Privacy notice: sign-up and Practice Mode access

Version 2.0

1. Who we are, and what this notice covers. This notice covers our sign-up page at chase.eagleapp.us ("the Page") and your use of the Eagle app during our closed Practice Mode ("Practice Mode"). We intend to publish a fuller, dedicated in-app privacy notice before the app leaves Practice Mode; until then, this notice is intended to describe our Practice Mode app practices as closely as it reasonably can — see item 5 for how we handle information generated by your use of the app. Eagle Financial Labs, Inc., 131 Continental Drive, Suite 301, Newark, New Castle, Delaware, 19713, USA, is the data controller. Contact, including for any Data Protection Officer or EU/UK representative enquiry: privacy@eagleapp.us.
2. What we collect. Name; email address; country of residence (inferred automatically from your IP address — we do not ask you to select it); your consent to receive marketing updates from us (implied by submitting this form, not collected as a separate question); the page or campaign you came from (referrer and link source); IP address (we store only a one-way hash for abuse control, plus the country it maps to); browser user-agent; timestamps of your consent and account activation.
3. Why we use it and our legal basis. (a) To process your sign-up, decide whether to admit you to Practice Mode, and create your practice account: necessary to provide the service you've asked for by submitting this form (Art. 6(1)(b)/(f)). (b) To send you product updates about Eagle: your consent, given by submitting this form (Art. 6(1)(a)), and entirely separate from (a). (c) To keep the service secure and prevent bots and abuse (rate limiting, spam and fraud checks, including automated checks on your email domain and IP location): our legitimate interests in protecting our service (Art. 6(1)(f)). (d) To understand how people find us: our legitimate interest in measuring sign-up sources, using only the data above.

   US law. Eagle Financial Labs, Inc. is a Delaware corporation. To the extent US law applies to our processing of your data, we rely on Section 5 of the FTC Act (which prohibits unfair or deceptive practices), the CAN-SPAM Act (governing the marketing emails described in item 11) and applicable US state consumer-privacy laws (see item 8) as the basis for the purposes described above.

4. Automated decisions. We use automated rules (for example, your IP-inferred country, email checks and available capacity) to decide whether to admit you to Practice Mode straight away or review your request manually. This does not have a legal or similarly significant effect on you. If you are not admitted automatically, a person may review your request, and you can contact us to ask for one.
5. Who we share it with. Service providers acting on our instructions process your sign-up details: Amazon Web Services (hosting, database, email delivery) and Cloudflare (Turnstile bot check). If you activate a practice account and go on to use the app, further information generated by your use of the app is processed by WealthKernel Limited, our regulated account infrastructure partner (identity and account details, in their Practice Mode sandbox environment during Practice Mode) — please use dummy data at that stage, not real identification numbers. WealthKernel Limited also trades as "Alpaca Europe" the same FCA-regulated entity (reference 723719). Alpaca Europe's own privacy policy discloses that it may share data with its US parent, Alpaca Securities LLC — see item 6 for how we handle this. If you submit an in-app problem report, the text you enter is sent to GitHub and stored as a private issue (personal details are scrubbed from it first). We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
6. Where it is stored and international transfers. Your data is stored in AWS in the United Kingdom (London region). Cloudflare and GitHub are US-headquartered and may process limited data in or from the United States. WealthKernel Limited (including its Alpaca Europe trading name) is itself UK-based, but its own privacy policy discloses that it may share data with its US parent, Alpaca Securities LLC, and may process data on servers located in the United States. Where personal data is transferred outside the UK — by us to Cloudflare or GitHub, or onward by WealthKernel Limited/Alpaca Europe to its US parent — we rely, as applicable per recipient, on the UK–US Data Bridge (the UK's extension of the EU–US Data Privacy Framework, for a recipient that self-certifies under it) or the UK International Data Transfer Agreement (IDTA) as a fallback.
7. How long we keep it. If you sign up but do not open an Eagle account: we retain your sign-up data until you unsubscribe, or until 24 months have passed since the date you signed up, whichever is sooner. If you do open an Eagle account: we retain your data for as long as you hold that account with us, plus 7 years after it closes (to meet our own record-keeping obligations), or until you withdraw consent (for the updates in item 3(b)) or ask us to delete it, whichever is sooner. IP hashes and other technical logs: 90 days. If you unsubscribe from marketing updates, we keep a record of your email address on a suppression list for no other purpose than to make sure we don't contact you again.
8. Your rights. You can ask to access, correct or delete your data, restrict or object to our use of it, receive a copy in a portable format, and withdraw your marketing consent at any time (withdrawing does not affect earlier processing). Email privacy@eagleapp.us. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

   If you are a resident of a US state with its own consumer-privacy law (for example California, Colorado, Connecticut, Virginia or Texas), you may also have the right to access, correct or delete your personal information, and to opt out of its sale, sharing or use for targeted advertising — we do not sell, share or use your personal information for targeted advertising in the first place, so there is nothing to opt out of today. We will verify your identity before responding to a request, aim to respond within 45 days, and will not treat you differently for exercising any of these rights. If we decline a request, you can ask us to reconsider it by emailing privacy@eagleapp.us.

9. Providing your data. Giving us your name and email address is needed to process your sign-up; without it we can't process your request. By submitting the form you're also giving the marketing consent described in item 3(b). There is no other, optional field on this form.
10. Practice mode notice. We do not collect financial, account, tax or identity-document information through this sign-up form. Eagle Practice Mode itself runs as a sandbox — please use dummy data there and do not enter real identification numbers (for example NINO or SSN).
11. Marketing emails. Any marketing email we send you will identify Eagle Financial Labs, Inc. as the sender, include our postal address (see item 1), and provide a working unsubscribe link. We process unsubscribe requests within 10 business days.
12. Security. We use reasonable administrative, technical and physical safeguards to protect your data, including encryption in transit and access controls. If a breach affecting your data occurs, we will notify you and any relevant regulator where required by law.
13. Children. The Page is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18.
14. Changes. We'll update this notice if we change how we use your data, with the version and date shown at the top.