning), referrer, anonymized IP address, location (city/country), language, and similar meta data. Mouseflow does not collect any information on pages where it is not installed, nor does it track or collect information outside your web browser. We configure Mouseflow to mask keystrokes and to exclude fields likely to contain personal or sensitive information, including password fields, authentication fields, checkout and payment fields, support or contact free-text fields, and similar user-input fields that may contain personal data. We do not intentionally use Mouseflow to capture payment card data, passwords, or the contents of private communications. If you'd like to opt-out, you can do so at https://mouseflow.com/opt-out. If you'd like to obtain a copy of your data, make a correction, or have it erased, please contact us first or, as a secondary option, contact Mouseflow at privacy@mouseflow.com.
Mouseflow only runs if you consent to analytics in our cookie banner; switching to Essential or Reject All stops/unloads Mouseflow and removes its cookies.
We use AWS CloudFront and AWS Web Application Firewall (WAF) to protect our services from malicious activity. These services process network data such as IP address, request time, URLs, user-agent and other request headers solely for security and fraud-prevention purposes.
Lawful basis: our legitimate interests in keeping the service secure and available (Art. 6(1)(f) GDPR/UK GDPR). Retention: security and WAF logs are normally retained for 30 days. Where logs are reasonably required for a specific and documented security, fraud, abuse, or legal investigation, relevant records may be retained for up to 12 months, after which they are deleted or de-identified unless a longer retention period is required by law or an active dispute. Location and safeguards: logs are stored with AWS under appropriate transfer safeguards (e.g., Standard Contractual Clauses / Data Privacy Framework where applicable), access-restricted, and never used for marketing or profiling.
When you make or change a cookie choice, we create a server-side record to demonstrate compliance and troubleshoot consent issues. This record includes: a consent receipt ID (ccid), your choice (Reject All / Essential / Accept All), banner and policy versions, MarketAlpha site, whether the small or main box was used, browser/OS, derived country, client and server timestamps, and a pseudonymised IP network prefix. The raw IP is discarded immediately. These records are stored separately from security/WAF logs, are encrypted and access-restricted, and are retained for up to 6 months before deletion.
When you proceed past the Terms screen or accept program/feature terms (e.g., Referral Rewards Terms or Ambassador Program Terms), we create a server-side record to evidence contract formation. This record includes a timestamp, your email, internal and authentication identifiers, the policy/version shown, site context, and a truncated IP address (network prefix). Raw IPs are not stored in this record (though they may appear temporarily in security/WAF logs described above). Where you have a paid relationship, we also store your payment customer reference (e.g., Stripe customer ID). We do not store payment card details. For Ambassadors, we also create an audit record when you add or change your Payout Link (for example, timestamps and account identifiers) and we send a notification email on each add/change.
In hosted checkout flows, our record includes the timestamp, your email (or billing reference), and the policy/version shown. Stripe processes network data under its own privacy policy.
We process your Personal data for the following purposes:
We process your Personal data under the following lawful bases as defined by the UK GDPR:
How this applies here: platform essential cookies and security/WAF logging rely on contractual necessity and our legitimate interests in security and service integrity; analytics cookies rely on your consent; preference and consent-receipt records rely on our legitimate interests in demonstrating and managing consent. For direct electronic marketing to individuals, we rely on consent and use double opt-in, except where an equivalent lawful exception expressly applies under applicable law. Unsubscribing from marketing does not affect transactional or service emails. Discord role verification and community moderation rely on contractual necessity (where tied to subscriber benefits) and our legitimate interests in community administration and safety.
In addition, maintaining a minimal audit trail of your Terms acceptance (timestamp, user IDs, version shown, and pseudonymised IP prefix) relies on our legitimate interests in establishing, exercising or defending legal claims and in service integrity.
In the hosted checkout flow (Stripe Checkout), our evidence record may not include an IP address; maintaining a non-IP audit trail that references Stripe’s records relies on our legitimate interests in establishing, exercising or defending legal claims.
For billing administration using Stripe dashboard records (contact, billing address, subscription/invoice activity and limited payment-method metadata), we rely on contractual necessity and our legitimate interests in accurate billing and fraud-prevention; Stripe processes certain data under its own lawful bases as an independent controller.
For Ambassador payouts, we process your Payout Link under contractual necessity (to perform the Ambassador Program) and our legitimate interests in fraud-prevention and account security (including sending change-notification emails).
Transactional/service emails sent via Amazon SES (for example, verification, password reset, login alerts, billing and security notices) are processed under contractual necessity and our legitimate interests in keeping your account secure and informing you about important service-related changes.
We implement robust technical and organizational measures to protect your Personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
Despite our efforts, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we continuously work to ensure that your Personal data is protected to the highest possible standard.
If we become aware of a Personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and, where required by law, inform affected individuals without undue delay.
Our services are not intended for children under 18 years of age, and we do not knowingly collect Personal data from children. If you believe we have inadvertently collected such data, please contact us immediately. We do not process sensitive Personal data as defined by UK GDPR Article 9, such as data concerning health, race, religion, or sexual orientation. If such data is inadvertently collected, please contact us and we will take immediate steps to delete it.
Our Platform may contain links to third-party websites. These sites operate independently of us and have their own privacy policies. We are not responsible for the content or privacy practices of these linked sites. We recommend that you review the privacy policies of any third-party sites you visit.
You have the option to stop using our Platform and request the deletion of your account through the Account Settings page. Upon your confirmation, your account will be permanently deleted. This process includes the removal of the Personal data we hold in your core account profile, where we are not required to keep it for legal or security reasons.
However, certain records and contributions cannot be fully removed where they are integral to the platform's operation or have already been shared with others. For example, custom metrics and screener profiles developed or configured with you (including versions you have shared with other users), internal logs and audit records, and discussions in our external community spaces (such as Discord) may continue to exist after account deletion.
For on-platform assets we control, we will, where feasible, detach or pseudonymise your personal identifiers while preserving the underlying feature for other users. Content hosted by third parties (such as Discord) is governed by their own tools and policies, and you may need to manage or delete it separately within those services.
If you are located in the European Economic Area (EEA) or the United Kingdom (UK), you have certain rights regarding your Personal data under applicable data protection laws:
You may request a copy of your cookie consent record and Terms/EULA acceptance record; we will provide the timestamp, version, and identifiers stored with the record. To exercise your rights, please contact us at support@marketalpha.ai. We may need to verify your identity before processing your request. We will respond to legitimate requests without undue delay and, in any event, within one month of receipt. If your request is complex or you have made multiple requests, we may extend that period where permitted by law, in which case we will inform you within the initial one-month period.
For payment data Stripe controls (e.g., card details and fraud signals), you may also exercise your rights directly with Stripe via its privacy policy; if you contact us, we will help route your request.
If you remain unhappy, you can lodge a complaint with the UK Information Commissioner’s Office (ICO). See the ICO’s guidance on how to complain. If you are in the EEA, you may also complain to your local supervisory authority.
We retain your Personal data only for as long as necessary to fulfil the purposes for which it was collected, including:
Once your data is no longer needed, we will either delete it or anonymize it, ensuring it cannot be linked back to you.
For clarity, our main retention periods and criteria are as follows:
Additional retention details: consent preference and receipt cookies are kept for up to 6 months; security/WAF logs are retained for 30 days. Analytics retention: Google Analytics (GA4) user and event data retention is set to 2 months. Session analytics (Mouseflow) session data is retained for 3 months. Aggregated, non-personal reports may be retained longer for trend analysis.
Sign-up requests that do not result in an active account or subscription are kept for up to 12 months for troubleshooting, security, and anti-fraud purposes, then deleted.
Terms acceptance records are retained for the life of your account and up to 6 years after closure to establish or defend legal claims. Account security entries (signup/login timestamps and IPs): retained for the life of your account and up to 12 months after closure to investigate fraud and security issues, then deleted.
We keep references to your billing profile (e.g., Stripe customer ID and default payment-method identifier) for the life of your account and up to 6 years thereafter for accounting; Stripe retains payment-method metadata and billing records under its own retention policy.
Referral attribution metadata (referral codes and reward redemptions recorded in Stripe) is retained for the life of your account and up to 6 years thereafter for accounting and fraud-prevention purposes.
Ambassador Payout Links are retained while you participate in the Ambassador Program and for up to 6 years after your last payout or account closure (whichever is later) for accounting, tax, and fraud-prevention purposes. Payout-link change audit entries may be retained for up to 12 months after closure (and longer if tied to a security investigation).
Transactional email delivery logs (SES), which contain technical message metadata (such as recipient address, timestamps, subject line, and delivery/bounce/complaint status but not email content), are retained for 30 days (and up to 90 days in case of delivery troubleshooting), then deleted. Marketing subscription, unsubscribe and consent records are retained by Mailchimp for as long as we maintain our mailing list to demonstrate consent; we keep suppressed/unsubscribed addresses to honor opt-out requests.
Discord verification DMs: reviewed and deleted within 30 days of role assignment. Internal Discord access/audit records (Discord user ID, role, timestamps) are retained for the life of your subscription and up to 12 months after closure to investigate abuse, then deleted.
Unless stated otherwise above, operational logs that may include IP addresses are retained for 30 days (extendable up to 12 months if tied to a security investigation) and are then deleted.
Platform security logs: retained for 90 days, and where linked to a specific security or abuse investigation, up to 12 months, after which they are deleted or de-identified.
Your Personal data may be transferred to, and stored in, countries outside the European Economic Area (EEA) or the United Kingdom (UK), including the United States. These countries may have different data protection standards compared to your home country.
We ensure that all international transfers of your Personal data are protected by appropriate safeguards, such as:
Our main third-party providers for the activities described in this Privacy Policy include Amazon Web Services (hosting, infrastructure, and WAF), Amazon SES (transactional email delivery), Stripe (payments and billing), Intuit Mailchimp (email marketing), Google (analytics, where consented), Mouseflow (session analytics, where consented), Algolia (help-center search), and Discord (community hosting, if you choose to participate). Where Personal data is transferred outside the UK or EEA, we rely on an appropriate lawful transfer mechanism, which may include adequacy regulations, the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or an applicable Data Privacy Framework arrangement. You may contact us for further information about the safeguards relevant to a particular provider.
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):
Full name of legal entity:
Questions? Email support@marketalpha.ai or write to: Harben House Harben Parade, Finchley Road, London, United Kingdom, NW3 6LH.
If you have any questions or concerns about how we handle your personal data, we would really appreciate the opportunity to resolve them directly. Please do not hesitate to get in touch with us and we will do our best to help.