Privacy Policy | HyperPM

1. Who we are and what this covers

This policy explains how HyperPM (the "platform", available at https://hyperpm.ai), operated by PM LABS PTE. LTD. ("we", "us"), collects, uses, shares and protects your personal data when you use the platform. We are responsible for your personal data and handle it in accordance with Singapore's Personal Data Protection Act 2012 (the "PDPA"). Together with the Terms of Use, this policy forms the agreement between us.

For anything in this policy, including to reach our data protection officer, write to app@hyperpm.ai.

This policy is written in English and may be translated into other languages. If a translation differs from the English version, the English version prevails.

1.1 What this policy does not cover

This policy applies to this platform only. The platform connects and links to other services — among them the exchanges you connect, Telegram and PM.finance. What you do on those services, and the data they hold about you, are governed by their own terms and privacy policies, not this one, and a link does not mean we endorse or have reviewed them. Please read their policies before you use them.

2. What we collect

2.1 Information you give us

Account information: your email address, username, display name and language preference, and your password, which we store only as a one-way hash and never in readable form. If you turn on two-step verification, we store its secret in encrypted form.
Invitation details: the invitation code you used, which we store only as a one-way hash, and, if we invited you by email, the address we sent the invitation to.
What you create and upload: your conversations with the agents, including the text and images you send; strategies and their versions; backtests and other run results; factors; event studies; research notes; the documents and datasets you upload; the memories the agents keep for you; your skill packs and other instructions for the agents; and the settings and records of your paper and live trading accounts.
Exchange API keys: the key and secret you provide to connect an exchange account, stored encrypted.
Connected database: the connection details (connection string) of a database you connect, stored encrypted.
Telegram: if you link Telegram for alerts, your Telegram chat ID.
Messages to us: when you write to app@hyperpm.ai, your email address and what you write.
Billing records: your plan; the points granted to you, used and returned; and, if you pay us, invoice and payment records.

2.2 Information we collect automatically

Sign-in and session information: the time you sign in, your IP address, your browser or client identifier (User-Agent) and how long the session lasts.
Usage records and logs: the features you use, the operations you start, their status and the points they use, errors, technical logs, and records of security-relevant actions.

2.3 Information we get from others

From the exchanges you connect, through your API key: the balances, positions, orders and fills of the exchange account, the key's permissions, and the exchange's responses to the orders sent for you.
From Telegram: when you link Telegram by sending the link code to our bot, Telegram passes us your chat ID.
From a database you connect: the data returned by the queries the agents run for you.

2.4 Whether you have to provide this data

Required to have an account: an email address and a password, and, during the testing period, an invitation code.
Required for particular features: an exchange API key for live trading, connection details for a connected database, and a Telegram chat ID for Telegram alerts. Without them the feature cannot work.
Optional: everything else you choose to upload or create, and two-step verification unless we require it for your account or for an action.

2.5 People under 18

The platform is not for anyone under 18. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it.

3. Cookies and local storage

A cookie is a small piece of information a site stores in your browser; local storage and session storage are other places the browser offers, which are not sent to the server with every request. We use them only to run the service and remember your preferences. We set no advertising cookies and use no third-party analytics, tracking or behavioural profiling.

They are used to: keep you signed in; remember the interface language you chose (a cookie that lasts one year, with a copy in local storage); remember your interface preferences, such as the layout of the workbench, your filters and the choices you made on the chat and tuning pages (local storage); and remember which page you came from so that "back" links work (session storage). What keeps you signed in is cleared when you sign out; session storage is cleared when you close the tab; the rest stays until you clear your browser data.

How to refuse or clear them: you can refuse or delete cookies and clear local and session storage in your browser settings, and signing out clears what keeps you signed in. The sign-in part is required for the service to work: once it is cleared you will need to sign in again, and your language and interface preferences return to their defaults.

Cookies set by others are outside this policy: when you go from the platform to an exchange, Telegram or another service, any cookie that service sets is governed by its own privacy policy, and we can neither access nor control it.

4. Why we use your data, and on what basis

To provide the service you signed up for — running your account, the agents, research, backtests, factor and event-study work, datasets, documents, a connected database, skill packs and paper trading. Basis: performance of our contract with you.
To run live trading you set up — using your exchange API key to place and cancel your strategies' orders and to read your exchange account. Basis: performance of our contract with you, at your instruction.
To produce answers with AI — sending what the agents need to AI model providers, and the background tasks described in section 5. Basis: performance of our contract with you.
To send you alerts and notices — in the platform, by email and, if you link it, on Telegram, including security notices and notices of changes to our terms. Basis: performance of our contract with you.
To keep the service and your strategies running — our operations team receives automated alerts and a daily summary about running paper and live strategies (see 6.2). Basis: legitimate interests in operating the service reliably, and performance of our contract with you.
To manage plans, points and billing. Basis: performance of our contract with you; legal obligation (accounting and tax records).
To keep the platform secure — detecting unusual sign-ins, abuse and fraud, limiting request rates and keeping security records. Basis: legitimate interests in keeping accounts and the platform secure.
To improve the service — for example, finding out which data the research ideas in users' documents need that the platform does not yet provide, so that we can decide what to add, and learning from errors and usage to fix and improve features. Basis: legitimate interests in improving the service.
To support you — answering your messages and investigating problems you report. Basis: performance of our contract with you; your consent where we look at your content at your request.
To comply with the law — keeping records and responding to lawful requests from authorities. Basis: legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights and use the least intrusive means available; you may object at any time (see "Your rights").

We do not sell your personal data, we do not use it for advertising, and we do not use your content to train AI models. We do not send marketing emails. If we ever want to, we will ask for your separate consent, which will be off unless you turn it on, and every such email will let you unsubscribe.

5. AI processing and automated decisions

5.1 What is sent to AI model providers

To answer you, the agents send your messages, the files and images you give them, and the context they need — for example earlier parts of the conversation, your notes, memories and skill packs, excerpts from your documents and datasets, the results of queries on a database you connect, and your strategies and results — to AI model providers, which process them to produce the reply. Each provider handles this content under its own terms with us. The providers we use, and where they are, are listed in 6.3.

5.2 AI tasks in the background

The platform also uses AI models outside your conversations:

to extract memories from your conversations, so that the agents remember your preferences and earlier work; you can view, edit and delete memories on the platform;
to write summaries of your conversations;
to index your past results and your documents so that the agents can search them, which turns text into numerical representations called embeddings;
to read the images and figures in documents you upload.

5.3 Automated checks and decisions

Some decisions are made automatically, by rules applied to a strategy and its results rather than to you as a person — for example whether code passes the platform's checks, whether a strategy meets the conditions for live trading, and whether a risk control stops a running strategy. They are based on the strategy's code, settings and paper or live trading record, not on your identity. You can ask us to explain such a decision, and to have a person review it, by writing to app@hyperpm.ai.

5.4 Please keep sensitive data out

Please do not enter identity document numbers, bank account numbers, passwords, the secrets of exchange API keys (except in the place the platform provides for keys) or other people's personal data into conversations, documents, datasets or skill packs.

6. Who can see your information

6.1 Other users

Your content is private to your account by default: other users cannot see your conversations, strategies, factors, research notes, documents, datasets, memories or trading accounts. Event studies are the exception: they run on the platform's own event data and are listed for all users with their settings and results, but without your name or the idea you started from.

6.2 Our team

A small number of authorised people in our team can access the systems where your data is stored. To run the platform they routinely see account and usage information, such as accounts, plans and points, and which operations are running and their status. They look at the content of your conversations, strategies, documents and other work only where needed — to give you support you asked for or agreed to, to investigate a problem, to keep the platform and its users secure, or to meet a legal obligation — and only as far as the task requires. Where the platform offers a way for you to grant support access, we use it, and that access is limited in time and logged.
To decide which data to add to the platform, our team uses a view that lists, across users, the kinds of data that the research ideas in users' documents need and the platform does not yet provide, with the documents they come from.
When we investigate a problem that involves your content, our engineers may use AI-assisted development tools, which then process the parts of your content being examined.
Our operations team receives automated alerts and a daily summary about running paper and live strategies — for example a strategy's name, state, equity, drawdown, number of trades and errors — in a private Telegram chat.
Everyone in our team who handles personal data is bound by confidentiality obligations.

6.3 Service providers

We share personal data, only as far as needed, with the service providers below, which process it to provide their services to us:

Railway (Singapore) — servers, databases, file storage and backups; holds the data the platform stores.
Vercel (Singapore, with a global content delivery network) — delivers the website to your browser; processes your requests to the website, including your IP address.
DeepSeek (China) — AI models for the agents' conversations, code and analysis, and for memories and summaries; processes the content sent to the agents (see 5.1).
OpenAI (United States) — embeddings for search, and reading images; processes the text being indexed and the images and figures from your documents.
Telegram — delivers the alerts you choose to receive and our team's operations alerts; processes your chat ID and the content of the alerts.
Resend (a United States company; servers in Tokyo, Japan) — sends the platform's emails, such as verification codes and notices, where the platform sends you email; processes your email address and the content of the message.
The email service that hosts our support mailbox — processes the messages you send to app@hyperpm.ai.
AI-assisted development tools our engineers use — process the parts of your content examined when we investigate a problem (see 6.2).

The exchanges you connect receive the orders and requests made with your API key. They, and Telegram, also process data in their own right, under their own terms and privacy policies.

We also disclose personal data where the law, legal process or a competent authority requires it, or where it is necessary to protect the rights, property or safety of the platform, our users or others.

6.4 Transfers of the business

We will not transfer your personal data to a third party except with your prior express consent, where the law requires it, or in a merger, division, restructuring, acquisition or sale of assets, where your data may transfer as part of the transaction. In that case we will tell you beforehand who the recipient is and how to contact them, and require them to remain bound by this policy; a recipient wanting to change the purpose must obtain your consent afresh.

7. Cross-border transfers

We are based in Singapore and our main servers are in Singapore. Some of the providers in 6.3 are elsewhere — DeepSeek in China, OpenAI in the United States, Resend's servers in Japan — and the website is delivered through a global network; the exchanges you connect and Telegram may also process data in other countries. Your personal data is therefore transferred to, stored in or accessed from countries other than Singapore.

When we transfer personal data out of Singapore, we take appropriate steps, as the PDPA requires, so that the recipient protects it to a standard comparable to that of the PDPA — for example through the data-protection commitments in our agreements with the recipient. Data held in another country is subject to that country's laws, and may be accessible to its courts and authorities under those laws. You can ask us for more information about the safeguards in place at app@hyperpm.ai.

8. Your rights

Under the PDPA you may:

ask for access to your personal data, and for information about how it has been used or disclosed in the year before your request;
ask us to correct personal data that is wrong or incomplete;
withdraw consent you gave earlier;
ask us to delete your personal data, including by asking us to delete your account (see 9.2);
ask us to explain, and to have a person review, an automated decision (see 5.3).

You can also do much of this yourself on the platform: change your display name and language, delete memories, documents and datasets, remove exchange API keys and database connections, and unlink Telegram.

To make a request, write to app@hyperpm.ai. To protect your account we will verify your identity before acting on it. We will respond within 30 days; where we need longer, we will tell you within that period when we expect to respond and why.

Please note:

Withdrawing consent does not affect processing already carried out on the basis of it. After withdrawal we may be unable to provide the features that depend on it; we will tell you the likely consequences before we act on it.
Records we must keep by law, such as billing records, are kept for the periods in section 9 and may not be deleted on request.
Once the 30-day period after a deletion request has passed, the account and its content cannot be restored.
Deleted data may remain in backups until they expire.

If you are not satisfied with our answer, you may complain to Singapore's Personal Data Protection Commission, or to the data-protection authority where you live.

9. How long we keep it

9.1 Retention periods

We keep your personal data for as long as we provide the service to you, and afterwards only for as long as we still need it — to meet legal, tax and accounting obligations, to prevent fraud and abuse, to resolve disputes and to enforce our agreements. In practice:

Account information: while your account exists. When your account is deleted, we clear your email address, password, display name, Telegram link and language, and keep only an empty account record with a random name, to which the records below remain attached.
What you create and upload: while your account exists. We do not delete it on a schedule, and you can delete documents, datasets and memories yourself at any time.
Exchange API keys and database connection details: until you remove them, or straight away when you ask us to delete your account.
Sign-in and security records: 13 months, keeping only a shortened form of your IP address.
Session records and sign-in tokens: up to 90 days after they end. One-time codes and links, such as those for verification, password reset or an invitation: 7 days after they are used or expire.
Sign-ups that are not completed: 7 days.
The email address of a person we invited: 30 days after the invitation is used or expires.
Records of the emails we send (to whom, when and whether delivered): 30 days.
Records of your acceptance of the Terms of Use and this policy (version, language, time and a shortened IP address): while your account exists, and for 5 years after.
Billing and points records: 5 years, including after your account is deleted, attached only to the empty account record.
Trading and contest records: 5 years, including after your account is deleted, attached only to the empty account record. Trading records are the orders, fills, steps with their error messages, equity and cash flows of paper and live trading accounts; contest records are entries, submissions, daily results and the backtest results they cite. When your account is deleted, the account names, strategy code and similar content in them are cleared.
If we offer free trials: a one-way, keyed fingerprint of each email address that received a trial, kept for as long as we offer trials so that each address receives one trial. It cannot be turned back into your address.
If we suspend an account and do not lift the suspension within 30 days, we may then delete its content, uploaded files and stored connection details.
Backups: our hosting provider keeps daily and weekly backups, which expire on their normal schedule; data deleted from the platform remains in them until they expire.
Server logs: a limited period set by our hosting provider, after which they are deleted automatically.

Once a retention period ends we delete your personal data or anonymise it.

9.2 Deleting your account

Until the platform offers a way to do this yourself, you can ask us to delete your account by writing to app@hyperpm.ai from the email address registered to it. Then:

your account enters a 30-day pending-deletion period, during which you can restore it by signing in, or ask us to restore it; your exchange API keys and database connection details are deleted, and Telegram is unlinked, straight away;
after 30 days we delete your content and files — conversations, strategies, factors, research notes and documents, datasets, memories, skill packs and other instructions, search indexes and run records — and clear your account information as described in 9.1; the trading and contest records described in 9.1 are kept, with the account names, strategy code and similar content in them cleared;
we keep the records listed in 9.1 for the periods stated there.

An account cannot be deleted while live trading is running on it or positions opened through the platform remain open: stop those strategies and close those positions first. If you are still taking part in a contest when the 30 days end, we delete your content once the contest is settled.

9.3 Inactive accounts

We do not delete accounts because they are inactive. An unused account and its content stay until you ask us to delete them, except as described in 9.1 for suspended accounts.

10. How we protect it

10.1 Security measures

Our security measures follow the principles of least privilege and defence in depth. They include:

In transit: HTTPS is enabled across the site, so data between you and the platform is encrypted in transit.
Passwords: stored only as salted one-way hashes; we cannot derive your password from what we store.
Credentials: exchange API keys and database connection details are encrypted (AES-256) before they are stored, and the encryption key is kept outside our code and database. Two-step verification secrets are encrypted too.
Access control: the server checks permissions on every request, and each account's content is kept separate from every other account's. Access by our team is limited to authorised people.
Records: the ledger of points and plan changes, and the fills and steps of paper and live trading, are kept as append-only records.
Your files: documents and datasets you upload are stored privately; no public link is issued for them, and only you can download them through the platform.
Abuse prevention: sign-in attempts and other sensitive requests are rate-limited.

These measures reduce risk substantially, but no system can be guaranteed to be completely secure.

10.2 Security incidents

If personal data is or may have been accessed, disclosed, altered or lost without authorisation, we will begin incident response immediately, assess the scope and take remedial action. Where a breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after we determine that it is notifiable, and we will notify the affected users where the PDPA requires, by email or in-app notice, explaining what happened, the likely impact, what we have done and what you can do to protect yourself.

11. Changes to this policy

When this policy is updated we will change the "Last updated" date and publish it on the platform. Where a change is material we will tell you at least 14 days before it takes effect, by email or by a prominent notice on the platform, with a short summary of what changed — unless the change is required sooner by law or for security, in which case we will tell you as early as we can — and, where necessary, ask for your consent again. Material changes include, among others:

a significant change in the service that alters the purpose, categories or manner of processing;
a change in the main recipients of shared, transferred or publicly disclosed data;
a significant change in your rights over the processing, or in how you exercise them;
any other change that may significantly affect your interests in your personal data.

12. Contact us

For any question, request or complaint about this policy, or to reach our data protection officer, write to app@hyperpm.ai.