Privacy Policy

Tiedbook · Operated by MRSLM Group LLC Last updated: October 20, 2026

Contents

1. Who We Are and Scope
2. Definitions
3. Information We Collect
4. Sources of Information
5. How We Use Information and Our Legal Bases
6. How We Share Information
7. Selling, Sharing and Targeted Advertising
8. Cookies and Similar Technologies
9. International Transfers
10. Retention
11. Security
12. Your Rights and Choices
13. U.S. State Privacy Rights (including California)
14. EEA, UK and Swiss Rights
15. How to Exercise Your Rights
16. Global Privacy Control and Do Not Track
17. Children
18. Changes to this Policy
19. Contact Us and Representatives

1. Who We Are and Scope

1.1 Controller. This Privacy Policy explains how MRSLM Group LLC, a Florida limited liability company doing business as Tiedbook ("Tiedbook," "we," "us," "our"), collects, uses, shares and protects personal information when you visit https://tiedbook.com, use the Tiedbook web application (including the installable web app), use the free Statement Check, or contact us (together, the "Service"). For the purposes of the EU and UK General Data Protection Regulations ("GDPR"), we are the controller of the personal data described here.

1.2 Not covered. This policy does not cover the practices of brokers, trading platforms, prop firms or other third parties, including those whose data you export to Tiedbook or connect through an API key. Their own privacy policies apply.

1.3 Related documents. Read this policy together with our Terms of Service, Cookie Policy, Security overview and Sub-processors list.

2. Definitions

• "Personal information" or "personal data" means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual.
• "Trade Data", "Customer Data", "API Key" and "Third-Party Platform" have the meanings given in our Terms of Service.
• "Processor" or "service provider" means a company that processes personal information on our behalf and under our instructions.

3. Information We Collect

We collect only what we need to provide and improve the Service. The table below explains each category, with examples and whether you must provide it.

Statement Check. When you use the free Statement Check at /check, your file is read and processed inside your browser. We do not receive or store the file or its contents. We may still collect the ordinary usage and device data described above about the visit to the page itself.

Sensitive information. We do not ask for government ID numbers, health information, biometric data or precise geolocation, and we ask you not to upload them. Under some U.S. state laws, account log-in credentials (such as an API Key combined with a username) and financial account information can be considered "sensitive personal information." We use that information only to provide the Service you asked for and for security, not to infer characteristics about you.

4. Sources of Information

• From you, when you register, import files, connect an API Key, enter notes, buy a Subscription or contact us.
• From Third-Party Platforms, at your direction, when you connect read-only sync using your own API Key.
• From Stripe, which tells us about payment status, plan and the limited card details described above.
• Automatically, from your browser or device when you use the Service.
• From advertising and analytics partners, only if enabled (for example, whether a visit that began with an ad led to a sign-up). See Section 7.

5. How We Use Information and Our Legal Bases

We use personal information for the purposes below. For people in the EEA, UK and Switzerland, the GDPR requires us to state a legal basis for each purpose. Where we rely on legitimate interests, we have balanced those interests against your rights; you can ask us for details and you can object (Section 14).

What we do not do. We do not use your Trade Data to trade or to develop trading strategies for ourselves or others; we do not sell it; we do not use it to profile you for advertising; and we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. The Service's "mistake detector" and "edge finder" apply rules to your own data for your own review; they do not make decisions about you.

Machine learning. We do not use your Customer Data to train machine-learning or artificial-intelligence models offered to others. If we ever want to, we will ask for your permission first.

6. How We Share Information

We share personal information only as described below.

6.1 Processors (service providers). We use carefully selected companies to host and run the Service. They may process personal information only on our instructions and under written contracts that require confidentiality and security. The current list, with purpose and location, is at /subprocessors. In summary:

We will update /subprocessors before a new processor begins handling personal information.

6.2 Third-Party Platforms, at your direction. When you connect read-only sync, we send your API Key and the necessary requests to that platform (for example, TopstepX/ProjectX) to retrieve your data. That platform handles the request under its own terms and privacy policy.

6.3 Stripe as an independent controller. Stripe also processes payment data for its own purposes, such as fraud prevention and meeting its legal obligations, under the Stripe Privacy Policy (https://stripe.com/privacy).

6.4 Legal and safety reasons. We may disclose information if we believe in good faith that it is reasonably necessary to: comply with law, regulation, legal process or an enforceable government request; enforce our Terms; detect or prevent fraud, security or technical issues; or protect the rights, property or safety of Tiedbook, our users or the public. Where legally permitted, we will try to notify you before disclosing your Customer Data in response to legal process.

6.5 Professional advisers. We may share information with our lawyers, accountants, auditors and insurers under duties of confidentiality, where needed.

6.6 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's protections. We will notify you of any change in ownership or control of your personal information.

6.7 With your consent. We may share information for other purposes with your consent or at your direction.

7. Selling, Sharing and Targeted Advertising

7.1 No selling. We do not sell personal information, including in the broad sense used by California and other U.S. state laws, and we have not done so in the past 12 months.

7.2 Current position on advertising. As of the "Last updated" date, we do not use advertising cookies or pixels and do not "share" personal information for cross-context behavioral advertising or engage in "targeted advertising" as those terms are defined in U.S. state privacy laws. We do not run Google Ads or any other advertising or analytics tags at launch.

7.3 If we enable Google Ads conversion tracking. We may in future use Google Ads to advertise Tiedbook and use Google's conversion tracking to measure whether our ads lead to sign-ups. If we do:

• a Google tag may set cookies or use similar technologies on our marketing pages to record that a visit came from an ad and whether a sign-up followed, and Google may associate that with information it holds about you under its own policies;
• under California law this may be considered "sharing" personal information for cross-context behavioral advertising, and under other state laws it may be considered "targeted advertising";
• in the EEA, UK and Switzerland, we will not activate these technologies unless you consent through our cookie banner (using Google Consent Mode or equivalent, so that the tag does not set advertising cookies without consent);
• in the United States, we will add a way to opt out in the site footer before activation, and we will treat a Global Privacy Control signal as a valid opt-out (Section 16);
• we will not send your Trade Data, notes or API Keys to Google or any advertising partner; and
• we will update this policy, our Cookie Policy and /subprocessors before activation.

7.4 No financial incentives. We do not offer financial incentives in exchange for personal information.

8. Cookies and Similar Technologies

We use a small number of necessary cookies and similar technologies (such as browser local storage) to keep you signed in, remember your preferences and keep the Service secure. We use analytics or advertising technologies only if enabled and, where the law requires, only with your consent. Full details, including a table of cookies and how to manage them, are in our Cookie Policy.

9. International Transfers

9.1 Where your data is stored. We are based in the United States, and our application and database are hosted on a server in Boston, Massachusetts, USA. Some processors may process data in other countries; their locations are listed at /subprocessors.

9.2 Transfers from the EEA, UK and Switzerland. If you are in the EEA, UK or Switzerland, your personal data will be transferred to the United States. Where required, we rely on: (a) the necessity of the transfer to perform our contract with you (Article 49(1)(b) GDPR) for transfers you initiate by using a U.S.-based service; and (b) for transfers to our processors, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalents, or a processor's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where applicable. We also apply supplementary measures such as encryption in transit and, for API Keys, encryption at rest. You can request a copy of the relevant safeguards by emailing legal@tiedbook.com (commercial terms may be redacted).

10. Retention

We keep personal information only for as long as needed for the purposes described in this policy, then delete or anonymize it. Our standard retention periods are:

We may keep information longer where the law requires it, or where it is needed to establish, exercise or defend legal claims, in which case we will restrict its use to that purpose.

11. Security

We use administrative, technical and physical measures designed to protect personal information, including TLS encryption in transit, encryption of API Keys at rest, one-way hashing of passwords, access restricted to authorized personnel on a need-to-know basis, separation of each user's data in the database, and regular backups. Details are in our Security overview. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the authorities as required by law. Please help by using a strong, unique password and protecting your devices.

12. Your Rights and Choices

12.1 Rights for everyone. Whatever the law where you live, we offer every user the following:

• Access and export. Export your journal from Settings, or ask us for a copy of your personal information.
• Correction. Edit most information in Settings, or ask us to correct it.
• Deletion. Delete your Account and Customer Data in Settings, or ask us to delete it, subject to the limited exceptions in Section 10.
• API Keys. Remove a connected key at any time in Settings, and revoke it with the platform that issued it.
• Marketing email. Unsubscribe using the link in any marketing email. We will still send transactional emails, such as receipts and renewal reminders.
• Cookies. Only necessary storage is in use, so there is no cookie-settings control. You can clear cookies and local storage in your browser. See the Cookie Policy.

12.2 No discrimination. We will not deny you the Service, charge you a different price or provide a different quality of service because you exercised a privacy right. (Deleting your data will, of course, mean we can no longer provide the Service with that data.)

13. U.S. State Privacy Rights (including California)

13.1 Which laws. Residents of California and of several other U.S. states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have specific rights over their personal information. Some of these laws apply only to businesses above certain size thresholds. Whether or not a particular law applies to us, we will honor the rights below for all U.S. residents.

13.2 Your rights. Depending on your state, you may have the right to:

• Know / access what personal information we have collected about you, including the categories, sources, purposes, the categories of third parties we disclose it to, and the specific pieces of information;
• Correct inaccurate personal information;
• Delete personal information we collected from you;
• Portability: receive your personal information in a portable, readily usable format;
• Opt out of the sale of personal information, of sharing for cross-context behavioral advertising, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in these activities currently; see Section 7);
• Limit the use of sensitive personal information (we use it only for purposes that do not require this right to be offered, such as providing the Service you requested);
• Obtain a list of the specific third parties to which we have disclosed personal information (Oregon and Minnesota residents) — see /subprocessors or ask us;
• Appeal our decision on your request (Section 15.5); and
• Not be discriminated or retaliated against for exercising your rights.

13.3 California notice at collection and disclosures (last 12 months). The table below describes the categories of personal information defined in the California Consumer Privacy Act (CCPA) that we collect, the business purposes for which we use them, and to whom we disclose them. Sources are described in Section 4, and retention in Section 10.

We do not knowingly collect personal information of consumers under 16 and we do not sell or share it.

13.4 Authorized agents. You may use an authorized agent to make a request on your behalf. We may require the agent to provide your signed written permission and may ask you to verify your identity directly, unless the agent has a valid power of attorney.

13.5 Nevada. We do not sell covered information as defined under Nevada law.

13.6 California "Shine the Light." We do not disclose personal information to third parties for their own direct-marketing purposes.

14. EEA, UK and Swiss Rights

If you are in the EEA, UK or Switzerland, you have the right, subject to conditions and exceptions in the law, to:

• access your personal data and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data;
• restrict our processing;
• data portability: receive data you provided to us in a structured, commonly used, machine-readable format and have it sent to another controller;
• object at any time to processing based on our legitimate interests, and absolutely to direct marketing;
• withdraw consent at any time where we rely on consent, without affecting processing that took place before; and
• lodge a complaint with your local data-protection authority (for example, the authority in your EU member state of residence, the UK Information Commissioner's Office at ico.org.uk, or the Swiss Federal Data Protection and Information Commissioner). We would appreciate the chance to address your concern first.

Is providing data required? Providing account information is a contractual requirement to use the Service; without it we cannot create an Account. Providing Trade Data and API Keys is optional, but some features will not work without it. Billing information is required to buy a Subscription.

15. How to Exercise Your Rights

15.1 Self-service. Many requests can be completed instantly in Settings (export, correction, API-key removal, account deletion).

15.2 By email. Email legal@tiedbook.com with the subject "Privacy request" and tell us what you would like.

15.3 Verification. To protect your data, we will verify your identity before acting on a request, usually by asking you to confirm the request from the email address on your Account or while signed in. We will ask only for information needed for verification and use it only for that purpose.

15.4 Timing. We will confirm receipt within 10 business days and respond within 45 days (U.S. state laws) or one month (GDPR). Where permitted, we may extend this once by a further 45 days or two months respectively, and we will tell you why. Requests are free unless they are manifestly unfounded or excessive.

15.5 Appeals. If we decline your request in whole or in part, you can appeal by replying to our decision or emailing legal@tiedbook.com with the subject "Privacy appeal" within a reasonable time. We will respond in writing within the period your state's law requires (generally 45 to 60 days), explaining our reasons. If your appeal is denied, you may contact your state Attorney General.

16. Global Privacy Control and Do Not Track

16.1 Global Privacy Control (GPC). We treat a valid Global Privacy Control signal sent by your browser as a request to opt out of the sale and sharing of your personal information and of targeted advertising, for that browser and, if you are signed in, for your Account. Because we do not currently sell, share or target ads, there is presently nothing to switch off, but we will continue to honor GPC if that changes, and where required we will show that your opt-out preference signal has been honored.

16.2 Do Not Track. Browsers' "Do Not Track" setting has no agreed industry standard, so we do not respond to it differently from other traffic. We do not track you across third-party websites.

17. Children

The Service is intended only for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact legal@tiedbook.com and we will delete it.

18. Changes to this Policy

We may update this policy to reflect changes in the Service, our processors or the law. We will post the new version with a new "Last updated" date. If a change is material, for example a new purpose or a new type of sharing, we will notify you by email or in the Service before it takes effect and, where required, ask for your consent.

19. Contact Us and Representatives

MRSLM Group LLC (doing business as Tiedbook) 7095 Hollywood Blvd #484, Los Angeles, CA 90028 Privacy and legal: legal@tiedbook.com Support: support@tiedbook.com

Data Protection Officer. We have not appointed a data protection officer because we are not required to. Privacy questions are handled at legal@tiedbook.com.