Privacy Policy

1. Your Consent

By providing MockTrade with your Personal Information, you consent to the collection, use, disclosure and retention of that information by MockTrade in accordance with this Privacy Policy and as otherwise permitted by applicable law. You may withdraw your consent at any time, subject to legal or contractual restrictions and on reasonable notice to MockTrade, but then you might not be able to proceed with your intended interactions or transactions with MockTrade or otherwise receive the full benefit of MockTrade’s products and services.

MockTrade does not sell, rent or share your Personal Information with sponsors, advertisers or other third parties for their own marketing purposes. We share Personal Information only as described in Section 4 below.

2. The Information We Collect and How We Collect It

MockTrade collects a limited amount of Personal Information from participants who register on mocktrade.io. As a condition of registration, every participant provides:

• a name (displayed to the educator of any class you join, and on class leaderboards);
• an email address (used as your login identifier and for transactional messages); and
• a password, which is stored only as a salted one-way hash and is never visible to us or to anyone else.

Participants also select an account type (student or educator). Students who are joining a class may supply a class invite code provided to them by their educator.

Educators. Educators who create a class may additionally provide information about that class, such as the class name and description, subject, academic level, textbook, estimated number of students, and billing or invoicing contact details where an institutional plan is purchased.

Simulation activity. As you use the simulation, we record the activity you generate on the platform: simulated orders and trades, virtual portfolio holdings and cash balances, watchlists, performance metrics and class rankings. This is simulated activity involving no real money, real securities or real brokerage accounts.

Investment Policy Statement. MockTrade offers an optional Investment Policy Statement tool. It is entirely voluntary: you may use every other part of the platform without it, and nothing is collected under this heading unless you choose to fill it in. Because the tool exists to model a real financial picture, the information it collects is more sensitive than anything else described in this Section. If you use it, we store what you enter, which may include:

• your age, planned retirement age, province, marital status, household income structure, employment stability, and the number and ages of any dependants;
• a monthly budget — sources of income, living, food and personal expenses, and loan and credit card payments;
• assets and their values (including residences, vehicles, bank accounts and registered and non-registered investment accounts) and debts owing against them;
• financial goals, target amounts and target dates, and your retirement income expectations;
• your answers to questions about your investment experience, financial literacy, risk tolerance and financial capacity to absorb loss; and
• any existing insurance coverage you record.

We also store the figures the tool calculates from those answers, such as a required rate of return, a target asset allocation and suggested insurance coverage amounts. You may edit or clear these answers at any time, and deleting your account deletes them with it.

Payment information.Subscription payments are processed by Stripe, Inc. Credit and debit card numbers are submitted directly to Stripe and are never received, processed or stored on MockTrade’s systems. We retain only a Stripe customer identifier, a subscription identifier, and your plan and subscription status.

Technical information. Our servers and infrastructure providers automatically log information such as IP address, browser type and operating system, pages requested and timestamps, for security, fraud prevention, abuse monitoring and diagnostic purposes.

Enquiries. If you contact us through the contact form, sales enquiry or demo request on mocktrade.io, we collect the contact details and message you submit in order to respond.

3. Purpose of the Information

MockTrade collects Personal Information from our participants to operate the simulation and for educational purposes. Your name allows educators to keep track of an individual participant’s performance, activity and class ranking. Your email address enables us to contact you about class and contest updates, results, and other information that may be of interest to you, and is also used for transactional email such as registration confirmation and password reset requests. Your simulation activity is used to calculate your portfolio, performance metrics and leaderboard position, and to produce the reports and exports available to you and to the educator of your class. Billing information is used to provide, renew and support paid subscriptions. Technical information is used to keep the service secure, available and working correctly.

Where you choose to complete an Investment Policy Statement, the information you enter is used for one purpose only: to generate that statement back to you and to keep it available so you can revisit and revise it. We do not use it to profile you for marketing, we do not use it to make decisions about your account, eligibility or pricing, and we do not combine it with your simulation activity for any other purpose.

4. To Whom We Disclose the Information

MockTrade is the sole owner of the information collected through mocktrade.io. We do not sell or rent the Personal Information of our users. Data is retained for the purposes of operating the website and enabling educators to monitor and evaluate the performance of the participants in their own classes. We may share or disclose your Personal Information with certain third parties, but only in ways disclosed in this Privacy Policy or with your express consent.

Educators.The educator who owns a class has access to the Personal Information of the participants enrolled in that class, and to their simulation activity and results (trade history, virtual portfolio details, performance metrics, rankings and roster exports). This access is limited to the classes that educator owns; an educator cannot see participants in another educator’s class. Names of participants appear in class leaderboards visible to other members of that class. MockTrade may publicize the names of winners of public contests as we deem appropriate.

Your Investment Policy Statement is not shared with educators. It is visible only to you. Educators, other participants and class leaderboards have no access to it, it does not appear in any roster or class export, and it is not used in ranking. It is not disclosed to any third party other than the database and hosting providers listed below, who store it on our behalf.

Third-Party Processors.We may disclose your Personal Information to contractors or service providers who provide services or perform functions on our behalf (“Third-Party Processors”), including:

• Supabase, Inc. — managed PostgreSQL database hosting and authentication. All account and simulation data described in Section 2 is stored here;
• Amazon Web Services, Inc. — application hosting and scheduled job infrastructure;
• Stripe, Inc. — subscription billing and payment processing.

These Third-Party Processors are permitted to use your Personal Information only for the purpose for which it has been provided and may not disclose it to any other third party except at our express direction and consistently with this Privacy Policy.

Market data displayed in the simulation is supplied by third-party market data providers (including Yahoo Finance, Polygon.io and Alpha Vantage). We do not send your Personal Information to these providers; we request price and company data only.

We may also disclose Personal Information where required to comply with a law, regulation, subpoena or court order, to enforce our Terms & Conditions, or to protect the rights, property or safety of MockTrade, our users or others. If MockTrade is involved in a merger, acquisition or sale of assets, we will provide notice before your Personal Information is transferred and becomes subject to a different privacy policy.

5. Internet-Based Advertising

MockTrade does not display third-party advertising. We do not use interest-based or targeted advertising services, advertising vendor cookies, advertising pixels, or cross-site advertising trackers on mocktrade.io, and we do not share identifiers such as your IP address or a hashed email address with advertising networks or data brokers.

6. Cookies

MockTrade uses cookies. Cookies are small files that a site or its service provider transfers to your device through your web browser (if you allow) that enable the website’s systems to recognize your browser and remember certain information.

The cookies we set are strictly necessary for the website to function:

• an authentication session cookie, which keeps you signed in and identifies your account to the server;
• a security token used to protect forms against cross-site request forgery; and
• a preference cookie recording your light or dark theme selection.

Stripe may set cookies on its own hosted checkout and billing pages in order to process payments and detect fraud; those pages are governed by Stripe’s privacy policy.

You may choose to decline or disable cookies if your web browser permits, but doing so will prevent you from signing in to or using mocktrade.io. You can find out more about how to manage cookies at allaboutcookies.org/manage-cookies.

7. Data Security and Retention

At MockTrade we take numerous steps to ensure that the Personal Information of our users is securely maintained. We collect only a minimal amount of Personal Information at registration. Passwords are stored only as salted one-way hashes and are never stored or transmitted in readable form. All the user data and Personal Information that we collect is stored in Supabase’s managed PostgreSQL platform, a professional cloud hosting environment which is SOC 2 Type II compliant and which features a managed firewall, automated backups, restricted physical access, encryption of data in transit and at rest, redundancy and regular security audits. Payment card data is never held by MockTrade.

Personal Information and other data of inactive users is purged from our database after 24 months of inactivity for student participants and individual account holders, and after 60 months of inactivity for educators and administrators (for example teachers and professors). This purge includes any Investment Policy Statement, which is deleted along with the rest of the account. You may request deletion sooner at any time under Section 9, and you may clear your Investment Policy Statement yourself at any time without deleting your account.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Opting Out of Changes To This Privacy Policy

From time to time we may modify or update this Privacy Policy, which modification shall be effective immediately upon posting on the site, so please be sure to check back periodically. If we make any changes that materially affect our practices with regard to the Personal Information we collect or have previously collected, we will endeavor to provide you with notice in advance via email or an in-product notice. If you do not agree with any material changes to this Privacy Policy, you may opt out of those changes by emailing us within 30 days of the effective date of the updated Privacy Policy, in which case your registration will be cancelled and you will not be able to use the website or participate in any ongoing or future contests. If you do not opt out during those 30 days, or you continue to access or use the website after the changes have become effective, you will be deemed to be bound by the updated Privacy Policy.

9. Corrections, Modifications and Deletions of Personal Information

To correct Personal Information you have submitted, to request that it be deleted, or if you have any questions about this Privacy Policy, please use the contact form on mocktrade.io or send an email to privacy@mocktrade.io.

Parents and guardians of users under 18 years of age can contact us to review, modify or delete the Personal Information of their children by using the contact form on mocktrade.io or by emailing privacy@mocktrade.io.

Where MockTrade processes student information at the direction of a school, district or other educational institution, we act as a service provider or school official under applicable student privacy laws, including the Family Educational Rights and Privacy Act (FERPA). Requests from students or parents relating to records held on behalf of a school should be directed to the school, and we will support the school in responding.

10. Data Breach

In the event of an unauthorized release, disclosure or acquisition of your Personal Information that compromises the security, confidentiality or integrity of your Personal Information maintained by MockTrade (a “Data Breach”), MockTrade shall notify you within a reasonable time after the incident, and in any event within the time period required by applicable law. Notices of Data Breach incidents will be sent to the email address associated with your account and posted on mocktrade.io. MockTrade will adhere to all applicable governmental requirements with respect to a Data Breach related to your Personal Information.

The security breach notification shall include, to the extent known by MockTrade, a list of the types of Personal Information that were or are reasonably believed to have been the subject of the Data Breach and, if known at the time of the notice, the date or estimated date of the Data Breach and a general description of the incident. MockTrade maintains a written incident response plan that reflects best practices and is consistent with industry standards and the requirements of governmental authorities for responding to a Data Breach relating to Personal Information.

Residents of Canada should also read Section 22, which sets out our additional reporting obligations under PIPEDA.

11. Resolving Complaints

If you have any concerns about the way MockTrade is handling your Personal Information, please let us know immediately. You may email us directly at privacy@mocktrade.io with the subject “Privacy Concerns”. We will do our best to respond as soon as possible. You may also contact us at:

Sapio Analytics
[STREET ADDRESS]
[CITY, STATE / PROVINCE, POSTAL CODE]
[COUNTRY]

If you are not satisfied with our response, the regional notices below explain how to escalate to a supervisory authority or privacy commissioner.

12. Data Controller

For purposes of the General Data Protection Regulation (the “GDPR”) and the UK GDPR, we are the data controller in respect of your Personal Information collected and used through your use of the website, products and services. This is because we determine the purposes for which your Personal Information is used and how we use it.

13. Automated Decision Making

MockTrade does not monitor or profile you for advertising, marketing, eligibility or pricing purposes, and does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

For completeness, the optional Investment Policy Statement described in Section 2 does calculate figures from the information you enter, including an investor profile, a required rate of return, a target asset allocation and suggested insurance coverage amounts. We draw it to your attention here because it evaluates personal financial and behavioural information. It differs from automated decision-making in every respect that matters:

• it runs only when you choose to use it, on figures you supply and can change or clear at any time;
• its output is educational information returned to you, not a determination we make about you;
• it has no bearing on your account, your access to the platform, your pricing, your standing in any class, or anything else we do; and
• every assumption it relies on is disclosed in the statement it produces, so you can see how each figure was reached and are free to disregard it.

It is not investment, tax, insurance or legal advice, and it is not a substitute for a qualified professional.

14. Your Rights Under the GDPR

Under the GDPR, you have the following eight (8) rights:

• The right to be informed. Anyone processing your personal data must make clear what they are processing, why, and who else the data may be passed to.
• The right of access. This is your right to see what data is held about you by a controller of your data.
• The right to rectification. The right to have your data corrected or amended if what is held is incorrect in some way.
• The right to erasure.Under certain circumstances you can ask for your personal data to be deleted. This is also called ‘the Right to be Forgotten’. This would apply if the personal data is no longer required for the purposes it was collected for, or your consent for the processing of that data has been withdrawn, or the personal data has been unlawfully processed.
• The right to restrict processing. This gives you the right to ask for a temporary halt to processing of personal data, such as where a dispute or legal case has to be concluded, or the data is being corrected.
• The right to data portability. You have the right to ask for any data supplied directly to the controller of the data to be provided in a structured, commonly used and machine-readable format.
• The right to object. You have the right to object to further processing of your data which is inconsistent with the primary purpose for which it was collected, including profiling, automation and direct marketing.
• Rights in relation to automated decision making and profiling. You have the right not to be subject to a decision based solely on automated processing.

To exercise any of these rights, email privacy@mocktrade.io. You also have the right to lodge a complaint with your national supervisory authority.

15. Transferring Data Internationally

MockTrade transfers personal data that we have collected from you and stored to Third-Party Processors located in countries outside the EEA and the United Kingdom, including the United States. MockTrade shall not transfer such personal data to a country or territory outside the EEA or the UK unless the transfer is made to a country or territory recognized by the European Commission (or, for the UK, by the UK government) as providing an adequate level of data protection, or is made subject to appropriate safeguards such as the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, or is otherwise permitted under the GDPR and the UK GDPR. We will comply with the GDPR, the UK GDPR and the Data Protection Act 2018 in respect of any such transfer.

By using this website, you consent to the transfer of your Personal Information to the Third-Party Processors located in countries outside the EEA and the United Kingdom.

16. Legal Bases for Processing Your Data

• Performance of a contract. We process your registration details, class enrollment, simulation activity and billing information because it is necessary to provide you with the website, products and services you have signed up for.
• With your consent. We use Personal Information you have provided where you have given clear consent for the processing of that Personal Information for a specific purpose, such as responding to a sales or demo enquiry.
• To comply with any legal or regulatory obligations (including in connection with a court order) and to protect and enforce MockTrade’s legal rights, interests and remedies, and to protect the business operations and customers of MockTrade or other persons.
• To protect our legitimate interests.The processing is necessary for our legitimate business interests, unless there is a good reason to protect the individual’s Personal Information which overrides those legitimate interests. For example, we use your Personal Information to provide customer support and service, for research and development purposes, and to protect your safety and security, including the monitoring of suspicious activity and fraud.

17. Application of Canadian Privacy Law

Sapio Analytics is established in Ontario, Canada. Our collection, use and disclosure of Personal Information is subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, to substantially similar provincial legislation, including Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act, and Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

Where a provision of this Additional Notice conflicts with a provision elsewhere in this Privacy Policy, this Additional Notice governs in respect of residents of Canada.

18. Accountability and Our Privacy Officer

Sapio Analytics is accountable for the Personal Information under its control, including information transferred to the Third-Party Processors named in Section 4. We have designated a Privacy Officer who is responsible for our compliance with this Privacy Policy and with applicable Canadian privacy legislation. The Privacy Officer may be reached at:

[PRIVACY OFFICER NAME AND TITLE]
Sapio Analytics
privacy@mocktrade.io

19. Consent Under PIPEDA

We collect, use and disclose your Personal Information only with your knowledge and consent, except where collection, use or disclosure without consent is permitted or required by law. Consent is express where you provide Personal Information during registration, when you subscribe to a paid plan, or when you submit an enquiry to us. Consent may be implied where the purpose is obvious and you voluntarily provide the information, such as your continued use of the Simulation generating trading activity in a class you have joined.

The form of consent we seek is proportionate to the sensitivity of the information. We do not require you to consent to collection, use or disclosure beyond what is necessary to provide the Websites as a condition of using them.

You may withdraw your consent at any time, subject to legal or contractual restrictions and on reasonable notice, by contacting privacy@mocktrade.io. We will tell you the likely consequences of withdrawal, which will generally include closure of your account, removal from any class you have joined, and loss of access to your virtual portfolio and performance history.

20. Access, Correction and Accuracy

On written request, we will inform you of the existence, use and disclosure of your Personal Information and give you access to that information, and we will tell you to whom it has been disclosed where we are able to do so. We will respond to an access request within 30 days, or tell you within that period if we require an extension permitted by law.

We may refuse access in the limited circumstances permitted by PIPEDA, including where the information contains references to other individuals that cannot be severed, where disclosure would reveal confidential commercial information, or where the information is subject to solicitor-client privilege. If we refuse a request, we will give our reasons in writing and tell you how to complain.

You may challenge the accuracy and completeness of your Personal Information and have it amended as appropriate. Most account information can be corrected directly in your account settings; for anything else, contact privacy@mocktrade.io.

21. Transfers and Storage Outside Canada

Your Personal Information is stored and processed outside Canada, including in the United States, by the Third-Party Processors named in Section 4. We use contractual and other means to provide a comparable level of protection while the information is being processed by them.

While your Personal Information is located outside Canada, it is subject to the laws of that jurisdiction, and may be accessible to the courts, law enforcement and national security authorities of that jurisdiction under those laws. By using the Websites, you acknowledge this transfer and storage.

22. Breach of Security Safeguards

Where a breach of security safeguards involving your Personal Information creates a real risk of significant harm to you, we will report the breach to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible, as required by PIPEDA. Our notification will describe the circumstances of the breach, the Personal Information involved, the steps we have taken to reduce the risk of harm, and the steps you can take to reduce that risk. We will also notify any organization or government institution that may be able to reduce the risk of harm. We maintain records of every breach of security safeguards involving Personal Information for at least 24 months, and will provide those records to the Office of the Privacy Commissioner on request.

23. Additional Rights of Quebec Residents

If you are a resident of Quebec, the following additional rights apply under Law 25:

• Person in charge. The Privacy Officer identified in Section 18 is the person in charge of the protection of personal information for the purposes of Law 25.
• Confidentiality by default. Any technological product or service we offer to you with privacy settings provides, by default, the highest level of confidentiality without any intervention by you.
• Automated decision making. As stated in Section 13, we do not make decisions about you based exclusively on automated processing. The Investment Policy Statement tool calculates figures at your request and returns them to you; it is not a decision made about you and has no effect on your account. If this changes, we will inform you at or before the time of the decision and, on request, tell you what personal information was used, the reasons and principal factors leading to the decision, and give you an opportunity to submit observations to a member of our personnel able to review the decision.
• Data portability. You have the right to receive the computerized Personal Information you have provided to us in a structured, commonly used technological format, and to have it communicated to any person or body authorized by law to collect it.
• De-indexing and cessation of dissemination. You may require us to cease disseminating your Personal Information, or to de-index any hyperlink attached to your name that provides access to that information, in the circumstances set out in Law 25.
• Privacy impact assessments. We conduct a privacy impact assessment before communicating Personal Information outside Quebec and before any project to acquire, develop or overhaul an information system involving Personal Information, as required by Law 25.
• Complaints. Quebec residents may also complain to the Commission d’accès à l’information du Québec.

24. Complaints to a Regulator

If you are not satisfied with our response to a privacy concern raised under Section 11, you may complain to the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
priv.gc.ca

Residents of Alberta, British Columbia and Quebec may instead complain to their provincial privacy commissioner.