Privacy Policy

Warren Labs, Inc. (“Warren Labs,” “we,” “us,” or “our”) operates Orqis, an AI-powered strategy generation, validation, and execution platform for cryptocurrency trading. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the Orqis platform, including our website, application, and related services (collectively, the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

We use the information we collect to:

• Provide the Service — authenticate your account, generate and validate trading strategies, execute paper and live trades, and manage your portfolio
• Process payments — manage subscriptions via Stripe and calculate, crystallize, and settle performance fees
• Send notifications — alert you to trade executions, fee events, system alerts, access approvals, and platform updates
• Enforce access controls — apply region-based restrictions, subscription tier limits, and fee enforcement
• Improve the Service — analyze strategy performance patterns, train advisory ML models (using aggregated, non-personally-identifiable trading data), and improve the chat assistant
• Maintain security — rate-limit abuse, detect anomalies, and maintain audit logs for administrative actions
• Comply with legal obligations — respond to lawful requests from government authorities

We use the following third-party services that may receive, process, or store your data. Each operates under its own privacy policy.

We take the security of your exchange credentials seriously. Private keys are handled as follows:

• Encryption at rest — all private keys are encrypted with AES-256-GCM (authenticated encryption with a unique random initialization vector per key) before being written to the database. Keys are never stored in plaintext.
• Encryption in transit — all communications between services use HTTPS/TLS.
• Minimal decryption — private keys are only decrypted in server-side memory when needed for specific operations: executing trades, processing withdrawals, or an admin-approved key reveal. Keys are never sent to your browser.
• Key reveal requires admin approval — if you request to view your full private key, the request must be explicitly approved by a Warren Labs administrator before the key is decrypted.
• Revocation — you can revoke an exchange connection at any time. Revocation clears the encrypted key from our database. Revoked connections are retained as metadata for audit purposes only (without the key).
• Privy-managed wallets — for wallets created via Privy, the key is generated server-side using a 1-of-2 key quorum (user + server authentication key). The private key is exported, encrypted, and stored by Orqis. Privy’s own security policies also apply.

Your data is stored in a Supabase-hosted PostgreSQL database in the United States. Backend services run on Google Cloud Platform in the us-west2 region. The web application is hosted on Vercel’s global CDN.

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention details:

• Account data — retained while your account exists
• Trading history & strategy data — retained indefinitely for performance tracking, learning models, and audit purposes
• Fee records & capital flow events — retained indefinitely for financial audit compliance
• Chat conversations — retained while your account exists; threads can be archived
• Admin audit logs — retained indefinitely (append-only, immutable)
• Exchange credentials — encrypted key retained until you revoke the connection; connection metadata retained for audit
• Waitlist & access request entries — retained until processed or deleted upon request

Row-level security (RLS) policies in our database ensure that authenticated users can only access their own data.

We use analytics tools to understand how the Service is used and to improve performance:

• Google Analytics — collects page views, interaction events, browser type, device information, and referral sources. This is loaded via Google Tag Manager and uses cookies. You can opt out via your browser settings or a Google Analytics opt-out extension.
• Vercel Analytics — collects API performance and deployment metrics. This runs automatically on Vercel-hosted applications.
• Vercel Speed Insights — collects Core Web Vitals and page performance metrics.

We do not use tracking pixels, fingerprinting, or cross-site advertising trackers.

We send transactional emails via Resend for the following purposes:

• Access request approvals and invitations
• Waitlist confirmations and spot-available notifications
• Trade notifications (position opened, closed, filled)
• Critical system alerts and daily digest summaries
• Fee notices (fee due, fee overdue, fee payment confirmed)

These are service-related communications, not marketing emails. We do not sell your email address to third parties or send promotional emails unless you have explicitly opted in to a newsletter.

We do not sell your personal information. We share data only in the following circumstances:

• Service providers — with the third-party services listed in Section 4, solely to operate the Service
• Exchange execution — your wallet address and signed transactions are submitted to Hyperliquid for trade execution and withdrawals
• Legal compliance — if required by law, subpoena, or court order
• Business transfer — in connection with a merger, acquisition, or sale of assets, with notice to affected users
• Aggregated data — we may use aggregated, de-identified trading performance data to improve ML models and platform intelligence. This data cannot be used to identify individual users.

Depending on your jurisdiction, you may have the right to:

• Access your personal data and request a copy
• Correct inaccurate personal data (e.g., update your display name or email)
• Delete your personal data, subject to legal retention requirements. Chat memory stored in Mem0 supports explicit deletion on request.
• Revoke exchange connections to remove stored encrypted credentials
• Object to or restrict certain processing
• Data portability — request your data in a structured, machine-readable format

To exercise any of these rights, contact us at hello@warrenlabs.ai. We will respond within 30 days.

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

Our services are hosted primarily in the United States (Supabase, Google Cloud us-west2, Vercel global CDN). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last updated” date. For significant changes, we may also notify you via email. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us at: