We collect the following categories of information:

• Account Data: email address (required), password (bcrypt-hashed), and optionally name, country, and profile avatar. Subscription tier is assigned automatically.
• Payment Data: payment card details are processed by Stripe, Inc. We do not store raw card numbers on our servers — only Stripe customer IDs, transaction references, and the last 4 digits / card brand for receipts.
• Usage Data: IP address (used for session security and fraud prevention), browser type, pages visited, features used, and timestamps.
• Communications: messages sent in the community chatroom, Trading Floor posts, and direct messages.
• Device Data: when using the iOS app, device identifiers, operating system version, and crash logs.

We use your information to:

• Provide and maintain the SurgingMarkets platform and iOS app
• Process payments and manage subscriptions via Stripe
• Deliver real-time trading signals, AI coaching (Surge AI), and community features
• Send transactional emails (receipts, password resets, subscription renewals)
• Improve our platform through analytics
• Comply with legal obligations

All payment processing is handled by Stripe, Inc. (stripe.com). When you subscribe or purchase a product, your card details are entered directly into Stripe's secure elements and are never transmitted to or stored on SurgingMarkets servers. Stripe's Privacy Policy is available at stripe.com/privacy.

In-app purchases made through the SurgingMarkets iOS application use Stripe web checkout — not Apple In-App Purchase. Apple does not receive payment information for SurgingMarkets subscriptions.

We do not sell your personal data. We share limited data with the following sub-processors that help us operate the platform:

• Stripe, Inc. (USA) — payment processing, subscription billing, fraud signals. Data: email, card token, billing address.
• Mailgun (Sinch) (USA) — transactional email delivery (receipts, password resets, alerts). Data: email, message content.
• Pusher Ltd. (UK) — real-time messaging and signal-broadcast infrastructure. Data: user ID, channel name, message payload.
• TwelveData (USA) — market price feed; receives only ticker symbols, no user identifiers.
• Alpaca Securities (USA) — supplementary US equities data; receives only ticker symbols, no user identifiers.
• OANDA Corporation (USA) — FX rate reference data; receives only currency-pair codes, no user identifiers.
• Google Tag Manager / Google Analytics (USA) — anonymised page-view and event analytics, loaded only after you accept the analytics cookie banner.
• Hosting providers — our servers; no third-party data access.
• Law enforcement — only when compelled by valid legal process or to protect our users.

All sub-processors are bound by data-processing agreements. A current list is maintained here and updated when changes occur.

See our sub-processor list →

We retain account data for as long as your account is active. You may request deletion of your account and associated data at any time by emailing support@surgingmarkets.com. Payment records are retained for 7 years for tax and legal compliance. Community posts and messages may be retained in anonymised form.

We use the minimum set of cookies and local-storage entries needed to operate the platform. We do not use third-party advertising cookies.

You can withdraw analytics consent at any time by clearing site data in your browser. Strictly necessary cookies cannot be disabled, but you may sign out to end the session.

The SurgingMarkets iOS app is a WebView wrapper that loads mmm.surgingmarkets.com. All data handling occurs on our web servers, not locally on your device, except for standard iOS WebView caching. We collect crash logs via Apple's crash reporting. We do not access your camera, contacts, or location without explicit permission.

We implement industry-standard security measures including HTTPS/TLS encryption in transit, hashed passwords (bcrypt), rate limiting on authentication endpoints, and regular security reviews. No system is 100% secure — please use a strong, unique password for your account.

If you are in the EU/UK (GDPR / UK GDPR) you have the right to:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your account and associated data.
• Restriction (Art. 18) — limit how we process your data.
• Portability (Art. 20) — receive your data in a machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent at any time without affecting prior lawful processing.

If you are a California resident (CCPA / CPRA) you have the right to:

• Know what personal information we collect, use, and share.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — we do not sell personal information.
• Non-discrimination for exercising your rights.

To exercise any of these rights, email privacy@surgingmarkets.com (or support@surgingmarkets.com) with the subject line "Privacy Request". We respond within 30 days (GDPR) or 45 days (CCPA). You also have the right to lodge a complaint with your local data-protection authority.

SurgingMarkets is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us immediately.

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notice. Your continued use of SurgingMarkets after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data:

• Email: support@surgingmarkets.com
• Website: mmm.surgingmarkets.com