Your privacy is part of the product. This Policy clearly explains, without unnecessary legalese, what data Edge Flow collects, why it collects it, with whom it shares it, how long it keeps it, and how you can exercise your rights at any time.
This Privacy Policy applies to the Edge Flow platform ("Platform"), the corporate website, and all services provided by EDGE FLOW, private legal entity, in the role of controller of the personal data processed.
It must be read together with the Terms of Use and with the Cancellation and Refund Policy, and fully complies with Law No. 13,709/2018 (General Data Protection Law — LGPD), the Civil Rights Framework for the Internet (Law No. 12,965/2014), and the Consumer Protection Code.
By creating an account, subscribing to a plan, or browsing the Platform, the User declares that they have read and understood this Policy.
1 Who processes your data
The processing of personal data described in this Policy is carried out by EDGE FLOW, private legal entity, in the capacity of controller.
Official channel for privacy matters and rights requests: privacidade@theedgeflow.com.br.
This Policy applies to all Platform users—traders, mentors, students, partners, and affiliates—as well as site visitors.
2 Settings
To make reading easier, we adopt the definitions of the LGPD:
- Personal data
- any information related to an identified or identifiable natural person.
- Account Holder
- the natural person to whom the personal data refers — in this case, you.
- Processing
- all processing of personal data: collection, use, access, storage, sharing, deletion, among others.
- Controller
- who decides how data is processed — EDGE FLOW.
- Operator
- who processes data on behalf of the controller, such as hosting, payment, and artificial intelligence providers.
- Data Protection Officer (DPO)
- person designated to act as the communication channel between the Company, data subjects, and the ANPD.
- Operational Data
- information about your market operations imported or entered by you (assets, times, results, volumes, notes, and derived metrics).
- Anonymization
- process that prevents data from being associated with an individual, directly or indirectly.
3 Data we collect
We collect only what is necessary to operate the Platform. The data is divided into four groups:
3.1. Data you provide to us
- name or username;
- email address;
- password (stored encrypted, with hash — never in readable text);
- operational profile data (market traded, initial capital, goals, risk tolerance);
- billing information needed to issue an invoice;
- content you voluntarily submit: support messages, notes, trading journals, and questions to the AI assistant.
3.2. Operational Data
They are the core of the service: spreadsheets, statements, and trade files imported by you, plus the metrics calculated from them (P&L, win rate, profit factor, drawdown, equity curve, asset distribution, time and duration, among others).
This data is your. Nós os tratamos para gerar suas análises e não os utilizamos para identificar estratégias de terceiros, nem os divulgamos de forma individualizada.
3.3. Data collected automatically
- IP address and application access logs, as required by Article 15 of the Brazilian Internet Civil Rights Framework;
- access date and time, pages visited, and actions performed on the Platform;
- device type, operating system, browser, and language;
- session identifiers and cookies strictly necessary for authentication.
3.4. Data received from third parties
- affiliate or partner referral code, when you arrive through a promotional link;
- payment status, card brand, last digits, and transaction IDs reported by the payment processor;
- name, email, and profile photo, when you choose to sign in with a Google account.
We do not collect sensitive personal data (racial or ethnic origin, religious belief, political opinion, health, biometrics, sexual life), and we ask that you do not enter it in free-text fields on the Platform. Also we do not receive or store your full credit card number.
4 What we use it for and on what legal basis
All processing has a specific purpose and a legal basis defined in art. 7 of the LGPD:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Create and maintain your account, authenticate access | Registration, credentials, access logs | Contract performance (art. 7, V) |
| Process files and generate metrics, charts, and reports | Operational Data | Contract performance (art. 7, V) |
| Generate diagnostics and responses using artificial intelligence | Operational Data, profile, conversation history | Contract performance (art. 7, V) |
| Charge subscriptions, manage renewals and refunds | Registration, billing and transaction data | Contract performance (art. 7, V) and legal obligation (art. 7, II) |
| Issue tax documents and comply with accounting obligations | Registration and transaction data | Legal or regulatory obligation (Art. 7, II) |
| Provide support and respond to requests | Registration and message content | Contract performance (art. 7, V) |
| Prevent fraud, abuse, unauthorized account sharing, and ensure security | Access logs, IP, device | Legitimate interest (Art. 7, IX) and legal obligation (Art. 7, II) |
| Improve the Platform, fix issues, and measure feature usage | Usage data, preferably aggregated or anonymized | Legitimate interest (Art. 7, IX) |
| Produce internal statistics and indicators | Anonymized or aggregated data | Anonymized data is not personal data (art. 12) |
| Share your progress with your group mentor | Student metrics and history | Consent (art. 7, I) or performance of a mentoring agreement |
| Tell the partner who funds your access which accounts they sponsor | Name, email, and granted plan status — never your trades | Contract performance (art. 7, V) |
| Send communications about news, content, and offers | Name and email | Consent (art. 7, I), revocable at any time |
| Exercise rights in judicial, administrative, or arbitration proceedings | Strictly necessary data | Regular exercise of rights (art. 7, VI) |
We do not use your data for purposes incompatible with those stated above. If a new purpose arises, you will be informed and, when required by law, new consent will be requested.
5 Artificial intelligence and automated decision-making
Some features use third-party language models to interpret your Operational Data and produce diagnoses, suggestions, and responses in natural language.
In this process:
- we sent to the AI provider metrics, aggregated statistics, and the necessary context to analysis, avoiding the sending of unnecessary identifying data;
- the submission occurs through an application programming interface (API) with encrypted transmission;
- under the provider’s current terms for corporate API use, the content sent is not used for training the supplier’s models;
- the generated result is tied to your account and visible only to you and, where applicable, to the authorized mentor.
The Platform does not make automated decisions that produce legal effects concerning you: we do not grant credit, evaluate you for third parties, or block rights based solely on an algorithm. The analyses are informational and educational.
Even so, under art. 20 of the LGPD, you may request human review of any automated analysis that affects you, as well as clear information about the criteria used, subject to commercial and industrial confidentiality.
6 Who we share with
A EDGE FLOW does not sell, rent, or commercialize personal data. O compartilhamento ocorre apenas com operadores necessários ao funcionamento do serviço, sempre sob contrato e limitado à finalidade informada.
| Who | What for | Data | Local |
|---|---|---|---|
| Stripe | Payment and subscription processing | Email, subscription identifiers, and transaction identifiers | United States |
| Artificial intelligence provider (OpenAI) | Generation of analyses, diagnostics, and assistant responses | Metrics and operational context | United States |
| Hosting and infrastructure provider | Platform storage and execution | All stored data | As per the hosting agreement |
| Transactional email sending service | Confirmations, password recovery, billing notices | Name and email | As per provider |
| Mentor or class supervisor | Student educational follow-up | Linked student metrics and history | Brazil |
| Sponsoring partner (broker, mentoring, or community) | Management of the accounts he sponsors, when you joined through his link | Name, email, join date, and granted plan status | Brazil |
| Accounting and legal advisory | Tax obligations and defense of rights | Registration and transaction data | Brazil |
| Public authorities | Compliance with a court order or legal obligation | Strictly what is requested | Brazil |
Affiliates: numbers only
Anyone who promotes the Platform through the affiliate program receives aggregate information only of conversion: number of referrals and commission status. Affiliates do not have access to your name, your email, or your Operational Data.
Sponsoring partner: identity, not operations
The situation is different for the sponsoring partner — broker, mentor, or community that pays for your access and through whose link you created the account. Since they fund the subscription and are responsible for a limited number of spots, they can see, only in relation to the accounts they sponsor:
- your name and registration email;
- the date you joined through his link;
- the status of the plan they granted (active, expired, or whether you started subscribing on your own).
The sponsoring partner does not have access to your Operational Data: he cannot see your trades, results, metrics, charts, AI diagnostics, or conversations with the assistant. He sees who sponsors it, not how you trade.
The partner may end the sponsorship of an account, freeing up the spot. In that case, access that they granted is terminated and the account returns to free status — your data and your history remain intact and available to you. If at that moment you already hold your own paid subscription, the termination of the sponsorship does not affect your access.
This sharing is legally based on performance of the contract (art. 7, V) entered into between you, EDGE FLOW and the partner funding your access, and is disclosed to you when the account is created via the partner link. If you prefer that the partner not see your data, simply subscribe to a plan directly, without sponsorship linkage.
In the event of a corporate reorganization, merger, acquisition, or sale of assets, the data may be transferred to the successor, which will be required to maintain the terms of this Policy or to notify in advance of any changes.
7 International data transfer
Some essential service providers — notably the payment processor and the artificial intelligence provider — are based outside Brazil, mainly in the United States. Therefore, part of the processing involves international data transfer.
These transfers are based on Article 33 of the LGPD and are necessary to perform the contract entered into with you, and are supported by contractual safeguards that require the processor to:
- process data only according to our instructions and for the contracted purpose;
- adopt compatible technical and administrative security measures;
- maintain confidentiality and not use the data for their own purposes;
- help respond to data subject requests and security incidents.
8 How long we keep it
We retain personal data only for as long as necessary for the purposes of this Policy or compliance with legal obligations:
| Data | Retention period |
|---|---|
| Registration and account data | As long as the account exists |
| Operational Data, analyses and reports | As long as the account exists or until you delete them |
| Conversation history with the AI assistant | As long as the account exists or until deleted by the User |
| Application access logs (IP, date, and time) | Minimum of 6 months, pursuant to art. 15 of the Brazilian Civil Rights Framework for the Internet |
| Billing, invoicing, and tax data | Up to 5 years after the transaction, in accordance with tax law and the Consumer Protection Code |
| Records required for defense in legal proceedings | Until final closure and the end of all applicable limitation periods |
| Anonymized data and aggregated statistics | Indefinite period — not personal data |
Once the applicable period has ended and there is no legal basis for retention, the data are securely deleted or permanently anonymized.
10 Information security
We adopt technical and administrative measures to protect your data against unauthorized access, loss, alteration, destruction, and any form of improper or unlawful processing, including:
- encrypted traffic over HTTPS/TLS across the Platform;
- passwords stored with function hash cryptographic, irreversible;
- role-based access control, with segregation between user, mentor, and administrator;
- session validation and request origin verification against spoofing;
- data isolation by account, so that one user cannot access another user's data;
- backup routines and administrative activity logs;
- restricted access to people who actually need it, under a duty of confidentiality.
No system is absolutely impenetrable. That is why you are also responsible for keeping your password confidential, not sharing your account, and using trusted devices.
11 Your rights as a data subject
The LGPD guarantees you the following rights at any time and free of charge (art. 18):
- Confirmation and access — know whether we process your data and obtain a copy of it;
- Correction — update incomplete, inaccurate, or outdated data;
- Anonymization, blocking, or deletion — unnecessary, excessive, or unlawfully processed data;
- Portability — receive your data in a structured, commonly used format;
- Deletion — data processed on the basis of consent, except where retention is required by law;
- Information about sharing — know which public and private entities we share your data with;
- Information about consent refusal — understand the consequences of not consenting;
- Withdrawal of consent — at any time, by explicit request;
- Opposition — to processing based on legitimate interest;
- Review of automated decisions — under art. 20.
How to exercise
Most of it is already in your hands: you can edit your profile, delete imports, and erase chat history directly in the dashboard. For other requests, write to privacidade@theedgeflow.com.br by providing the registered email and the right you wish to exercise.
We will respond within a reasonable time, generally by 15 days from the request. We may request additional information to confirm your identity — a measure that protects you against fraudulent requests.
Deletion requests that conflict with legal retention obligations (tax and access records, for example) will be partially fulfilled, with use blocked and data deleted at the end of the legal retention period. We will always explain the reason.
12 Consent and its revocation
When processing depends on consent — such as sending marketing communications or sharing your metrics with a mentor — it will be requested in a clear and specific way.
Revocation is free, may be done at any time, and can be requested through the dashboard or by email. Revocation does not affect the lawfulness of processing carried out before it, nor does it stop processing supported by another legal basis, such as performance of the contract.
13 Children and adolescents
The Platform is intended exclusively for people with 18 years or older, with full legal capacity to enter into agreements.
We do not intentionally collect data from children or teens. If we identify an account registered by a minor without the proper legal authorization, the account will be closed and the data deleted. If you are a parent or guardian and suspect this situation, contact us at privacidade@theedgeflow.com.br.
14 Communications we send
We distinguish two types of message:
- Transactional — account confirmation, password recovery, billing notices, renewal, and relevant policy changes. These are part of the service and cannot be disabled while the account exists;
- Promotional — news, content, and offers. They depend on your consent and can be refused at any time through the unsubscribe link in the message itself or by direct request.
15 Security incidents
In the event of a security incident that may cause significant risk or harm to data subjects, the EDGE FLOW will notify the National Data Protection Authority (ANPD) and the affected data subjects within a reasonable time, under art. 48 of the LGPD.
The notice will include, at a minimum: the nature of the data involved, the affected data subjects, the technical security measures used, the risks identified, and the steps taken to reverse or mitigate the effects.
16 Our commitments
In practical terms, what we guarantee:
- we do not sell, rent, or transfer personal data to third parties for commercial purposes;
- we do not disclose your trading results on an individual basis;
- we do not use your Operational Data to trade in the market, replicate strategies, or guide third parties;
- we do not send your data to AI providers for model training;
- we collect the minimum necessary and keep it for the shortest possible time;
- we will notify you before any material change to this Policy.
17 Changes to this Policy
This Policy may be updated to reflect legal, technical, or operational changes. The date of the latest update is always shown at the top of this page.
If there is a material change — especially regarding the purposes, legal bases, or sharing — you will be notified by email or through a highlighted notice on the Platform before it takes effect. When the change depends on consent, it will be requested again.
18 Data Protection Officer, contact, and ANPD
For questions, requests, or complaints about privacy and data protection, contact our Data Protection Officer (DPO):
Data Protection Officer contact: privacidade@theedgeflow.com.br
If, after our response, you believe your rights were not addressed, you may file a complaint with the National Data Protection Authority (ANPD), through the official channels available at gov.br/anpd, as well as to consumer protection agencies.