Privacy Notice

Last updated October 15, 2026

This notice explains how GY Capital Group LLC (“GY Capital”, “we”, “us”) collects, uses, shares and protects personal information when you use Kassia: the AI trading assistant at my.kassia.ai, its AI assistant, the optional brokerage connection and related services (together, “Kassia”). The kassia.ai waiting list has its own short notice at kassia.ai/privacy.

1. Information we collect

Information you give us

• Account details: your email address and name, and an optional display name and profile photo.
• Sign-up and plan details: the plan and billing period you choose and, if you tell us, where you heard about Kassia.
• Billing details. Stripe processes your payment card; we never see or store the full card number. We keep the Stripe customer and subscription references that link your plan to your account.
• Questions you ask the AI assistant and the replies.
• Feedback you send, including any screenshots and images. When you open the feedback form it takes a screenshot of the page you are on, which can show account details; you can remove it before sending.
• Trades, notes, imported files and the settings you choose, such as layout, theme, trading-rule overrides and which broker account to use.
• Your answers to the market-data subscriber questions, which decide whether you are a professional or non-professional subscriber.
• Records of what you agreed to: the version of the Terms of Service you accepted, your consent to automatic renewal and the wording shown to you, and any price-change notice you acknowledged, with the time, IP address and browser you used.

Information from your broker, if you connect one

• Your account numbers, balances (including net liquidating value and buying power), positions, orders, fills and transaction history.
• The access token your broker issues when you authorize Kassia. You sign in on your broker’s own page; Kassia never sees your broker password.

Information from other sources

• Your sign-in provider. Sign-in runs on Microsoft Entra External ID, by an emailed one-time code or with Google. We receive an account identifier, your email address and your name.
• The kassia.ai waiting list. We check whether your email address is on it, using a one-way hash, to apply the private preview and founding-member pricing.

Information collected automatically

• Your IP address and browser details, used for security, rate limits and the consent records above.
• Request logs: which part of Kassia was used, the result and how long it took. These logs carry a one-way hash of your account identifier instead of the identifier itself.
• Counts of how many AI messages and other metered features you use each day and month, to apply your plan’s limits.
• Browser storage described in section 5.

2. How we use information

• Provide, operate, secure and improve Kassia, including your dashboards, journal, statistics, reports and the AI assistant.
• Connect to your broker, show your account and send the orders you approve.
• Process payments, manage your subscription and remind you before it renews.
• Send you our newsletter with news about Kassia, such as product updates and offers, matched to your plan. You can unsubscribe at any time (see section 10).
• Answer support requests and feedback.
• Apply plan limits, and detect, prevent and investigate fraud, abuse and security incidents.
• Keep records of what you agreed to, and report subscriber status or counts to exchanges and market-data providers when our data licences require it.
• Comply with the law and enforce our Terms of Service.

We do not use your information to build advertising profiles, and we do not make decisions about you that have legal or similarly significant effects by automated means alone.

3. AI features

• When you use the AI assistant, we send your question and the context needed to answer it to Microsoft Azure AI Foundry, which runs the AI models. Context can include the page you are on, market data and, when it is relevant to your question, your own positions and balances.
• Azure keeps the state of a conversation so it can continue. Kassia may also remember facts from your conversations to make later answers more useful; those memories expire after at most 90 days.
• Under Microsoft’s terms for these services, your prompts and the replies are not used to train Microsoft’s or OpenAI’s foundation models.
• Our staff may use AI to draft replies to feedback and to group feedback by theme. Names and email addresses are removed before feedback is grouped.
• Do not include sensitive personal information, such as government ID numbers or passwords, in your questions.

4. Your brokerage data

• If you connect a broker, Kassia copies your positions, balances, orders and trade history from it and stores them in our database so it can show your journal, statistics and reports and size rules-based setups.
• The access token your broker issues is encrypted before it is stored, and the encryption key is held separately in Azure Key Vault.
• When you disconnect your broker in Kassia, we delete the stored token. You can also revoke Kassia’s access at your broker at any time. Trade records already copied stay in your journal until you ask us to delete them.

5. Cookies and browser storage

• A secure, HTTP-only session cookie that keeps sign-in and broker connection steps working.
• Browser storage used by Microsoft’s sign-in library to keep you signed in.
• Local storage for your preferences, such as theme and layout, for banners you have closed, and to carry the box you ticked at sign-up to your first visit.

Kassia does not use advertising cookies, tracking pixels or third-party analytics, and does not track you across other websites. Because we do not sell or share personal information, there is nothing to opt out of, but we treat a Global Privacy Control signal as an opt-out request. Our newsletter emails are covered in section 10.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers that process it for us under obligations to protect it: Microsoft (Azure hosting, databases, storage, key management, monitoring, sign-in and AI models), Stripe (payments, receipts and billing emails), Kit (our email newsletter), and Google (only if you sign in with Google).
• Your broker, tastytrade, when you connect your account: the requests and orders you send through Kassia.
• Exchanges and market-data providers, when our data licences require us to report subscriber status, counts or identity.
• Our staff, only as needed to support you and run Kassia. Feedback is visible only to staff with the feedback administrator role.
• Legal and safety: when the law or legal process requires it, or to protect the rights, safety and property of GY Capital, our members or others.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, under this notice.

7. Security

We protect information with encryption in transit and at rest, separately held keys for broker tokens, role-based access for staff, and Microsoft Azure’s secured infrastructure. No system is completely secure, and we cannot guarantee absolute security. Keep your sign-in private, and tell us at info@gycapital.net if you think someone else has used your account.

8. How long we keep information

When we no longer need information, we delete it or remove what identifies you.

9. Your choices and rights

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete your information, except what the law requires us to keep; or
• stop using information you gave us with your consent, such as your broker connection.

In Kassia, under Profile → Your data, you can download a copy of your information and delete your account yourself. Deleting your account cancels your plan with a prorated refund of unused time, disconnects your broker, and deletes your profile, settings, feedback and usage records straight away. You choose whether to stay on our newsletter. We keep records of what you agreed to and billing records as the law requires, and our team removes trade records, AI assistant memories, your newsletter record if you unsubscribed, and your sign-in within 45 days. If you sign in again and buy a plan before then, your account reopens: we stop those removals and keep the record of your earlier deletion request. If you tell us why you are leaving, we keep your answer with the record of your deletion request.

You can also export your own trade records from Kassia, disconnect your broker, delete your feedback and profile photo, and change your preferences yourself. For anything else, email info@gycapital.net. We will verify your identity before acting on a request, may accept a request from an authorized agent where the law allows, and aim to respond within 45 days. If we decline a request, you can appeal by replying to our decision. We will not treat you differently for exercising these rights.

Residents of California and other U.S. states with privacy laws: we do not sell or share personal information, and we use financial account information and account access only to provide the services you ask for.

10. Emails from us

We and Stripe, on our behalf, send service emails: receipts, invoices, failed-payment notices, renewal reminders, security notices and notice of material changes to our Terms or this notice. You cannot opt out of these while you have an account.

We also send a newsletter with news about Kassia, such as product updates and offers. It goes out through Kit (kit.com), which receives your email address, first name, plan, billing period, subscription status, any discount on your plan and, if you told us, where you heard about Kassia, so each member gets the news that fits their plan. Kit records when a newsletter is delivered and opened and which of its links are clicked. Every newsletter has an unsubscribe link; unsubscribing stops the newsletter only and does not affect your account or service emails. You can also subscribe or unsubscribe under Profile → Kassia newsletter. If you had unsubscribed and then take a plan, we ask you once whether you would like the newsletter again, and we only subscribe you if you say yes. Each choice you make in Kassia is kept with when you made it, your IP address and your browser, as the record of your consent. If you joined the kassia.ai waiting list, you were already on this newsletter, and that list’s own notice covers the time before you created an account.

11. Third-party services

Kassia links to and works with services run by others, including your broker, Stripe, Kit, Google and Microsoft. Their own privacy policies govern how they handle your information, and we are not responsible for their practices.

12. Children

Kassia is not for anyone under 18. We do not knowingly collect personal information from children, and we delete it if we learn we have.

13. Where information is processed

GY Capital is based in the United States, and Kassia runs in Microsoft Azure data centres in the United States. If you use Kassia from elsewhere, your information is transferred to and processed in the United States, where data-protection laws may differ from those where you live.

14. Changes to this notice

We will post any update here with a new “Last updated” date. If a change is material, we will tell you in the app or by email before it takes effect.

Supplement: account applications and signatures

Version October 15, 2026 · Download PDF

This supplement adds to the Kassia Privacy Notice of GY Capital Group LLC ("GY Capital", "we", "us"). It describes the information we collect when you complete the Kassia account application and sign your agreements, and what we do with it. Where it says something the Privacy Notice does not, this supplement applies.

1. What we collect

• Your full legal name and the email address on your account.
• Your answers to the application's eligibility questions, including whether you or members of your family or household work for, or have relationships with, regulators, exchanges, brokers, banks or other financial institutions, or hold certain public positions.
• The outcome of your application, and any exception our compliance staff approve, with their notes.
• Which version of each agreement and disclosure you were shown, identified by a digital fingerprint (a SHA-256 hash).
• Your acknowledgments, your consent to electronic records, and your choice about sharing your trade history.
• Your signature: the name you typed, or an image of the signature you drew.
• The date and time you signed, your IP address and your browser's identifying string.
• If you join the Private Preview, when it started, how it was granted and, when it ends, when and why.

2. Why we collect it

• To decide whether we can open your account, including whether you qualify as a non-professional market-data subscriber.
• To meet the requirements of the exchanges and data providers whose data Kassia shows.
• To keep a reliable record of what you agreed to, and to show it if a question or claim arises.
• To run the Private Preview and your plan, and to protect Kassia against fraud and misuse.

3. Who can see it

• Your application and signature are stored separately from the rest of your profile, in our cloud storage with Microsoft Azure in the United States, and can be read only by GY Capital staff we have authorized for compliance work.
• We may share your subscriber status, and where required your identity and certification, with exchanges and data providers that require it, and may share your application with our lawyers, auditors and insurers.
• We disclose it to authorities when the law requires.
• We do not sell it, and we do not use it for advertising.

4. How long we keep it

We keep your application, signature and the related records for as long as you have an account, and after your account is deleted for as long as we need them to show what was agreed, to meet our legal and contractual obligations and to deal with claims. Deleting your account does not delete these records, and it ends any Private Preview you hold.

5. Your choices and rights

You have the rights described in the Privacy Notice. Because these records are evidence of a legal agreement, we may keep them even if you ask us to delete them, where the law allows; we will tell you if we do. You can download the agreements you signed in Kassia under Profile at any time.

6. Contact

info@gycapital.net, or GY Capital Group LLC, PO Box 2418, Orlando, FL 32828.

15. Contact us

GY Capital Group LLC
PO Box 2418, Orlando, FL 32828
info@gycapital.net