This Privacy Policy describes how Button Labs, Inc. (“Button,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use the Button website at button.xyz, the application at app.button.xyz, and our related software, tools, agents, interfaces, plugins, application programming interfaces, communications, subscriptions, and services that link to this Privacy Policy (collectively, the “Services”). This Privacy Policy should be read together with our Terms of Service, which are incorporated by reference where applicable.

Personal Information We Collect

We collect personal information in the following ways, depending on how you interact with the Services, which features you use, which accounts or integrations you connect, and which subscription or payment options you select.

Personal information we receive from you or at your direction

Account, Contact, Waitlist, and Checkout Details: Name, email address, username, account identifiers, login and authentication information, contact information, billing address, subscription selections, promo codes, and other information you provide when you join a waitlist, create an account, subscribe to a paid plan, contact us, or otherwise communicate with us.
Connected Account, Wallet, and Financial Information: Public wallet addresses and associated on-chain activity; read-only brokerage, bank, exchange, retirement-account, or wallet information that you authorize us to receive through connected services, such as holdings, positions, balances, transaction history, account identifiers, and account metadata. We do not receive or store your brokerage or bank login credentials where those credentials are handled by a third-party account-linking provider.
User Inputs, Outputs, and Content: Theses, prompts, watchlists, search queries, instructions, files, code, strategy parameters, backtests, artifacts, automations, feedback, and other content you submit to or generate through the Services, including third-party research, newsletters, social-media content, messages, or other “knowledge graph” sources you designate for use with the Services.
Preferences and Settings: Language, interests, plan preferences, model and feature settings, dashboard views, search and display preferences, plugin settings, connected-account preferences, notification preferences, and other feedback or preferences that you express during your use of the Services.
Payment and Subscription Data: Subscription tier, billing cadence, transaction amount, tax and billing information, payment-method selection, payment tokens or limited payment-method details, promotion-code information, and related payment records. Payment information may be processed by third-party payment providers such as Stripe, Link, Amazon Pay, Cash App Pay, Klarna, card networks, and bank-payment providers, depending on the payment method you select.
Communications and Relationship Information: Details of your communications with us, support requests, feedback, survey responses, claims, complaints, inquiries, and administrative or marketing communication preferences.

Personal information collected automatically through your use of our Services

Online Activity Data: Pages, screens, dashboards, features, plugins, automations, threads, artifacts, backtests, signals, and connected-account features you view or use; search queries; navigation paths; interactions; access times; duration of access; feature usage; usage limits; and whether you have opened our marketing emails or clicked links within them.
Device, Log, and Location Information: Your device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type, IP address, language settings, mobile device carrier, network information, timestamps, referring URLs, log data, and approximate location information derived from IP address or device settings, including for security, fraud-prevention, eligibility, sanctions, and geographic-restriction screening.

Tools we use for automatic data collection

Cookies: Cookies are pieces of information stored directly on the device that you are using and allow us and our service providers to collect information such as browser type, time spent on the Services, pages visited, language preferences, identifiers, and other traffic data. We and our service providers may use cookies for security, authentication, fraud prevention, navigation, preferences, analytics, performance measurement, and personalization. Where required by law, we will seek your consent before using non-essential cookies and will provide applicable cookie choices or opt-out mechanisms. We do not currently respond to browser do-not-track signals, but we will honor legally required opt-out preference signals, such as Global Privacy Control, where applicable. You can read more information about cookies at allaboutcookies.org.
Local Storage Technologies: These technologies provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
Pixel Tags: Also known as web beacons and clear GIFs, pixel tags may be used to, among other things, track the actions of users of the Services (including email recipients), measure the success of our marketing campaigns, and compile statistics about usage of the Services and response rates.
Analytics and Measurement Tools: We may use analytics and measurement tools, such as Google Analytics or similar services, which use cookies and similar technologies to collect and analyze information about use of the Services and report on activities and trends. These services may also collect information regarding use of other websites, apps, and online resources. You can learn about Google’s practices at policies.google.com/privacy, and you can exercise the opt-out provided by Google by downloading the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Sensitive or Regulated Information: We may process financial account information, wallet information, payment information, precise or approximate location information, account credentials or authentication data, and other information that may be considered sensitive, regulated, or protected under applicable law. We do not seek to collect special categories of personal information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or information concerning a person’s sex life or sexual orientation, and you should not submit such information to the Services unless we expressly request it. We use sensitive or regulated information only as necessary to provide, secure, and improve the Services, comply with law, prevent fraud or abuse, verify eligibility, or as otherwise permitted by applicable data privacy laws and regulations.

We need to collect personal information to provide the requested Services to you. If you do not provide the information requested, or if you disconnect a required account or integration, we may not be able to provide some or all of the Services. If you disclose or designate any personal information relating to other people, third-party accounts, third-party content, or third-party sources to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy and our Terms of Service.

How We Use Personal Information

Here’s an overview of how we use personal information in providing our Services.

Administering and Providing the Services: To provide the Services to you, including creating and managing your account, arranging access to your account, authenticating you, processing subscriptions and payments, connecting integrations you authorize, generating outputs, backtesting strategies, saving artifacts, configuring automations, routing user-directed actions where enabled, responding to inquiries, fulfilling requests, and sending administrative information such as agreements, notices, and changes to our terms, conditions, and policies.
Operations and General Business: To conduct our operations, including troubleshooting, diagnostic testing, performance analyses, system and log maintenance, technical support, hosting, debugging, vendor management, model evaluation, usage metering, business analytics, and facilitating mergers, acquisitions, financings, and other reorganizations or restructurings of our business, including prospective transactions.
Marketing: To send you newsletters, publications, product updates, promotions, and other marketing communications that may be of interest to you, subject to any consent required by applicable law and your marketing choices.
Relationship Building and Engagement: To respond to your messages, posts, feedback, and support requests, and to manage relationships with users, prospects, partners, connected services, and the communities or social-media services that you choose to connect or interact with through the Services.
Personalizing Our Services: To personalize our interactions with you and customize dashboards, model settings, artifacts, signals, search results, notifications, connected-account features, subscription features, and other Services functionality.
Improving and Developing Our Services: To conduct data analysis, monitor and analyze use of our Services, improve the efficiency, safety, performance, and quality of the Services, develop new features, enhance, improve, repair, maintain, or modify our Services, identify usage trends, evaluate model performance, and determine the effectiveness of promotional campaigns. We do not use identifiable connected-account financial data to train general-purpose AI models, and we use User Inputs, Outputs, connected-account data, and usage data to improve models or Services only in aggregated, de-identified, consented, or otherwise legally permitted ways and subject to any applicable settings, agreements, and provider restrictions.
Aggregation and/or Anonymization: We may anonymize and aggregate personal information that does not identify you or another individual and use and share such data for our own business purposes.
Security, Eligibility, and Fraud Prevention: To conduct audits, verify that internal processes function as intended and comply with legal, regulatory, and contractual requirements, authenticate users, screen for eligibility and geographic or sanctions restrictions, monitor for and prevent fraud, abuse, market manipulation, unauthorized access, and security incidents, maintain system security, and enforce rate limits, subscription limits, and usage restrictions.
Legal and Compliance: To fulfill our legal and compliance-related obligations, including complying with applicable privacy, data-protection, financial-services, sanctions, export-control, securities, commodities, derivatives, tax, consumer-protection, and payment laws; complying with legal processes; responding to requests from public and government authorities; meeting national security or law enforcement requirements; enforcing our terms and conditions and standards; protecting our operations; protecting the rights, privacy, safety, or property of Button, our users, or others; responding to auditors; pursuing available legal remedies; making insurance claims; defending claims; and limiting the damages that we may sustain.

Legal Bases for Processing

Where GDPR, UK GDPR, or similar laws apply, our legal bases for processing personal information include performance of a contract or taking steps at your request before entering into a contract; our legitimate interests in providing, securing, improving, and protecting the Services, preventing fraud and abuse, and communicating with users; compliance with legal obligations; your consent, where required for marketing, certain cookies, optional connected services, or other processing; and, where necessary, protecting vital interests or performing tasks in the public interest. You may withdraw consent where processing is based on consent, but withdrawal will not affect processing that occurred before withdrawal.

How We Disclose Personal Information

Here are the types of entities to which we may disclose personal information in providing the Services.

Service Providers and Processors: We disclose personal information to service providers and processors that provide hosting, cloud infrastructure, information technology, security, fraud prevention, account linking, payment processing, tax calculation, customer support, email and communications delivery, analytics, AI model processing, data processing, and other services for the purposes listed above, subject to contractual confidentiality, security, and use restrictions where appropriate.
Professional Advisors: We use accountants, actuaries, auditors, experts, consultants, lawyers, banks, and financial institutions to support our business.
Authorities and Others: If required by law or legal process, or if we deem disclosure appropriate for legal, compliance, sanctions, eligibility, security, abuse-prevention, market-integrity, or fraud-prevention purposes, we may disclose personal information to law enforcement, public, regulatory, and government authorities, courts, auditors, counterparties, or other entities that obtain valid subpoenas or otherwise have a lawful basis to receive the information.
Connected Third Parties at Your Direction: We disclose personal information to third parties you choose to connect or interact with through the Services, such as SnapTrade or similar account-linking providers, Hyperliquid and other execution venues, wallets, brokerage and bank connections, Databento and other market-data providers, X, Discord, Telegram, social-media services, payment providers, and other plugins or integrations. These third parties process your information under their own terms and privacy policies.
Business Transferees: We may disclose or transfer your personal information to third parties such as acquiring entities and their advisors in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
No Sale for Money; Advertising and Analytics Choices: We do not sell personal information for money. Some analytics, advertising, or cookie-based disclosures may be considered a “sale,” “sharing,” or “targeted advertising” under certain privacy laws even when no money is exchanged. Where those laws apply and we engage in such activities, we will provide required notices and opt-out mechanisms, including honoring legally required opt-out preference signals such as Global Privacy Control.
As Disclosed, Directed, or Consented To: We may disclose your personal information for any other purpose disclosed by us at the time you provide that personal information, as necessary to provide a feature or integration you request, or otherwise with your consent.

Security

We seek to use reasonable organizational, technical, and administrative measures designed to protect personal information within our organization, including measures appropriate to the sensitivity of connected-account, wallet, payment, and financial information. These measures may include access controls, encryption in transit and at rest, logging and monitoring, vendor diligence, incident-response procedures, and employee access restrictions, as appropriate to the nature of the information and Services. No data transmission or storage system can be guaranteed to be 100% secure. You are responsible for safeguarding your account credentials, connected accounts, payment methods, and self-custodied wallets, and Button cannot recover assets or reverse transactions submitted to third-party venues, payment providers, wallets, or blockchains. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately.

California Privacy Rights

If you are a California resident, you may have rights under California privacy laws, including the right to know, access, correct, delete, and obtain a portable copy of personal information; the right to opt out of certain sales, sharing, or targeted advertising where applicable; the right to limit certain uses or disclosures of sensitive personal information where applicable; and the right not to be discriminated against for exercising privacy rights. California’s “Shine the Light” law also permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make a request, please contact us at legal@button.xyz. We will verify and respond to requests as required by applicable law.

Marketing Choices

You have choices regarding marketing-related communications. If you no longer want to receive marketing-related communications from us on a going-forward basis, you may opt out by following the unsubscribe instructions in any such message or by contacting us at legal@button.xyz. Where required by law, we will send marketing communications only with your consent.

We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing from us, we may still send you important administrative messages, from which you cannot opt out.

Other State Privacy Rights

Residents of certain states may have additional personal information rights and choices, including rights to access, confirm, correct, delete, obtain a copy of, or port personal information; opt out of certain sales, sharing, targeted advertising, or profiling where applicable; appeal a denied rights request where applicable; and limit certain uses or disclosures of sensitive personal information where applicable. We will honor rights requests to the extent required by applicable law. If you believe you have such additional rights and wish to exercise them, please send us an email with your request, including the specific rights you wish to exercise, to legal@button.xyz. Please be aware that your rights are limited to the extent permitted by applicable law.

EU and UK Privacy Rights

If GDPR, UK GDPR, or similar laws apply, you may have rights to access, correct, delete, restrict or object to processing of, and obtain a portable copy of your personal information; withdraw consent where processing is based on consent; and lodge a complaint with a supervisory authority. Where we transfer personal information internationally, we use legally recognized safeguards where required, such as standard contractual clauses or other approved mechanisms.

Data Retention

We retain personal information for as long as reasonably necessary to provide, maintain, secure, and improve the Services; maintain your account; honor your choices; operate connected services; preserve saved threads, artifacts, backtests, automations, and subscription records; comply with legal, tax, accounting, regulatory, sanctions, financial-services, payment, and recordkeeping obligations; resolve disputes; enforce agreements; prevent fraud and abuse; and protect our rights and the rights of others. Retention periods vary depending on the type of information, the sensitivity of the information, the feature used, whether you maintain an account or connected integration, legal requirements, and legitimate business needs. Disconnecting an account or wallet stops future access to that connection but does not automatically delete information previously received or retained for the purposes described above. We delete, de-identify, or aggregate personal information within a reasonable period after we no longer need it for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Third-Party Services

This Privacy Policy does not address, and we are not responsible for, the privacy, information, security, or other practices of third parties. This includes third parties operating websites, services, payment methods, account-linking tools, brokerage or bank connections, wallets, blockchains, execution venues, market-data feeds, social-media services, AI model services, plugins, or protocols to which the Services link or with which the Services interoperate, including Hyperliquid, SnapTrade or similar account-linking providers, Databento, X, Discord, Telegram, Stripe, Link, Amazon Pay, Cash App Pay, Klarna, card networks, bank-payment providers, and other third-party services. Your use of those services is governed by their own privacy policies and terms. The inclusion of a link or integration on our Services does not imply endorsement of the linked or integrated service by us or our affiliates.

Financial Privacy

Some information processed through the Services, including brokerage-account information, retirement-account information, wallet information, trading information, payment information, and subscription information, may be subject to financial-privacy, payment-card, consumer-protection, or other sector-specific laws. Where those laws apply, we process, disclose, secure, and retain such information in accordance with applicable legal requirements and applicable terms with account-linking, payment, execution, and other financial-service providers.

Children

The Services are not directed to, and may not be used by, anyone under 18 years of age or the age of majority in their jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at legal@button.xyz and we will take reasonable steps to delete such information from our systems, subject to applicable law.

Updates to this Privacy Policy

The “Last Updated” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy on the Services, unless we state otherwise. For material changes, we will provide additional notice, such as by email, in-product notice, or other legally required method, and we will request renewed consent where required by applicable law.

Contacting Us

If you have any questions about this Privacy Policy or wish to exercise privacy rights, please contact us at legal@button.xyz. You may also contact us at Button Labs, Inc., Attn: Privacy, 50 Woodside Plaza, Redwood City, CA 94061.