Privacy Policy

Who we are

NANO Prop is an independent prop-firm intel and reviews desk, operated by NANO Prop LLC, a Wyoming (USA) limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, USA. For anything in this policy, email desk@nanoprop.info. NANO Prop LLC is the controller of the personal data described below.

What we collect

• Newsletter: your email address when you subscribe, handled by our email provider.
• Account: your email and password when you create an account. Passwords are handled by our authentication provider; we never see them in plain text.
• Desk data you provide: prop-firm accounts, costs, payouts, reviews, goals, journal and day logs, strategy assumptions, risk plans, trade-risk entries, budgets, and preferences.
• Connected-service data: if you opt in, linked-bank account descriptors and matched transaction records, billing or checkout state, referral or creator records, and device-notification registration.
• Service and security activity: notification history, bounded rate-limit counters, and cookieless analytics events such as pages, referrers, and low-cardinality tool actions. We do not send form inputs or desk amounts as analytics properties.

Why we use it, and our legal basis

• To send the newsletter you asked for (your consent).
• To run your account and show you your own logged data (performance of a contract).
• To provide optional bank linking, billing, referrals, creator earnings, notifications, and abuse prevention when you use those features (performance of a contract and legitimate interest, as applicable).
• To build anonymized, aggregated firm statistics, shown only at a minimum sample size of five so no individual is identifiable (legitimate interest).
• To keep the service secure and working (legitimate interest).

Bank and card connections (Plaid)

Connecting a bank or card is optional. If you choose to, we use Plaid to link it. Plaid asks for your permission and handles the bank login directly. We never see, receive, or store your bank username or password.

With your permission we access your transactions and basic account details. We use them for one thing: to identify covered prop-firm charges in the synced records we can match, so you can cross-check them against what you logged yourself. This is a bounded identified-charge view, not a complete statement of everything you spent. We do not use this data for advertising, profiling, or anything else.

The access token that lets us read your transactions is stored encrypted at rest and is only ever used on our server, never sent to your browser. You can disconnect any linked account at any time from your bank page. Disconnecting tells Plaid to revoke our access and deletes that connection along with the transactions and account details we synced from it.

Who processes your data

We rely on a small set of processors and share only what each one needs:

• A database and authentication provider (EU/US): stores your account data and signs you in.
• An application hosting provider (US) and its cookieless, privacy-first analytics.
• A DNS and content-delivery provider (US).
• A newsletter delivery provider (US): your email address, only if you subscribe.
• A transactional email provider (US): sign-up confirmation and password resets (your email address).
• Plaid (currently supported for U.S.-held institutions only): optional bank and card connections. Plaid’s own privacy policy governs what it does with the data you give it. EU/UK institution linking is not currently available.
• An AI conversation provider (US): powers the optional in-app “desk chat”. If you use it, your message and separately bounded desk fields requested through the chat tools (for example, your account list or payout summary) are processed by that provider and the AI language model it runs to generate a reply. Each tool call can return one field rather than the whole desk snapshot; a conversation may make more than one such call as you ask different questions.
• An AI composition provider (US): helps select the optional “desk analyses”. Only when you request one, our software turns exact evidence fields from your logged record into a bounded list of pre-written claim options. That list — not the full evidence bundle, source paths, or journal-note excerpts — is sent to the provider. A provider-side JSON Schema constrains the normal response to a flat array drawn from the exact allowed IDs. NANO still treats the returned data as untrusted: it independently accepts only those exact IDs and rejects every other shape or value before rendering the final text. Nothing is sent without your request.
• A public blockchain explorer, queried only if you ask us to verify an on-chain payout (we send a transaction reference, not personal data).
• A third-party form host (US): our optional, anonymous trader survey.

Use of AI

The optional “desk chat” uses a third-party AI language model to answer questions and prepare typed drafts. The model cannot add an account, payout, or cost to your records: NANO shows the exact draft in a first-party confirmation card, and only your explicit Add action can run the ordinary deterministic writer. Unconfirmed drafts expire. The provider receives the message you send and may call separately bounded tools that each return one desk field; it does not receive a preloaded whole-desk snapshot.

The optional “desk analyses” use a second third-party AI language model to select from claim options that NANO has already written and tied to exact evidence fields, meanings, and units. The provider request constrains its normal response to a flat JSON array drawn from those exact allowed IDs. Refusals, truncation, and returned data are still checked locally and have no direct persistence path: NANO accepts only the exact allowlisted IDs, renders the final plain-words text itself, and shows the frozen evidence beside it. An invalid, blocked, or failed analysis is not shown. NANO attempts to return its reserved usage credit; if that return is delayed, the artifact reports it and opening the artifact makes another return attempt.

NANO Prop does not train its own model on your data. Third-party retention and training controls depend on the provider terms and account configuration in effect when you use these features; those contractual settings are not proven by this code. Outside these two features, the site — our stats, rankings, and cost/plan tools — is ordinary software doing arithmetic on your inputs, not AI.

Selling and sharing

We do not sell or rent your data to anyone, and we do not use it for third-party advertising. We share data only with the processors above, and only to run the service.

Cookies

We use essential session cookies to keep you signed in. We do not set analytics or advertising cookies; our analytics integration is configured to be cookieless and receives bounded event labels rather than your form inputs or desk amounts.

How long we keep it

Newsletter membership continues until you unsubscribe; deleting a NANO account does not unsubscribe a separate newsletter record. NANO account and desk records remain until you delete the account. Resolved desk-chat proposals and their review trail become eligible for removal after at least 30 days; a proposal stuck in confirmation or locked for integrity review is retained until its possible desk write is safely reconciled. Expired internal chat capabilities and logout-race fences become eligible for removal after at least a seven-day security window once no proposal depends on them. Deletion first asks the billing provider to stop any known renewable membership, then revokes linked Plaid access, and only after both are confirmed removes the sign-in and account-linked database records. If provider cleanup cannot be confirmed — including a legacy subscription, an unresolved bank-link exchange, or an exposed checkout that the provider has not retired — we keep the account and provider binding for retry or support instead of claiming erasure while access or billing may remain. If you answer the optional exit question, only the selected reason category remains without your account ID; no free-text response is kept. Already-aggregated statistics may remain where they no longer identify you. Payment, email, AI, analytics, and other processors may retain records under their own policies or legal duties; their exact retention periods are governed by each provider’s own policy and contract.

Your rights

You can:

• Access and export your data.
• Correct anything that is wrong.
• Delete your account and your data.
• Withdraw newsletter consent at any time (every email has an unsubscribe link).
• Object to or restrict certain processing.
• Complain to your local data protection authority.

How to exercise your rights

You can download a portable copy of your account and desk records, and delete your NANO account records, yourself from account settings. The download deliberately excludes security credentials, internal anti-abuse/model values, and other members’ identifiers, and lists those exclusions. For a broader access review, a correction, restriction, objection, or a processor-related request, email desk@nanoprop.info from the address on your account. See the Contact page for more.

International transfers

Some processors may handle data outside the EU and EEA. The transfer mechanism for each provider depends on the provider, location, and contract in force. The applicable agreement may use an adequacy framework or standard contractual clauses; this repository does not prove which safeguard applies.

Children

NANO Prop is not intended for anyone under 18. Prop-firm trading is not a product for minors.

Changes

If we change this policy we update the date above, and we flag material changes in the newsletter.