Privacy Policy

This Privacy Policy explains what personal data Bukhari Software LLC ("we", "us") processes when you use VERDAXIS at http://localhost:3000 (external site), why, for how long, and what choices you have. Document version 2026-10-18.

Who is responsible

The operator of VERDAXIS and the party responsible for your personal data is Bukhari Software LLC, LLC registered in California, USA (registration number 202358617761), 1707 N Maple Ave, Apt 112, Fresno, CA 93703, USA.

For any privacy question or request, write to [email protected].

What the product does

Verdaxis is a web-based research workspace for structuring trading ideas as hypotheses and running paper simulations of simple strategy templates on synthetic sample data. It does not connect to brokers or exchanges, does not hold funds and does not execute trades.

Data we collect

We collect only what the product needs:

Data	When	Why
Email address	When you request access or subscribe to the newsletter	To send sign-in and confirmation links, to identify your account, and — only if you opted in — to send the newsletter
Workspace content	When you save it in the tool	To provide the tool: research notes, hypotheses, simulation settings, saved simulation runs and your written conclusions
Session record	While you are signed in	To keep you signed in (a random token; we store only its hash)
Consent records	When you accept the Terms, opt in to or out of the newsletter	To demonstrate what you agreed to, which document version and when
Language preference	When you choose a language	To show the site and emails in that language
Rate-limit counters	When you submit a form	To prevent abuse. Keys are one-way hashes of your email or network address and expire within hours
Product analytics events	Only if you allow analytics in cookie settings	To understand which features are used. Events contain no email, name or IP address

We do not collect passwords (sign-in is by email link), payment details, brokerage or exchange credentials, government identifiers, or precise location. We do not store IP addresses in our database. Our hosting provider's web server may keep standard access logs, including IP addresses, for security and troubleshooting for a limited time.

Please do not enter personal data about other people, or sensitive personal data, in free-text fields of the tool.

How we use data and on what basis

Providing the service you asked for — sign-in, saving and exporting your workspace, sending the emails you request. Basis: performance of our agreement with you (the Terms of Use).
Newsletter — only after you confirm your subscription (double opt-in). Basis: your consent, which you can withdraw at any time.
Security and abuse prevention — rate limiting and form protection. Basis: our legitimate interest in keeping the service available and safe.
Product analytics — only if you enable it. Basis: your consent.
Funnel measurement — we record, once per account, that an email address was confirmed and that the tool was first used successfully. These internal records are tied to your account and deleted with it. Basis: our legitimate interest in understanding whether the product works for people.
Legal obligations — where the law requires us to keep or disclose information.

We do not sell personal data, do not use it for profiling with legal or similarly significant effects, and do not share it for cross-context behavioural advertising.

Email delivery and other service providers

We use service providers that process data on our behalf, under contracts that limit their use of it:

Hosting and database — to run the website and store account and workspace data.
Email delivery — an email service provider sends sign-in, confirmation and newsletter emails on our behalf.
Advertising and analytics tags — only if enabled by the operator and you consent in the cookie settings (see the Cookie Policy).

The specific providers used in production are listed on request at [email protected].

Retention

Data	How long
Sign-in and confirmation links	Single use; expire after 30 minutes (sign-in) or 48 hours (newsletter); records deleted 7 days after expiry
Sessions	Up to 30 days of inactivity, or until you sign out
Account and workspace content	Until you delete it, or after 730 days without a sign-in, when the account and its content are deleted automatically
Unconfirmed newsletter sign-ups	30 days
Newsletter records after unsubscribe	30 days, as proof that you opted out, then deleted
Consent records	As long as the related account or subscription exists
Product analytics events	395 days
Rate-limit counters	Expire within hours; deleted within 2 days

Automatic deletion runs daily. Backups, if the operator keeps them, are overwritten on a rolling basis.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or the California Consumer Privacy Act), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent at any time, and not to be discriminated against for exercising these rights.

You can do most of this yourself:

Download your data — Settings → "Download my data".
Delete your workspace data or your whole account — Settings. Deletion is immediate.
Stop the newsletter — the unsubscribe link in every newsletter email, or Settings.
Change cookie choices — "Cookie settings" in the footer.

For anything else, email [email protected]. We may need to confirm that the request comes from the owner of the email address. You may also lodge a complaint with your local data protection authority.

International transfers

Bukhari Software LLC is based in the United States, and our providers may process data in the United States or other countries. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.

Security

Sign-in links and session tokens are random, single-use or time-limited, and stored only as hashes. Connections are encrypted (HTTPS). Access to the database is restricted. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you where required by law.