Privacy Policy

Protecting your private information is our priority. This Privacy Policy applies to https://aimvolatilitylab.com (the "Service"), operated by Bao Research ("we", "us", "our"), based in Minnesota, United States. It describes what personal data we collect, how we use and protect it, and the rights and choices you have.

By using the Service, you consent to the data practices described in this policy. If you do not agree with these practices, please do not use the Service.

Account information: your email address, an optional display name, and — for password accounts — a securely hashed password. We never store your password in plain text.

Billing information: if you purchase a subscription, checkout is handled by our payment processor, Stripe, on its own secure, PCI-compliant pages. We receive your plan, subscription status, and payment history — full card numbers never touch our servers.

Usage data: the portfolios, positions, watchlists, backtests, presets, and journal entries you create; the features you use; and diagnostic logs we use to keep the Service fast and reliable.

Technical data: IP address, browser type and version, device information, access times, and referring website addresses — collected automatically to operate the Service, maintain quality, and protect against abuse.

We do not collect personal information unless you voluntarily provide it — for example, by registering for an account, purchasing a subscription, or contacting us.

To provide, operate, maintain, and improve the Service and the features you have requested.

To manage your account, process transactions, and deliver alerts and reports you configure.

To communicate with you about support requests, security notices, and important changes to the Service.

To send you product updates and offers related to the Service. You can opt out of marketing emails at any time using the unsubscribe link in any such email.

To analyze aggregate, anonymized usage patterns so we can prioritize the features that matter most. We never analyze or share your personal trading results.

Essential cookies and browser storage: used to keep you signed in and remember your preferences. These are strictly necessary and do not require consent.

Analytics: we use cookieless, privacy-friendly analytics to understand aggregate site usage. No analytics cookies are placed on your device and no cross-site profile is built about you.

Advertising and marketing cookies: if we run advertising campaigns (for example, Google or Meta), related tags and pixels fire only after you give consent through the cookie banner on our site. You can accept, decline, or customize these categories, and you can change or withdraw your consent at any time via the banner’s preferences.

The consent banner is provided by our consent management platform and adapts to the privacy laws of your region (including GDPR and US state privacy laws).

We do not sell, rent, or lease your personal information to third parties.

We share data only with vetted service providers who help us run the Service: Stripe (payments), Resend (transactional email delivery), market-data providers (price feeds), our hosting infrastructure, and our consent management platform. These providers are contractually prohibited from using your information for any purpose other than providing their service to us and are required to keep it confidential.

We may disclose personal information without notice if required to do so by law, or in the good-faith belief that such action is necessary to comply with legal process, protect and defend our rights or property, or protect the personal safety of users of the Service or the public.

We may contact you by email with account confirmations, alerts you configure, security notices, product announcements, and occasional offers. To improve our emails, we may receive a notification when an email is opened or a link in it is clicked.

You can stop receiving marketing or promotional email at any time by clicking the unsubscribe link included in every such message. Transactional emails (such as password resets and billing receipts) are sent as needed to operate your account.

We keep your account and usage data while your account is active. You can delete your account at any time from Settings → Account inside the app; your personal data is then erased, and billing records are anonymized and retained only as long as tax and accounting law requires.

We may retain limited information where necessary to complete a transaction you requested, detect and prevent fraud or abuse, debug errors, comply with a legal obligation, or as otherwise permitted by applicable law.

We protect your data with encryption in transit (HTTPS/TLS), hashed passwords, scoped access controls, rate limiting, and regular security reviews.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security, and you acknowledge that you provide information at your own risk.

Depending on where you live — including under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Minnesota Consumer Data Privacy Act, and similar laws — you may have the right to know what personal data we hold about you, and to access, correct, export, delete, or restrict the use of that data.

You can exercise most rights directly in the app (Settings → Account → Export my data / Delete my account). For anything else, contact us using the details below; we may ask you to verify your identity before acting on a request. We will respond in accordance with applicable law.

If you are in the EU or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.

The Service is operated from the United States. If you access it from outside the US, your information will be transferred to and processed in the US, where data-protection laws may differ from those in your jurisdiction. Where required, our processors rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is intended for adults and is not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

The Service may contain links to other websites. We are not responsible for the content or privacy practices of those sites, and we encourage you to read the privacy statement of any site that collects personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by a prominent notice on the Service and/or by email to the address on your account, and we will update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Questions or concerns about this Privacy Policy? Reach us through our Contact page.

Bao Research · Minnesota, United States