Privacy Policy

1. 1. Who we are
2. 2. Scope of this Policy
3. 3. Information we collect
4. 4. How we use information
5. 5. AI and automated decision-making
6. 6. How we share information
7. 7. Data retention
8. 8. Security
9. 9. Cookies and tracking
10. 10. Your rights and choices
11. 11. Gramm-Leach-Bliley Act (GLBA) notice
12. 12. Sub-processors
13. 13. Data breach notification
14. 14. International data transfers
15. 15. Children's privacy
16. 16. Changes to this Policy
17. 17. Contact us

Zoro is operated by Breaking Equity, Inc. (dba "Zoro"). For privacy questions, you can reach us at privacy@zoro.trade.

Zoro is not a broker-dealer, investment adviser, or custodian. Zoro does not hold customer funds or securities. All brokerage activity occurs at independent third-party brokers that you separately authorize.

This Policy covers:

• The zoro.trade website and the Alpha Program waitlist
• The Zoro Alpha product (the trading agent platform), once made available to invited users
• Any related emails, communications, and other interactions you have with Zoro

This Policy does not cover:

• The privacy practices of brokerages you connect to Zoro (e.g., Alpaca, Interactive Brokers, Schwab, E*TRADE, Robinhood, Tastytrade, Tradier, Coinbase). Those brokers are independent controllers of your account information and have their own privacy policies.
• The privacy practices of identity providers you use to sign in (X, Apple, Google), or of email/SMS providers and analytics vendors except as described below.
• Third-party websites linked from our site.

3.1 Information you provide directly

On the waitlist landing page (today):

• Email address when you request access to the Alpha Program
• Any messages you send to us (e.g., support inquiries sent to our contact address)

In the Alpha Program (when invited and onboarded):

• Account credentials: identity from your chosen single sign-on provider (X, Apple, or Google), and a phone number or email used for one-time-password multi-factor authentication
• Profile and personalization: chosen Zoro username, self-reported trading goals, experience level, risk philosophy, and strategy preferences
• Agent configuration: the trading strategies, parameters, prompts, and natural-language instructions you create or modify for your trading agents
• Backtest inputs and results you generate within Zoro
• Acceptances: your acceptance of Zoro's Terms of Service, this Privacy Policy, product disclosures, and permission scopes
• Support and feedback: any information you share during onboarding calls, check-ins, or product feedback sessions

3.2 Information collected automatically

When you visit the website or use the Alpha product, we automatically collect:

• IP address
• Device and browser information (device type, operating system, browser type and version, screen size, language)
• Approximate location derived from IP address
• Usage data (pages visited, links clicked, time spent, referrer URL, session timestamps)
• Cookies and similar technologies for session management, security, anti-fraud, and basic analytics (see Section 9)

We use this metadata for security, fraud prevention (such as detecting duplicate or abusive signups), and to understand how our site and product are used.

3.3 Information received from brokerages (Alpha Program only)

Brokerage connections use OAuth. Your broker authenticates you and may require multi-factor authentication (MFA). You authorize the permissions for the connection. After consent, Zoro retrieves a limited set of information from the broker via API, including:

• Your legal name as recorded at the broker (for record-keeping and display)
• Account type (cash, margin, IRA, joint, etc.)
• Margin approval status (so Zoro can prevent margin-requiring orders from being routed to non-margin accounts)
• Options trading approval level (0–4, so Zoro can gate which options strategies your agents may execute)
• Holdings, balances, and order/transaction history for accounts you connect
• Where the broker exposes it, self-reported suitability information (income, employment, net worth) used solely as a personalization signal to improve agent suggestions

Important: Identity-verification and regulatory data — such as your date of birth, residential address, Social Security number or Taxpayer Identification Number, government-issued ID, tax classification (W-9 / W-8BEN), AML/sanctions screening results, FINRA affiliations, trusted-contact information, and beneficiary designations — are collected and held by your broker, not by Zoro. Zoro does not pull, store, or process this information.

3.4 Information from third parties

• Identity providers (X, Apple, Google): when you sign in via SSO, we receive a unique identifier and, depending on your settings with that provider, your name and email.
• Brokerage aggregator (Snap Trade): many broker connections are routed through Snap Trade, our brokerage-integration partner. Snap Trade processes OAuth handoffs and brokerage API traffic on our behalf. See Section 6.
• Analytics, email delivery, and infrastructure providers: see Section 6.

3.5 Information we do not collect

• We do not collect payment card numbers, bank account numbers, or other financial-account credentials on the waitlist site. Funding and withdrawals occur at your broker.
• We do not request or store your brokerage username and password. Connections use OAuth, where authentication happens on the broker's site.
• We do not knowingly collect personal information from anyone under 18.

We use the information we collect to:

• Operate the waitlist, including sending you transactional emails about your request for access (confirmation, status updates, and selection or non-selection notification)
• Communicate with you about the Alpha Program, product changes, security notices, and (where permitted) marketing messages you can opt out of
• Provide the Alpha product: authenticate you, connect your broker, run your agents, route orders to the broker, surface backtests and risk signals
• Personalize the product, including suggesting agents and strategies based on your stated preferences and (where available via the broker) account-level signals
• Operate AI-powered features, including translating natural-language strategy descriptions into agent configurations, generating strategy ideas from market context, and producing portfolio analyses. See Section 5.
• Compute analytics and risk metrics, both for your own floor (e.g., Sharpe ratio, drawdown, concentration) and, in aggregated and de-identified form, across the Zoro user base to detect strategy crowding and similar systemic signals
• Maintain security and prevent abuse, including detecting suspicious sign-ins, rate-limiting, and detecting trading abuse
• Comply with legal obligations and enforce our Terms of Service
• Improve the product: review information to support users and debug issues, conduct internal research and analytics, and use anonymized information for internal model training and evaluation as described in Section 5.4

Legal bases (for users in the EU/UK)

Where the EU or UK General Data Protection Regulation applies, we rely on the following bases: performance of a contract (operating your account and agents); your consent (marketing, optional features, cookies where required); our legitimate interests (security, fraud prevention, product analytics, communicating with waitlist members who asked to hear from us); and legal obligations.

5.1 Where AI is used

The Zoro product uses artificial intelligence, including large language models ("LLMs") and other algorithmic systems, to power several features:

• Strategy translation — converting natural-language strategy descriptions you write into structured agent configurations
• Personalized agent and strategy suggestions — AI generates suggestions using your stated preferences and account-level signals. Generating or displaying a suggestion does not execute a trade.
• Portfolio and performance summaries — explaining what your agents did and why, and summarizing floor performance
• Risk scoring and gating — computing per-agent and floor-level risk metrics (Sharpe, drawdown, concentration, autocorrelation, regime fit) used to warn you before agent deployment
• AI-generated suggestions do not automatically change capital allocations between your agents.

5.2 How decisions are made

You choose which agents to deploy and configure their settings. You can also manage your account directly through your brokerage. The following describes how Zoro handles agent actions and suggestions:

• Agent deployment, pause, edit, bench, and retire are explicit user actions
• Order generation is performed by the trading strategy you (or an agent author you selected) configured. Zoro routes those orders to your broker; the broker accepts or rejects them. Zoro does not exercise human or AI discretion over individual orders.
• Zoro does not automatically reallocate capital between your agents. You can disconnect Zoro or pause or bench your agents and manage trades and positions directly in your brokerage app. Orders already submitted to your broker may still execute; check order and position status with your broker.
• Managing trades directly at your broker is separate from overriding a warning, deployment restriction, or pause within Zoro. Broker rules and restrictions continue to apply.

5.3 Automated decision-making technology ("ADMT") notice

Under California's CCPA regulations effective January 1, 2026, certain uses of AI to make or substantially replace human decisions about consumers require additional disclosure. Where Zoro's risk-gating features operate without a human-in-the-loop and affect your access to financial services (for example, blocking a deployment that breaches a hard risk gate), you have the right to:

• Be informed before that automated process is applied to you (this Policy is that notice)
• Access meaningful information about how the system works, including the categories of inputs used, the categories of outputs generated, and how outputs are used in the decision
• Opt out of the automated decision, where an exemption does not apply, and request that a human review be performed instead
• Appeal an automated decision and request human review

To exercise any of these rights, contact privacy@zoro.trade. We will respond within the timeframes required by applicable law. Where you opt out of automated risk-gating, you accept responsibility for risk decisions that the system would otherwise have made on your behalf.

5.4 Training and model improvement

When you use AI features, your inputs (strategy prompts, configuration, market context, and related data) and the outputs generated for you are processed by AI services, which may include third-party model providers operating under contract with Zoro. We contractually require these providers not to use your inputs or outputs to train their general-purpose foundation models. Authorized Zoro staff may review strategy prompts, configurations, trading data, and AI outputs to support users, investigate errors, and improve the product. Zoro may use anonymized information derived from this content for internal model training and evaluation datasets. This internal training and evaluation use is limited to information that does not reasonably identify you.

We do not sell personal information. We share information only as described below.

6.1 Service providers

We use third-party service providers ("sub-processors") to operate Zoro. They process information only on our behalf, under contract, for the purposes we specify. Current categories include:

• Brokerage aggregator — Snap Trade, which routes brokerage OAuth and API traffic for most supported brokers
• Brokerage APIs — direct integrations with Alpaca, Interactive Brokers, Robinhood, Tastytrade, Tradier, and others, depending on the broker you connect
• Identity providers — X, Apple, Google (when you use SSO)
• Market and reference data providers — for delayed and real-time price data feeds
• Cloud hosting and infrastructure
• Email and SMS delivery providers — for transactional and waitlist emails and OTPs
• Analytics and error monitoring — including PostHog for product analytics
• AI/LLM providers — for the features described in Section 5

6.2 Brokerages you connect

When you connect a brokerage account, we share with that broker the information needed to authenticate the connection and route the orders you authorize (e.g., order parameters generated by your agent). What the broker does with your information is governed by the broker's own privacy policy and account agreements.

6.3 Legal, safety, and compliance

We may disclose information if we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our agreements; protect the rights, property, or safety of Zoro, our users, or others; or detect, prevent, or address fraud, security, or technical issues.

6.4 Corporate transactions

If Zoro is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.

6.5 With your direction

We may share information with third parties when you direct us to (for example, if you opt in to share an agent or backtest publicly, or if you connect an additional integration).

6.6 Aggregated and de-identified information

We may share aggregated or de-identified information — information that cannot reasonably identify you — for any business purpose. For example, we may publish statistics about Alpha cohort performance or strategy diversity.

We keep personal information for as long as needed to provide the service and for legitimate business or legal purposes. Our standard retention periods are:

• Account profiles and saved chats: retained while you maintain your account or keep the information in the product. Following account closure or an applicable deletion request, we delete this information from active systems within 30 days, except for the specific records retained for the purposes described below.
• Backups: deleted information expires from backups within 90 days after deletion from active systems. Backup copies are not used for routine product operations, and deletions are reapplied if a backup is restored.
• Trade and order audit records, identity-verification records where collected, and consent or agreement records: we retain the minimum records needed to meet obligations applicable to Zoro, document authorizations, and establish, exercise, or defend legal claims. Retention depends on the record, its purpose, and any applicable legal requirement or legal hold. Brokerage recordkeeping periods do not automatically determine Zoro's retention periods.
• Strategies, agent configurations, prompts, and backtests: retained while you keep them in the product. Following an applicable deletion request or account closure, we delete them from active systems within 30 days, subject to the specific retention exceptions in this section. Pausing, benching, or retiring an agent is distinct from requesting deletion and may preserve its history.
• Logs and analytics: routine diagnostic logs are retained for up to 90 days. Security logs and identifiable product-analytics records, including PostHog analytics, are retained for up to 12 months. Specific records may be retained longer for a documented security investigation or legal hold.
• AI inputs and outputs: Zoro retains prompts and outputs in your account history while you keep the related content. Following an applicable deletion request or account closure, we delete these records from active systems within 30 days, subject to the exceptions in this section. Processing copies held by AI service providers are separate from Zoro's account history and are governed by the applicable service and contractual terms.

When information is no longer needed for the purposes described above, we delete or anonymize it. We review the continuing need for anonymized training and evaluation datasets, and their re-identification risk, at least annually. Information that can reasonably be linked back to an individual remains subject to the applicable personal-information retention schedule.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, OAuth-based broker authentication (so Zoro does not handle broker credentials), MFA for user accounts, and monitoring. No system is perfectly secure. You are responsible for keeping your SSO and broker credentials safe and for promptly notifying us of any suspected unauthorized access at security@zoro.trade.

We use a small number of cookies and similar technologies for:

• Strictly necessary purposes (session management, security, anti-fraud, load balancing)
• Functional purposes (remembering preferences such as theme)
• Analytics to understand site and product usage, including PostHog

Where required by law, we will ask for your consent before setting non-essential cookies. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

We do not currently use cookies to serve targeted advertising. If that changes, we will update this Policy and provide appropriate choices.

Global Privacy Control (GPC) and Do Not Track. We recognize the Global Privacy Control signal as a valid opt-out of "sale" and "sharing" of personal information for California residents and for users in other jurisdictions where the signal is required by law. Because we do not sell or share personal information for cross-context behavioral advertising, the GPC signal does not change our current practices for you, but we will continue to honor it if our practices change. Our response to legacy "Do Not Track" headers depends on the browser; there is no industry consensus on its interpretation.

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your information
• Portability — request a copy in a portable format
• Objection or restriction — object to, or ask us to restrict, certain processing
• Withdraw consent — withdraw consent where processing is based on consent (without affecting processing already carried out)
• Complaint — lodge a complaint with your local data protection authority

To exercise these rights, email privacy@zoro.trade. We will verify your identity before fulfilling a request. We will respond within the timeframe required by applicable law.

You can also submit a request through our privacy request webform. This is the second designated method required by CPRA § 999.312.

Marketing emails: every marketing email contains an unsubscribe link. Transactional messages (security alerts, waitlist status updates, trade confirmations) are tied to your account and cannot be unsubscribed without closing your account.

California residents (CCPA/CPRA). If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act and the CCPA Regulations effective January 1, 2026:

• Right to know what personal information we collect, the sources, the purposes, and the categories of recipients
• Right to access a copy of your personal information
• Right to correct inaccurate personal information
• Right to delete personal information, subject to legal exceptions
• Right to limit the use and disclosure of sensitive personal information
• Right to opt out of "sales" or "sharing" of personal information for cross-context behavioral advertising
• Right to opt out of, and request human review of, automated decision-making technology, as described in Section 5
• Right to non-discrimination for exercising these rights

Zoro does not sell personal information and does not share personal information for cross-context behavioral advertising.

Some financial information we receive from your broker is "subject to" the Gramm-Leach-Bliley Act and is therefore partially exempt from the CCPA's substantive requirements. See Section 11 for our GLBA notice. CCPA protections continue to apply to non-GLBA information (for example, your strategy prompts, agent configurations, and website-usage data).

Categories of personal information collected, used, and disclosed in the last 12 months. The following table maps the categories of personal information defined by CCPA § 1798.140(v) to what Zoro collects, the business purposes, and the categories of recipients.

We use sensitive personal information only for the purposes permitted by CCPA § 1798.121(a) — to provide the service you request, prevent fraud, ensure security, and comply with law — and not for inferences about you for other purposes. You may request that we limit our use accordingly, although doing so may prevent us from providing core product functionality (for example, we cannot operate your account without your authentication credentials).

We have not "sold" or "shared" personal information in the preceding 12 months. We have disclosed the categories above to service providers and contractors for the business purposes described in Section 4.

Authorized agents

You may designate an authorized agent to make a request on your behalf by providing the agent with written, signed permission. We may require you to verify your identity directly with us before fulfilling the request.

Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

State-specific rights for other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing of their personal information, and to appeal a denial of such a request. To exercise these rights, email privacy@zoro.trade.

Zoro may be a "financial institution" within the meaning of the Gramm-Leach-Bliley Act and its implementing regulations (the FTC's Privacy Rule, 16 C.F.R. Part 313, and the Safeguards Rule, 16 C.F.R. Part 314). This notice describes how we handle nonpublic personal information ("NPI") that we receive about you in connection with a financial product or service.

What we collect

We collect NPI from you (e.g., information you provide on the waitlist landing page or during onboarding), from your transactions with us and with brokers you connect, and from your broker's API (e.g., legal name, account type, margin and options approval status, holdings, balances, and order history).

What we share

We share NPI as needed to provide the service, including with:

• Service providers (Section 6.1) — performing services on our behalf under contract
• Brokerages you connect — to authenticate the connection, retrieve account data you authorize, and route the orders your agents generate
• Affiliates — entities under common control with Zoro, for permitted business purposes
• Government and regulatory authorities — as required by law

We do not share NPI with non-affiliated third parties for those third parties' own marketing purposes. We do not sell NPI.

Your opt-out right

Under federal law, you have the right to opt out of certain sharing of NPI with non-affiliated third parties. Because we do not engage in that sharing, there is no current opt-out for you to exercise. If we change our practices in the future, we will provide you with a revised notice and a meaningful opportunity to opt out before any new sharing occurs. To request to limit sharing at any time, email privacy@zoro.trade with subject line "GLBA opt-out".

How we protect NPI

We maintain administrative, technical, and physical safeguards to protect NPI, as required by the GLBA Safeguards Rule. See Section 8.

Former customers

If you close your Zoro account, we continue to apply these protections to your NPI for as long as we retain it.

We maintain a list of the categories of sub-processors used to operate Zoro at Section 6.1. We will update this Policy or maintain a public sub-processor page when material changes occur. By using Zoro, you authorize us to engage these sub-processors. We require sub-processors, by contract, to protect personal information consistent with this Policy and applicable law.

If we become aware of a security incident that affects your personal information, we will notify you and applicable regulators without undue delay and consistent with the requirements of applicable law (including state breach-notification laws, the GLBA, GDPR Article 33–34, and the CCPA). Notifications will describe the nature of the incident, the categories of information involved (to the extent known), the steps we are taking, and what you can do to protect yourself.

Zoro is based in the United States. If you access Zoro from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data-protection laws different from those in your country. Where required, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement, or certification under the EU-US Data Privacy Framework where applicable) for international transfers of personal information. You may request a copy of the relevant safeguards by emailing privacy@zoro.trade.

Zoro is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. Brokerage accounts (which are required to use the Alpha product) are themselves limited to adults. If you believe a child has provided us with personal information, contact us at privacy@zoro.trade and we will delete it.

We may update this Policy from time to time. When we make material changes, we will notify waitlist members and Alpha users by email and post the updated Policy on this page with a new "Last updated" date at the top. We will provide notice at least 30 days before material changes take effect for existing users where required by law. Non-material changes (such as clarifications, typos, or contact-information updates) take effect on posting. Continued use of the website or product after an update constitutes acceptance of the revised Policy.

For privacy questions or to exercise your rights:

• Email: privacy@zoro.trade
• Security issues: security@zoro.trade
• Mailing address: Breaking Equity, Inc. (dba Zoro), 3435 Wilshire Blvd, 14th floor, Los Angeles, CA 90010.

Data Protection Officer / Privacy Officer: A privacy contact at Zoro is responsible for overseeing this Policy and responding to your requests. You can reach them at the email above.

EU representative (GDPR Article 27): If you are in the EU and we are required to designate a representative for the purposes of the GDPR, you can reach our EU representative at privacy@zoro.trade.

UK representative (UK GDPR Article 27): If you are in the UK and we are required to designate a representative, you can reach our UK representative at privacy@zoro.trade.

If we are not required to designate a representative under the GDPR or UK GDPR (for example, if we do not regularly target users in the EU or UK or process their information at scale), you may contact us directly at privacy@zoro.trade.