Legal
Privacy Policy
The data controller is A2GROUP LLC, a limited liability company organised under the laws of the State of Wyoming, United States, with its principal office at 5830 E 2nd St, Ste 7000 #16007, Casper, WY 82609, USA. This Privacy Policy explains how A2GROUP LLC (“we,” “our,” or “us”) collects, uses, shares, and protects your personal information when you use Cala Terminal — including our web application, desktop app, mobile apps, and TV apps (collectively, the “Platform”). By using the Platform, you agree to the practices described in this policy.
Contents
1. Information We Collect
1.1 Information You Provide Directly
When you create an account or use the Platform, we may collect:
- Account registration data: name, email address, and password (stored as a secure hash).
- Profile preferences: display settings, watchlist configuration, and dashboard layouts.
- Portfolio data: asset holdings and quantities you manually enter for portfolio analysis.
- Payment information: billing name, address, and payment card details — processed exclusively by our third-party payment processor (Stripe). We do not store raw card numbers.
- Support communications: messages or emails you send to our support team.
1.2 Information Collected Automatically
When you access the Platform, we automatically collect:
- Device and browser information: IP address, browser type, operating system, and device identifiers.
- Usage data: features used, time spent, click patterns, and error logs.
- AI interaction data: queries submitted to the AI assistant and tool execution logs (anonymized after 90 days).
- Session data: authentication tokens stored in secure cookies or local storage.
- Marketing attribution identifiers: when you reach the Platform from an advertisement or referral, we capture campaign identifiers — including the Google Ads click identifier (gclid), the Microsoft Ads click identifier (msclkid), and UTM parameters — together with the referring URL. We use these solely to measure which campaigns lead to subscriptions, and share them with Google Ads and Microsoft Advertising only to attribute conversions — never to identify you personally.
1.3 Information from Third Parties
If you sign in using a social login provider, we receive OAuth profile data (name and email).
1.4 Information from a connected brokerage or exchange account (optional)
If you choose to connect a brokerage or crypto exchange account, we receive from our aggregation provider, on a read-only basis:
- The name of the institution and the type, nickname and currency of each connected account, with the account number shown only as its last digits;
- Account balances, cash balance and total value;
- Position-level holdings: symbol, description, asset class, quantity, price, cost basis as reported by the institution, market value and open profit or loss;
- Transaction history for the account, such as trades, dividends, fees and transfers, with date, symbol, quantity, price, amount and fees;
- Daily account value history, used to display performance over time;
- Technical records of each synchronization (time, outcome, and any error), kept for support and reliability.
What we do not receive. We do not ask for, receive or store your brokerage or exchange username, password, PIN or multi-factor authentication codes. Those are entered in our aggregation provider’s own hosted portal and are not transmitted to us.
What we hold to keep the connection alive. We store a per-user access secret issued to us by the aggregation provider. It is encrypted at rest on our servers using AES-256-GCM with a key held outside the database, and it is never written to logs.
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Platform and its features.
- Personalize your experience, including AI memory that retains your preferences and portfolio context across sessions.
- Process payments and manage your subscription.
- Send transactional communications: account confirmations, password resets, billing receipts, and service alerts.
- Send marketing communications where permitted by law and only with your consent.
- Detect and prevent fraud, abuse, and unauthorized access.
- Screen accounts, names and payment details against sanctions and restricted-party lists, and block or terminate access where required, in order to comply with export-control and economic-sanctions law.
- Comply with applicable legal obligations, and establish, exercise or defend legal claims, including responding to payment disputes and chargebacks.
- Improve the quality, accuracy, and performance of the AI engine.
2.1 AI Memory and Personalization
Cala Terminal’s AI assistant maintains persistent memory of your preferences and portfolio context to improve response quality. You may reset or delete this memory at any time from your account settings. We do not use your personal data to train general-purpose AI models or share it with AI providers for training purposes.
4. Data Retention and Deletion
We retain your data for as long as your account is active or as needed to provide the Platform. Specifically:
- Account data: retained until account deletion plus 30 days.
- AI interaction logs: anonymized after 90 days, deleted after 2 years.
- Payment records: retained for 7 years for tax and accounting compliance.
- AI memory: retained until you manually reset it or delete your account.
- Connected-account data: retained while the connection is active. Position data is replaced in full on each synchronization rather than accumulated. When you disconnect, we instruct the aggregation provider to delete the authorization and we delete the accounts, positions, transaction history, value history and synchronization records associated with that connection. When you delete your account, any connection and all data synced through it are deleted with it.
- Diagnostic and crash data: retained on our providers’ standard schedules.
4.1 Deleting your account
You can delete your account from inside the app (Settings → Account → Delete Account) or by emailing contact@a2group.llc. When you delete your account we delete or irreversibly anonymize your profile, watchlists, conversation history and the per-user AI memory collection held with our model provider; we delete stored brokerage positions, balances and activity and remove the aggregation provider’s user record and its authorizations; and we cancel or revoke the subscription records we control. Some records are retained where law requires (for example billing and tax records) or in encrypted backups for a limited period before being overwritten.
4.2 Withdrawing consent
You can disconnect a brokerage connection, reset AI memory, and withdraw consent to non-essential cookies at any time, without affecting the lawfulness of processing before you withdrew it.
5. Your Rights and Choices
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated data.
- Portability: Request your data in a machine-readable format.
- Opt-out: Unsubscribe from marketing communications at any time via the link in any email or from account settings.
- AI memory reset: Clear your AI assistant’s persistent memory from account settings at any time.
To exercise any of these rights, contact us at contact@a2group.llc
6. Legal Bases (EEA and UK)
If you are in the European Economic Area or the United Kingdom, we process your personal data on the following bases:
- Creating and operating your account; delivering the features you subscribe to — Art. 6(1)(b), performance of our contract with you.
- Taking payment and managing your subscription — Art. 6(1)(b), and Art. 6(1)(c) for tax and accounting records.
- Retrieving and displaying data from a brokerage or exchange account you choose to connect — Art. 6(1)(b), because you request the connection, supported by your separate, explicit and granular consent under Art. 6(1)(a) given at the connection step, which you may withdraw at any time by disconnecting.
- Including your portfolio data in a prompt so AI answers reflect your holdings — Art. 6(1)(b), on the same consent basis as above.
- Crash reporting, diagnostics and service security — Art. 6(1)(f), our legitimate interest in a working, secure service.
- Product analytics and marketing measurement — Art. 6(1)(a), your consent.
- Screening against sanctions and restricted-party lists — Art. 6(1)(c), compliance with a legal obligation, and Art. 6(1)(f), our legitimate interest in not providing the Platform in breach of sanctions law.
- Responding to legal obligations and defending legal claims — Art. 6(1)(c) and Art. 6(1)(f).
Automated decision-making. The Platform generates AI analysis about markets and about your portfolio. It is designed not to issue personalized instructions to buy or sell, and it produces no decision that has a legal or similarly significant effect on you. It does not determine credit, eligibility, pricing, or access to any product. On that basis we do not consider it automated decision-making within Art. 22. You can always ask us to review any AI output at contact@a2group.llc.
Your rights under Arts. 15–22 — access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — are exercised by contacting contact@a2group.llc. You may complain to your supervisory authority; in Spain, the Agencia Española de Protección de Datos (AEPD), and in the UK, the Information Commissioner’s Office.
We are established in the United States. You can reach us about any of these rights at contact@a2group.llc or by post at A2GROUP LLC, 5830 E 2nd St, Ste 7000 #16007, Casper, WY 82609, USA.
7. California and Other US States
7.1 Notice for California residents
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA. We have not done so in the preceding twelve months, and we do not sell or share the personal information of consumers we know to be under 16.
We use analytics and advertising-measurement providers on our websites, including Google Analytics, Google Ads, Microsoft Advertising (Bing UET) and X (formerly Twitter) conversion measurement. Some of these technologies can be treated as a “sale” or “share” under California law depending on configuration. We have configured them not to be used for cross-context behavioral advertising, and you can opt out at any time by contacting contact@a2group.llc — no account required.
Sensitive personal information. Certain information we handle may be sensitive personal information under California law, including the authorization that allows retrieval of data from your brokerage or exchange account, and the contents of your messages to the AI features. We use sensitive personal information only to provide the Platform you requested and for purposes permitted without an option to limit under Cal. Civ. Code §1798.121 — we do not use it to infer characteristics about you. We treat the brokerage holdings and transaction data we retrieve as sensitive by policy, even though California law does not classify it that way.
Your California rights, whether or not we currently meet the CCPA’s applicability thresholds: to know, access and obtain a copy; to delete; to correct; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of them. Contact contact@a2group.llc. We verify requests via the email on your account and respond within 45 days.
7.2 Other US states
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, Kentucky and Texas — have rights to access, correct, delete and obtain a portable copy of their personal data, to opt out of targeted advertising, sale and certain profiling, and to appeal a refusal. We do not sell personal data and we do not process sensitive data for targeted advertising. Contact contact@a2group.llc; if we decline a request you may appeal by replying, and if we deny the appeal you may complain to your state Attorney General.
8. Cookies and Tracking
We use strictly necessary technologies to run the Platform — authentication and session management — and, on our public websites, analytics and marketing-measurement technologies, including Google Analytics, Microsoft Advertising (UET) and the X (Twitter) conversion tag. These measure which campaigns and pages lead to subscriptions. You may accept or reject non-essential technologies, and change your mind at any time, through your browser settings and, where offered, our cookie preference controls.
We do not sell your behavioral data to advertisers, and we do not share it for cross-context behavioral advertising.
9. Security
We implement industry-standard security measures including:
- TLS encryption for all data in transit.
- The access secret that maintains a brokerage connection is encrypted at rest on our servers using AES-256-GCM and is excluded from application logs.
- Restricted and audited access to production systems.
- Two-process architecture isolating AI services from market data APIs.
- Regular security audits and access controls.
No system can be made perfectly secure, and we do not claim otherwise. If you discover a security vulnerability, please report it to contact@a2group.llc
10. Children’s Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will delete their information promptly.
11. International Users and Transfers
Cala Terminal is operated from the United States, and our providers are located in the United States and elsewhere. If you access the Platform from outside the US, your data may be transferred to and processed in the US.
When we transfer personal data out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) together with a documented transfer assessment and technical safeguards including encryption in transit and at rest. You can request a copy of the relevant safeguards at contact@a2group.llc.
12. Changes to This Policy
We may update this Privacy Policy periodically. When we do, we will update the “Last updated” date at the top of this page. Where a change is material, we will notify you by email to the address on your account and, where practicable, by an in-app notice, at least 30 days before it takes effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
We keep superseded versions of this policy on file and will provide the version in force on a given date on request to contact@a2group.llc.
13. Contact
For privacy-related questions or requests:
A2GROUP LLC — a Wyoming limited liability company
5830 E 2nd St, Ste 7000 #16007, Casper, WY 82609, USA