Oval is early
Oval is in its paper-trading phase. No real money moves through the platform today, nobody funds an account, and no investor brokerage account exists. This document describes what we actually collect and share today, not what we will collect once real-money investing, identity verification, and account funding open. When those launch, we will update this document and tell you before the new collection or sharing starts.
1. Who this applies to, and what it covers
1.1 This document covers personal information Oval collects through the platform: from investors, followers, and managers.
1.2 It does not cover information you give to any third-party site the platform links to.
1.3 Where this document uses “we” or “Oval,” it means Oval’s investment advisory business.
2. What we collect today
2.1 What everyone gives us to create an account. Your name, email address, and password. Supabase, our authentication provider, stores your password in hashed form; we do not store or see it in plain text.
2.2 What a manager or an investor placing a pledge gives us. To place a pledge or to publish a strategy as a manager, we collect additional information: your legal first and last name, date of birth, mailing address, and the last four digits of your Social Security number. This is information the platform collects and stores directly today. It is used to verify who you are well enough to attribute a pledge or a published strategy to a real person, and to prepare for the identity verification real-money investing will eventually require. We do not collect your full Social Security number, and we do not run this information through a third-party identity-verification or background-check service today, even though the platform’s onboarding flow shows steps that describe what that verification will look like once it is live.
2.3 What we collect about a strategy, not about you. Trading and performance data generated by a strategy, calculated on simulated capital, is information about the strategy, not personal information about any individual follower who tracks it.
2.4 What we collect automatically. Standard web request data, like IP address and browser type, collected by Vercel as part of serving the platform to you.
2.5 What we do not collect today. We do not connect to your bank account, we do not collect your bank account or routing number, we do not run a credit or background check, and we do not collect government-issued identity documents. The platform’s onboarding flow references steps that will do these things once real-money investing opens; none of them are active today, and none of them transmit your information anywhere when you encounter them.
3. Why we collect it
3.1 To create and maintain your account and communicate with you about it.
3.2 To let you place a pledge or publish a strategy, and to attribute that pledge or strategy to a real, identifiable person.
3.3 To operate the marketplace: showing strategies, rankings, and public performance figures, and letting managers and investors find each other.
3.4 To prepare the account-level information real-money investing will eventually require, so that onboarding does not have to start over when it launches.
3.5 To improve the platform, using aggregated or de-identified data wherever that is sufficient for the purpose.
4. Who we share it with today
4.1 We do not sell your personal information.
4.2 We share personal information with the following vendors, for the purposes stated. We do not share more than each vendor needs to do its job for us.
- Supabase, our database and authentication provider. Supabase stores your account, profile, and platform data on our behalf, under a data-processing arrangement, and does not use it for its own purposes.
- Vercel, our hosting and content-delivery provider. Vercel serves the website and app and processes standard web request data, like IP address, as part of doing so.
- Resend, our transactional email delivery vendor. Resend sends account and notification emails on our behalf and processes the email address and message content needed to do that.
- Market-data vendors. We purchase company, sector, and security data from market-data vendors to classify strategies and holdings. This is data about companies and securities, not about you, and we do not share your personal information with these vendors.
- Professional advisers, including our lawyers and accountants, where necessary for their work.
- Regulators and law enforcement, where required by law, subpoena, or a valid legal process.
- With your consent, for any purpose not listed above that you specifically agree to.
4.3 What we do not share today. We do not share your personal information with Alpaca or with any identity-verification or background-check vendor today, because no brokerage account exists yet and no such verification runs today. When real-money investing opens, this section will be updated to name the vendors involved, what each receives, and why, before that sharing starts.
5. How long we keep it
5.1 We keep account and platform records for as long as our recordkeeping obligations as a registered investment adviser require, and in any event for as long as your account exists plus a reasonable period afterward to resolve any dispute or comply with law.
5.2 Information we no longer need for a legal or business purpose is deleted or de-identified on a schedule we review periodically.
5.3 Where you exercise a deletion right under section 8 below, we will explain if and why a record is retained instead of deleted, for example because law requires us to keep it.
6. How we protect it
6.1 We use administrative, technical, and organizational safeguards designed to protect your personal information, including encryption in transit, access controls limiting who inside Oval can see what, and vendor agreements requiring our service providers to protect data at least as well as we do.
6.2 No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the appropriate regulators as required by law.
7. Your privacy rights
7.1 You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by contacting us at compliance@ovalmarketplace.com.
7.2 We will verify your identity before acting on a request, using information we already have about you, to make sure we are not disclosing or deleting the wrong person’s data.
7.3 We will not discriminate against you for exercising any right in this document, including by denying you service or providing a different level of service, except to the extent a right cannot be honored while you continue to use the platform, for example, you cannot both delete your account information and continue to hold an active account with us.
8. Cookies and analytics
8.1 The platform uses cookies for functionality only today, for example, staying logged in. We do not run any third-party analytics or advertising tool on the platform today.
8.2 If that changes, we will update this section before any new cookie or analytics tool goes live, and where required by law, we will ask for your consent first.
9. Children’s privacy
9.1 The platform is not directed at, and is not intended to be used by, anyone under the age of 18. We do not knowingly collect personal information from anyone under 18.
9.2 If we learn that we have collected personal information from someone under 18, we will delete it, except where law requires us to retain it.
10. Changes to this policy
10.1 We may update this document. Where a change materially changes how we use or share your personal information, including when real-money investing opens and new vendors like Alpaca or an identity-verification provider begin receiving your information, we will notify you before the change takes effect. Where a change is not material, the updated document takes effect when posted.
11. How to reach us
11.1 Questions about this document, or about our privacy practices generally, can be sent to compliance@ovalmarketplace.com.