Privacy Policy

SGA Risk is a product of Smart Growth Assets, Inc. (“we”, “our”, or “us”), which provides standalone, server-side risk management for your connected brokerage and wallet accounts. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the SGA Risk web app and the sgaRisk iOS app.

Our privacy practices are guided by the principles of regulations such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act), and we draw on established information-security standards including ISO 27001. (References to these standards describe the principles we follow; they are not a claim of formal certification.)

Account & identity: your email address and authentication identifiers via SGA Central Auth (single sign-on).

Brokerage connections: trade-enabled API keys or OAuth tokens you choose to connect (e.g. Tradier, Alpaca, Schwab). These are encrypted at rest and used solely to read positions and place the risk-management orders (stops, trailing locks, take-profits) you configure.

Usage & device data: IP address, browser/OS, and app interactions, used for security and reliability.

Billing: subscription status and payment metadata processed by our payment provider (Stripe). We do not store full card numbers.

To operate the risk engine on your connected accounts exactly as you configure it.

To authenticate you, provide support, process subscriptions, and send service notifications.

To secure the platform, detect abuse, and comply with legal obligations.

We do not sell your personal information.

API keys and OAuth tokens are encrypted at rest and transmitted over TLS. SGA Risk never requests or holds withdrawal or fund-transfer rights — connections are limited to reading account data and submitting trade orders. You can disconnect any account at any time, which revokes our access.

We share data only with sub-processors necessary to run the service (e.g. cloud hosting, Stripe for billing, and the brokers you connect), each under contractual confidentiality and security obligations, or where required by law.

We retain information for as long as your account is active or as needed to provide the service and meet legal obligations, then delete or anonymize it. We apply encryption in transit and at rest, access controls, and monitoring; no method of transmission or storage is 100% secure.

Subject to your jurisdiction, you may request access, correction, deletion, or export of your personal data, and may object to or restrict certain processing. To exercise these rights, contact us at the address below.

Questions about this policy? Email [email protected].