Privacy Policy

1. Information We Collect

We collect information you provide directly: email address and identity information provided through Privy authentication; connected wallet addresses and public strategy-permission addresses; algorithm metadata, workflow configuration, prompts, chat messages, generated artifacts, and approval decisions; supported venue account, market, position, order, fill, fee, and portfolio data you permission or request, including paper and sandbox records; customer-owned compute status; and metadata needed to route bring-your-own-key AI requests. We also collect operational logs, feature and quota usage, runner health, error states, and strictly necessary cookies for authentication, sessions, and beta operations.

2. How We Use Your Information

We use information to provide and operate the Service; generate requested AI-assisted research, workflow drafts, historical tests, paper sessions, and execution previews; route prompts and context to selected AI providers; connect and monitor customer-owned compute; process transactions and billing communications; monitor platform health and abuse; and comply with legal obligations.

3. Sharing Your Information

We do not sell personal information. We may share the minimum information needed with infrastructure, authentication, billing, analytics, AI-model, trading-venue, blockchain, and customer-selected service providers; with professional advisers; when required by law; or during a permitted business transaction. Public blockchain activity and information sent directly to a venue or provider may be independently retained and observed. Prompts, context, generated artifacts, and usage metadata may be sent to the AI provider you select or configure. Hyperliquid beta paper orders are simulations and are not submitted as venue orders. Mattheus uses temporary, encrypted cloud-provider authorization only for a provisioning operation you request; under the provision-once model, that authorization is revoked and removed after the private runner is connected.

4. Data Retention

We retain account and product data while your account is active and then according to configured security, billing, dispute, abuse-prevention, and legal requirements. Temporary cloud-provider credentials are destroyed after successful provisioning or expiration. Execution, fill, order, approval, policy-decision, revocation, reconciliation, security, and operational audit records may be retained or pseudonymized after account closure where required. AI memory and personalization records remain until deleted or their configured validity or staleness period ends. Tool and context access audit records currently default to 90 days, subject to approved legal, security, and incident-response requirements. Strategy source, raw research documents, datasets, full runtime logs, local memory, and local artifacts normally remain on your own server. Revoking a Mattheus runner prevents future tasks, but Mattheus cannot erase an offline customer-owned disk.

5. Security

Mattheus uses technical and organizational safeguards designed to protect information, including scoped permissions, approval-first execution controls, encrypted transport, access controls, monitoring, and revocation paths. No system is completely secure, and users remain responsible for protecting wallets, credentials, recovery information, devices, and connected providers. Sentry PII collection defaults off, and session replay or error events must mask text input and sensitive request fields.

6. Cookies

We use strictly necessary cookies for authentication and session management. With your consent, we use PostHog for limited page, product-surface, attribution, and waitlist-funnel analytics. These analytics exclude email addresses, names, wallet addresses, balances, positions, prompts, uploaded content, authentication tokens, and financial account data. Session Replay and broad interaction autocapture are disabled. You can decline analytics without affecting waitlist submission or preview access.

7. Your Rights

Depending on jurisdiction, you may have rights to access, correct, delete, object to or restrict processing, or receive portable personal data. Requests must use the verified controlled-beta support process. Mattheus may need to confirm identity and may retain information where law or legitimate security and recordkeeping obligations require it. The account export provides a bounded, redacted copy of accessible central Mattheus data and labels customer-server data that was not exported. Deactivation blocks new execution and revokes central credentials first. Deletion removes accessible product data and pseudonymizes retained records while preserving required evidence. Self-service export and account deactivation require a signed-in user, recent account confirmation, and an explicit request. Self-service account deletion is disabled during this beta; contact support for the reviewed manual process. Export or deletion may be partial while a customer-owned server is offline.

8. International Transfers

Information may be processed in countries other than the country where it was collected. Where required, Mattheus and its providers use appropriate safeguards for international transfers.

9. Changes to This Policy

We may update this policy from time to time and will identify material updates through the Service or another appropriate channel.

10. Contact

Privacy contact details are supplied through the verified controlled-beta support process.