Effective Date: December 29, 2025
This page applies to OnHosty and the websites, applications, dashboards, APIs, software, AI features, digital tools, hosting services, commerce features, market tools, and other services made available at or through https://onhosty.com/. References to “we,” “us,” and “our” mean onhosty.com. References to “you” include visitors, customers, account holders, subscribers, sellers, creators, affiliates, and authorized users. New or updated services are covered when they reasonably fall within this description unless a separate notice or agreement applies.
1. Information We Collect
- Identity and account information such as name, username, email, contact details, profile data, authentication records, account roles, and security settings.
- Commerce information such as orders, billing and shipping details, invoices, subscription status, refunds, support history, license and download records. Payment-card data may be processed directly by payment providers rather than stored by us.
- AI and automation data such as prompts, instructions, uploaded files, tool selections, generated outputs, worker/bot configurations, workflow history, model-routing information, token/usage records, and quality or safety logs.
- Website, hosting, and creator data such as domains, site configuration, files, documents, spreadsheets, presentations, designs, images, video, screen recordings, audio, subtitles, project metadata, backups, and publishing instructions.
- Communications data such as support messages, email notifications, appointment details, and—when you enable those features—SMS, voice, meeting, or communication metadata and content as necessary to provide the service.
- Connected-account and API data such as provider identifiers, OAuth authorization grants, requested scopes, access/refresh token data, connection status, API-key configuration, and data retrieved from services you choose to connect.
- Market and financial-tool data such as watchlists, symbols, chart settings, paper-trading activity, strategies, alerts, portfolio analytics, and, if live connectivity is later enabled, authorized account identifiers, balances, positions, orders, fills, and transaction data made available by the financial provider.
- Technical and security data such as IP address, browser/device information, session identifiers, cookies, request logs, approximate location derived from IP, timestamps, error reports, fraud signals, and security events.
- Seller, affiliate, marketplace, and business data such as listings, commissions, payout preferences, business profile data, tax or verification information where required, and referral activity.
2. Brokerage Passwords and OAuth
When a financial provider supports OAuth or another provider-hosted authorization flow, you should authenticate with the provider directly. OnHosty does not need your provider password merely to receive an OAuth authorization token. Never send brokerage passwords, private API secrets, or recovery codes through ordinary support messages. Access tokens and other connection credentials are treated as security-sensitive information and are used only for authorized integration purposes.
3. How We Use Information
- Provide, personalize, maintain, and secure accounts, software, AI features, hosting, websites, commerce, creator tools, subscriptions, communications, and connected services.
- Process orders, billing, refunds, usage credits, subscriptions, licenses, customer support, abuse reports, and service requests.
- Execute user-requested automations and authorized API actions, including retrieving connected-account information and, only if live trading is enabled and authorized, transmitting user-directed or configured orders to the financial provider.
- Generate AI outputs and route tasks to selected model or infrastructure providers; detect abuse; troubleshoot errors; measure performance and reliability; and improve service quality.
- Protect users and services from fraud, account takeover, spam, malware, unauthorized trading activity, credential abuse, and other security threats.
- Comply with law, enforce agreements, respond to lawful requests, maintain records, and satisfy provider, tax, accounting, or compliance requirements.
- Send transactional, security, policy, support, and service communications and, where permitted, marketing communications subject to your choices.
4. AI Providers and Automated Processing
When you use AI features, relevant prompts, files, context, and instructions may be transmitted to the AI or infrastructure provider selected for that task. Different services may use different providers or models. We may use automated systems to route work, detect abuse, recommend actions, or assist with decisions. Material financial or legal decisions should not be made solely on unreviewed AI output.
5. Financial Providers and Sensitive Financial Data
If you connect Alpaca or another financial provider, we may receive data permitted by the authorization scopes you approve. Brokerage-account opening, identity verification, KYC/AML information, tax data, or similar regulated information may be collected directly by the provider or, if we later offer an embedded application flow, collected and transmitted to the provider as disclosed at that time. We do not knowingly sell brokerage passwords, OAuth tokens, or provider API secrets for advertising purposes.
6. How We Share Information
We share information with vendors and partners only as reasonably necessary for the purposes described in this Policy, such as hosting, cloud infrastructure, AI processing, payments, email/SMS/voice, analytics, security, customer support, fulfillment, licensing, accounting, legal compliance, connected-account services, market data, and financial-provider integrations. We may also share information in a business transfer, to protect rights and safety, or when legally required. Third parties process information under their own terms where they act independently.
7. Sale, Sharing, and Targeted Advertising Choices
Privacy laws in some jurisdictions define “sale” or “sharing” broadly and may treat certain advertising or analytics disclosures as covered activities even where no money is exchanged for the data. Where applicable, we will provide required opt-out methods and honor legally recognized preference signals such as Global Privacy Control when required. We do not use brokerage credentials or OAuth tokens for cross-context behavioral advertising.
8. Cookies and Similar Technologies
We use cookies, local storage, pixels, session identifiers, and similar technologies for authentication, carts, preferences, security, analytics, affiliate attribution, marketing, and embedded services. See the Cookie Policy for details and available controls.
9. Data Retention
We retain personal information for as long as reasonably necessary for the service, account relationship, legal obligations, billing and tax records, fraud prevention, security, dispute resolution, backups, and legitimate business purposes. Retention periods vary by data type. When a connected account is disconnected, we will stop using the authorization for new access and will delete, revoke, or de-identify stored connection data when it is no longer reasonably needed, subject to legal, security, and backup requirements.
10. Security
We use administrative, technical, and organizational safeguards appropriate to the nature of the information. No system is completely secure. Users must protect passwords, API keys, OAuth grants, devices, and recovery methods and promptly report suspected compromise. Do not place secrets in public posts, screenshots, source code, browser-visible configuration, or support tickets unless a secure channel is specifically provided.
11. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, obtain a copy of, restrict, object to, or opt out of certain processing of personal information, and to limit certain uses of sensitive personal information. You may also have a right to appeal a denied request. We will not unlawfully discriminate against you for exercising privacy rights. Requests may be sent to admin@onhosty.com; we may need to verify your identity before acting.
12. International Data Transfers
Services and providers may process information in countries other than the one where you live. Where required, we use appropriate transfer mechanisms or contractual safeguards and provide additional notices when applicable.
13. Children
OnHosty is not directed to children under 13 and financial or brokerage features are not intended for persons who do not meet the age and eligibility requirements of the applicable provider. If you believe a child has submitted personal information contrary to these rules, contact admin@onhosty.com.
14. Changes to this Policy
We may update this Policy as services, technologies, providers, or laws change. If an update materially changes how we use personal information, we will provide notice when required and update the effective date. New features are not permission to use information for unrelated purposes without appropriate notice or consent.
15. Contact
Privacy: admin@onhosty.com
Support: admin@onhosty.com
Business Address: