Learn on Paper — Privacy Notice
Effective date: [EFFECTIVE DATE]
Last updated: [LAST UPDATED DATE]
This notice explains what personal information Learn on Paper collects, why, who we share it with, and the choices you have. "We" and "us" means Interamerican Technology Services Inc., which runs learnonpaper.com (the "Service").
1. The short version
- We collect your email, password (stored only as a secure hash), optional name, language, and the simulated trading activity and notes you create.
- We use it to run your paper-trading account, send the emails you ask for, keep the Service secure, and provide support.
- We do not sell your personal information, show ads, or use third-party analytics or advertising trackers.
- We use a few service providers: Microsoft 365 (email), Yahoo Finance (market quotes; we do not send it your personal information), and, when switched on, xAI (AI features).
- The Service is hosted on our own server in the United States.
2. Information we collect
Information you give us
| What | Details | Why |
|---|---|---|
| Account details | Email address; password; optional display name (up to 80 characters); preferred language (English, Portuguese or Spanish); the time you accepted the Terms of Use. | To create and secure your account, sign you in, contact you, show the app in your language, and record your acceptance of the Terms. |
| Password | Never stored in readable form. We store only a one-way hash made with argon2id. | To check your password when you sign in. |
| Simulated trading activity | Paper cash balance and history (starting grant, deposits, withdrawals, trades, simulated fees); orders (stock symbol, Buy/Sell/Short/Cover, order type, quantity, prices, status, fills, times, optional order note); open and closed positions; daily snapshots of your simulated portfolio value. | To run the simulator, show your portfolio, stats, calendar and reports, and let you export your data. |
| Watchlist, alerts and notes | Stocks on your watchlist and whether you asked for daily analysis emails; price alerts (symbol, above/below, price, how to notify you); notes about stocks (up to 2,000 characters each) and any price "watch" read from them. | To provide watchlists, alerts and smart notes. |
| Journal | For each simulated trade: what influenced it and your notes (up to 4,000 characters). | To provide the trade journal. |
| AI features and Advanced strategies | Stored analyses (stock, date, AI output, the conditions used, and whether it was SAMPLE or real AI); your custom analysis conditions; Advanced strategy groups (name, label, methodology, tickers, budget, status) and a log of actions in each group; AI reasoning saved with Advanced trades. | To provide AI analysis and Advanced strategy features and show your history. |
Please do not put sensitive personal information (for example health, financial account numbers or government IDs) in notes, journal entries or strategy text.
Information collected automatically
| What | Details | Why |
|---|---|---|
| Sign-in sessions | A random session token in a cookie (we store only a hash of it), when the session was created, last used and expires, and the IP address and browser/device description (user agent) used to sign in. Sessions last up to 14 days. | To keep you signed in and protect your account. |
| Email links | One-time codes for email confirmation (valid 24 hours) and password reset (valid 1 hour); we store only a hash of each code and when it was used. | To confirm your email and reset your password safely. |
| Notifications and email delivery | In-app notifications (alerts, analysis emails, support-access notices) and their email delivery status. | To show notifications and deliver emails once. |
| AI usage log | Each AI request: type, provider, model, stock symbol, success or failure, and time. | To apply usage limits and keep a record of AI use. |
| Security and rate limiting | IP address and email used in sign-in, sign-up and email requests are counted briefly in memory to block abuse. These counters are not stored in the database and reset when the app restarts. | To prevent password guessing and abuse. |
| Web server logs | Our web server (Apache) keeps standard access logs: IP address, date and time, page requested, referring page and user agent. | To operate, secure and troubleshoot the Service. [RETENTION PERIOD FOR SERVER LOGS] |
Support access records
If an administrator opens a read-only support view of your account (see Section 5), we record the administrator, the reason they gave, when it started and ended, and which pages they viewed.
Information we do not collect
We do not collect payment details, bank or brokerage account information, government ID numbers, precise location, or contacts. We do not connect to any real brokerage account.
3. Cookies
We only use cookies needed for the Service to work. We do not use advertising or analytics cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
lop_session | Keeps you signed in | Up to 14 days, or until you log out |
lop_csrf | Security: protects forms against cross-site request forgery | Browser session |
lop_locale | Remembers your language choice | 1 year |
lop_ctx | Remembers which strategy view (Manual or an Advanced group) you selected | 30 days |
lop_support | Administrators only: marks an active read-only support view | Until the support view ends (about 30 minutes) |
4. How we use your information
We use your information to:
- create and run your account and the simulator;
- send emails you need or ask for: email confirmation, password reset, a notice if someone tries to sign up with your email, a confirmation when your account is deleted, and — if you turn them on — price-alert, note-alert and analysis emails;
- provide AI features you choose to use;
- provide support and investigate problems;
- keep the Service secure and prevent abuse; and
- meet legal obligations.
We do not use your information for advertising, and we do not sell it or share it for cross-context behavioral advertising. [LAWYER: confirm whether we want to use data to improve the Service or for aggregated statistics; add if so.]
[LAWYER: if users in Brazil (LGPD), the EU/UK (GDPR) or similar regions are in scope, add the legal bases: contract (running your account), legitimate interests (security, support, logs), consent (optional emails, AI features where required), and legal obligation.]
5. Who can see your information
- You. Your data is private to your account. Other users cannot see it.
- Our administrators, for support. An authorized administrator may open a read-only view of your account to help with support or security. They must write a reason; the view ends automatically after a limited time (currently 30 minutes); it cannot change anything; every view is audit-logged; and you get an in-app notice and can see each access in Profile → Account access log. Administrators cannot see your password.
- Service providers that help us run the Service:
- Microsoft 365 (Microsoft Corporation) sends our emails from support@learnonpaper.com. It processes your email address and the email content.
- xAI (Grok), when we switch on real AI. When you use AI features, we send xAI the text needed for the request: stock symbols, your custom conditions, strategy group names and methodologies, the focus you type when asking for a strategy draft, the text of a note you ask it to read, and, for Advanced groups, the group's simulated positions, simulated cash and recent quotes. We do not send xAI your email address or name. xAI handles this data under its own terms and privacy policy. [LAWYER: review xAI's API data-use and retention terms.] Until then, a built-in sample AI runs on our own server and nothing is sent outside.
- Yahoo Finance provides market quotes, charts and company names. Our server requests this data; we do not send Yahoo your personal information. If you click a "Yahoo" link in the app, Yahoo's website opens in your browser and Yahoo's own privacy policy applies.
- [DOMAIN / DNS PROVIDER: GoDaddy hosts our DNS records; it does not receive your account data.]
- Legal and safety reasons. We may disclose information if the law requires it, or to protect the rights, safety or property of users, the public or us.
- Business transfers. If Interamerican Technology Services Inc. is involved in a merger, sale or reorganization, your information may be transferred, and this notice will continue to apply to it.
6. Where your information is stored
Your account data is stored in a PostgreSQL database on a server we operate in the United States. Emails pass through Microsoft 365, and AI requests (when enabled) go to xAI, which may process data in [xAI PROCESSING LOCATIONS]. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. [LAWYER: cross-border transfer language for Brazil / Latin America / EU users.]
7. How long we keep it
We keep your account information and simulated trading data for as long as your account exists. When your account is deleted (by you in Profile → Delete account, or by us when you ask), it is deleted immediately, except for copies in web server logs and any database backups, and the records listed under "Delete" in Section 9. [RETENTION PERIODS — not yet defined. Suggested to decide: (a) how long expired sessions, used email-link codes, notifications and AI usage logs are kept; (b) web server log retention; (c) database backup retention; (d) support-access audit records, which the system keeps permanently by design.]
8. Security
We protect your information with measures such as: password hashing with argon2id; storing only hashes of session tokens, email-link codes and invite codes; HTTPS with secure, HttpOnly cookies; protection against cross-site request forgery; rate limits on sign-in and email requests; read-only, time-limited, audit-logged support access; and keeping email addresses out of application logs. No system is perfectly secure, so we cannot guarantee security. [LAWYER: breach-notification commitment, if any.]
9. Your choices and rights
- Access and export. You can download your simulated trading data (orders, positions, journal, alerts, notes, cash history, watchlist, portfolio snapshots, Advanced groups and AI analyses) as CSV or JSON from the Reports page. For a copy of other information we hold about you, contact us.
- Correct. You can change your display name and language on your Profile page. To change your email address, contact us.
- Emails. You can turn email on or off for each price alert and note. Account emails (confirmation, password reset) are needed to run your account.
- Delete. You can delete your account yourself in Profile → Delete account. Deletion is immediate and cannot be undone. You can also ask us to delete your account by emailing support@learnonpaper.com; we will respond within [RESPONSE TIME, e.g. 30 days]. After your account is deleted, we keep only the following records, plus any the law requires or allows us to keep:
- a deletion record: your account ID, the date, whether you deleted the account yourself or an administrator deleted it, and whether the account had administrator rights;
- records of any support access to your account, which identify your account by its ID and include the administrator, the reason they wrote, when it started and ended, and which pages they viewed;
- records of administrator-rights changes to your account;
- labels that administrators typed for invite codes, for example the code you signed up with (the record linking that code to your account is deleted); and
- if you were an administrator, your email address and account ID on the records of administrative actions you took.
- Other rights. Depending on where you live (for example, certain US states, Brazil or the EU), you may have more rights, such as to know, correct, delete, restrict or object to processing, or to withdraw consent. To use them, contact us. We will not treat you differently for using your rights. You may also complain to your local data protection authority.
We may need to verify your identity (for example, by confirming your account email) before acting on a request.
10. Children
The Service is not for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this notice
We may update this notice. If we make important changes, we will tell you in the app or by email before they take effect. The "Last updated" date at the top shows when it last changed.
12. Contact us
For privacy questions or requests:
Interamerican Technology Services Inc.
400 NW 127 Ave, Plantation, FL 33325
Email: support@learnonpaper.com