We collect little. We sell nothing.

This policy covers personal data processed through prop.localrootsstudio.com, the trading platform we provision, and our support channels. It applies alongside the Terms of Service. Third-party services you use around ours (your broker of choice, your Discord account, your charting tools) have their own policies.

• Account data — name, email address, screen name, country, and a hashed password. You provide these at signup.
• Order & payment data — plan purchased, price paid, coupon used, and a payment token from our processor with the last four digits of the payment method. We never receive or store full card numbers.
• Simulated trading activity — orders, fills, balances, and rule-compliance metrics generated inside the evaluation platform. This is what the product scores.
• KYC data at first payout — collected once, through a specialist verification vendor: government-issued ID and a liveness/likeness check. We receive the pass/fail result and matching details, not a copy pipeline of your documents into our own systems. See the AML / KYC Policy.
• Support communications — emails and tickets you send us.
• Analytics & logs — IP address, device and browser type, and page events, used for security and to understand aggregate product usage.

• To provide the service: accounts, scoring, dashboards, payouts.
• To process payments and prevent payment fraud.
• To meet legal obligations: sanctions screening, identity verification, tax documentation, record-keeping.
• To answer support requests.
• To secure the platform: abuse detection, enforcement of the one-identity rule, log analysis.
• To send service emails (receipts, rule-version notices, security alerts) and — only with your consent — product updates you can unsubscribe from in one click.

We share personal data only with vendors who process it on our instructions, under contracts that restrict use to our purposes:

The named vendor list is finalized at launch and available on request at support@prop.localrootsstudio.com. We may also disclose data when the law requires it, to enforce our Terms, or as part of a merger or acquisition — in which case the successor inherits this policy’s commitments.

• We do not sell or rent your personal data. We also do not sell, license, or share your trading data with trading firms, market makers, or anyone who might mirror it in live markets.
• We do not run third-party advertising trackers on the site.
• We do not display your legal name on leaderboards or public pages — screen names only, unless you explicitly opt in.
• We do not use your KYC documents for anything other than the verification and record-keeping described in the AML / KYC Policy.

We use a session cookie to keep you signed in (strictly necessary) and first-party analytics to measure aggregate usage. We do not set cross-site advertising cookies, and we honor Global Privacy Control signals where a legal opt-out right applies. Blocking non-essential cookies in your browser will not break the platform.

• Account & trading data — life of the account plus 24 months, then deleted or anonymized.
• KYC records — 5 years after account closure, as required by anti-money-laundering practice.
• Payment & payout records — 7 years, for tax and accounting law.
• Server & security logs — 12 months.
• Support threads — 24 months after the last message.

Regardless of where you live, you can email support@prop.localrootsstudio.com to: access the personal data we hold about you, export it in a portable format, correct inaccuracies, or delete your account and data (subject to the legally required retention periods in Section 7). We verify requests against your registered email and respond within 30 days. We never charge for a first request and never retaliate for exercising a right.

If you are in the European Economic Area or the United Kingdom, our legal bases are: contract (providing the service you purchased), legal obligation (KYC, sanctions, tax records), legitimate interests (security, abuse prevention, aggregate analytics), and consent (marketing email, which you may withdraw at any time). You additionally have the rights to restrict or object to processing and to lodge a complaint with your supervisory authority. Data is processed in the United States; where GDPR applies, transfers rely on the European Commission’s Standard Contractual Clauses with our processors.

Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Texas, and Virginia) have rights to know, access, correct, delete, and obtain a portable copy of their personal data, exercised as described in Section 8 — including through an authorized agent. We do not sell or share personal data as those laws define it, and we do not use sensitive personal data for anything beyond providing the service and meeting legal obligations, so there is nothing to opt out of. California residents: the categories we collect are listed in Section 2; we have disclosed them for the business purposes in Sections 3–4 and have sold none.

The service is restricted to adults 18 and older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account and its data.

Passwords are hashed, transport is encrypted (TLS), payment data is tokenized at the processor, and internal access to personal data is limited to staff who need it. No system is breach-proof; if a breach affects your personal data, we will notify you and the required regulators without undue delay.

Changes to this policy are published here with a new version number and effective date; material changes are announced to registered users by email at least 14 days before they take effect.

Privacy requests and questions: support@prop.localrootsstudio.com. A postal address for formal notices will be published at entity formation.