Privacy Policy

Last updated: August 14, 2026

1. Who we are

This Privacy Notice for POLIFLY.AI LLC, a New York limited liability company doing business as Polifly ("we", "us", or "our"), describes how and why we access, collect, store, use, disclose, and otherwise process ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at polifly.ai or any other site or app that links to this notice
• Create an account, sign in, or use the Polifly app or APIs
• Submit screenshots, text, prompts, or files to our AI tools
• Connect a wallet, provide a Polymarket trading key, or enable copy trading
• Purchase a subscription or communicate with us for support, sales, marketing, or events

POLIFLY.AI LLC is the "business" responsible for your personal information under US state privacy laws and the "data controller" under the EU and UK GDPR. Our mailing address is available on request by emailing polifly.ai@gmail.com.

2. The short version

We collect what we need to run Polifly, keep it secure, comply with the law, and make it better. We do not sell your personal information for money, and we do not run third party advertising pixels. Some analytics cookies may still qualify as "sharing" or "targeted advertising" under certain US state laws, even when no money changes hands. You can opt out any time. See Section 8.

3. What we collect

Information you provide:

• Account info: email, display name, password hash, and basic profile info if you sign in with Google
• Payment info: handled by Stripe or Whop. We receive limited billing details such as the last four digits of your card, brand, country, and transaction status. We never see your full card number or CVV
• User Content: screenshots, images, text, prompts, wallet addresses, and files you submit to the AI
• Trading and wallet info: public wallet addresses you enter or connect, and, if you enable copy trading, the Polymarket trading credentials you provide to us
• Paper trading activity and preferences
• Support communications and any info you include in them

Information we collect automatically:

• Device and connection info: IP address, user agent, browser, operating system, device identifiers, language, and approximate location derived from IP
• Usage info: pages viewed, features used, timestamps, referrers, error and diagnostic logs

Cookies, local storage, and SDKs (see Section 8)

Information from third parties:

• Google or other identity providers if you use them to sign in
• Stripe or Whop for subscription and payment status
• Public blockchain data associated with wallets you or others make available on chain
• Prediction market APIs (such as Polymarket or Kalshi) for market data and, where applicable, your account activity

4. Why we use it and legal basis (EU/UK)

• Provide the Services (contract): run your account, process payments, generate AI outputs, execute copy trades you set up
• Operate, secure, and improve (legitimate interest): analytics, fraud and abuse prevention, debugging, product improvement
• Marketing and non essential cookies (consent): promotional emails you can unsubscribe from at any time
• Comply with law (legal obligation): tax and accounting, responding to lawful requests, sanctions screening
• Vital interests / defending claims (legitimate interest): preventing harm, establishing or defending legal claims

You can withdraw consent at any time by emailing polifly.ai@gmail.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

5. Sensitive personal information

Under CPRA and similar US state laws, some of the information you give us is treated as sensitive personal information. That can include your account login, wallet address, Polymarket trading credentials, and detailed financial or trading activity. We use this information only to provide the features you asked for (such as authentication or copy trading), keep the Services secure, prevent fraud, and comply with the law. You have the right to limit its use to those purposes. Email polifly.ai@gmail.com with the subject "Limit SPI" and we will honor the request.

6. Automated decision making

Polifly generates AI outputs (probability estimates, suggested positions, coaching notes) using large language models and related systems. These outputs are informational only and do not by themselves produce legal or similarly significant effects on you. We do not use them for automated decisions about credit, employment, housing, insurance, or similar consequential matters. If we ever introduce such automated decision making, we will describe it here and provide the rights the law requires.

7. Who we share it with

We share personal information with service providers who process it on our behalf under written contracts. These include cloud hosting and database providers, payment processors (Stripe, Whop), email and messaging providers, analytics and error monitoring providers, AI model and inference providers (such as OpenAI and Google), and security tools. We may also disclose information: (a) to comply with law, court orders, or lawful requests; (b) to protect our rights, users, or the public; (c) to enforce our Terms; (d) in connection with a merger, acquisition, financing, sale of assets, or bankruptcy; and (e) with your consent or at your direction. We do not sell your personal information for money.

8. Cookies, tracking, and your ad choices

We use cookies, local storage, SDKs, and similar technologies to keep you signed in, remember preferences, measure usage, secure the Services, and understand how features perform. We do not run third party advertising pixels. Under CPRA and other US state privacy laws, some analytics data flows can still qualify as "sharing" or "targeted advertising" even when no money is exchanged.

Do Not Sell or Share and Opt Out of Targeted Advertising: email polifly.ai@gmail.com with the subject "Do Not Sell or Share" and we will apply the opt out to your account.

Global Privacy Control: we recognize a valid GPC browser signal as an opt out of sale and sharing.

Do Not Track: browsers still send a DNT header but there is no agreed industry standard for responding to it, so we do not act on DNT alone. Use GPC or email us instead.

9. AI processing and third party content

Screenshots, text, and prompts you submit are sent to the AI providers we use to generate outputs. Their handling is governed by their own terms and privacy policies. Outputs are informational only and can be inaccurate, incomplete, or out of date. Do not rely on them for medical, legal, financial, or other consequential decisions.

Do not upload screenshots or content that contain another person's personal, medical, financial, or otherwise sensitive information without a lawful basis. You are responsible for what you submit about third parties and we do not maintain a consent trail for people who are not our users. If you accidentally upload such content, email polifly.ai@gmail.com and we will delete it.

10. Wallets and copy trading credentials

If you enable copy trading, you provide a Polymarket trading key so we can place trades on your behalf on the account you connect. We encrypt those credentials at rest before storing them, restrict access to them, and never expose them to other users. No system is fully secure, so only connect a wallet you are willing to risk.

You are responsible for keeping your own accounts, seed phrases, and devices secure. We are not liable for losses caused by third parties, platform outages, phishing, or how you handle your own keys. Nothing in this policy tries to waive liability that cannot be waived by law, including for gross negligence, willful misconduct, or fraud.

11. Security and breach notification

We use TLS in transit, encryption of sensitive credentials at rest, access controls, logging, and standard security practices. You are responsible for keeping your password safe, using a strong unique password, and enabling any additional protections we offer. No service can promise absolute security. If a data breach affecting your personal information occurs, we will notify you and any regulator as required by applicable law.

12. How long we keep your data

These are our default retention periods. We may keep data longer where the law requires or shorter where you ask us to delete your account, unless we have a legal reason to keep it (for example tax, fraud, or defending legal claims).

• Account and profile: life of the account plus 30 days after deletion
• Payment and billing records: 7 years, to meet tax and accounting rules
• Trading activity and copy trading logs: 24 months after account closure
• AI submissions (screenshots and prompts): up to 90 days
• Support communications: 24 months
• Security and audit logs: 12 months
• Encrypted backups: rolling window up to 35 days

13. Your rights

If you are in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law:

• Know what we collect, use, disclose, and share
• Delete your personal information
• Correct inaccurate personal information
• Receive a portable copy

Opt out of sale, sharing, or targeted advertising (see Section 8)

Limit use and disclosure of sensitive personal information (see Section 5)

• Non discrimination for exercising your rights
• Where available, appeal a denial of your request by replying to our response
• Where available, use an authorized agent, with proof of authorization

Nevada residents can request that we do not sell certain covered information. We do not sell such information, but you can still submit a request to polifly.ai@gmail.com.

If you are in the EEA, the UK, or Switzerland:

• Access, rectification, erasure, restriction, portability, and objection
• Withdraw consent at any time where processing is based on consent
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects

Lodge a complaint with your local supervisory authority (for example the UK ICO or your national data protection authority in the EU)

To exercise any of these rights, email polifly.ai@gmail.com from the email address on your account. We will verify your identity and respond within the timeframe required by applicable law. We do not charge a fee unless a request is manifestly unfounded or excessive.

14. Third party platforms

We link to and integrate with third party platforms such as Polymarket, Kalshi, Stripe, Whop, Google, and OpenAI. Their privacy practices are their own. Please review their policies before you use them.

15. Children

Polifly is for adults only and is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, email us and we will delete the account and the information.

16. Updates to this policy

We may update this policy from time to time. The latest version will always be on this page and the "Last updated" date will reflect the change. For material changes we will provide reasonable notice through the Services or by email. Continued use after a change means you accept the updated policy.

17. Contact

Questions about your data or this policy? Email polifly.ai@gmail.com. POLIFLY.AI LLC is the business responsible under US state privacy laws and the data controller under GDPR and UK GDPR. Our mailing address is available on request.