Privacy Policy.

This Privacy Policy ("Policy") describes how Trade Catalyst Inc. ("Catalyst," "Company," "we," "us," or "our") collects, uses, discloses, and protects information obtained from visitors to and users of the Catalyst website located at https://tradecatalyst.com, together with all related products, services, mobile applications, and software (collectively, the "Services"). The Catalyst platform, website, dashboard, and simulation environment are referred to collectively as the "Platform."

This Policy applies to all visitors, users, and others who access the Services ("you" or "your").

Catalyst operates a skill-based trading evaluation platform. Customers complete performance evaluations in a simulated environment using real prediction market data. The Product does not involve live trading, proprietary trading, brokerage services, or custody of customer funds at any time. No real financial assets are traded.

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with this Policy, do not access or use the Services.

This Policy is incorporated into and made a part of our Terms of Use, available at tradecatalyst.com/terms.

We collect only the information reasonably necessary to provide and improve the Services, prevent fraud, and comply with legal obligations. We collect information in the following categories.

2.1 Information you provide to us

We collect information you voluntarily provide when you create an account, purchase a challenge, contact us, or otherwise interact with the Services, including:

• First and last name
• Email address
• Username and password
• Residential address and/or billing address
• Date of birth (required for payout processing)
• Telephone number (where applicable)
• Payment information (processed by our third-party payment processor, currently Payarc; Catalyst does not directly access, handle, or store your credit or debit card number, expiration date, or security code). Payarc's privacy policy is available at payarc.com/privacy-policy
• Any other information you choose to provide through the Services, including communications with customer support

2.2 Identity verification information

Upon payout eligibility, additional information is collected for identity verification, sanctions screening, and compliance purposes by our third-party payout and verification provider, currently Dots (dots.dev/legal/privacy-policy), through an integrated interface on our Platform. This information may include:

• Government-issued photo identification (e.g., passport, driver's license)
• Bank account or payment account verification data
• Social Security Number or taxpayer identification number (where applicable)
• Telephone number, date of birth, and residential address (as required by the verification provider)

Catalyst does not directly collect, process, or store government-issued identification documents, Social Security Numbers, or financial account information. Identity verification, anti-money laundering screening, tax documentation (including collection and storage of IRS Forms W-9 and W-8), and payout processing are conducted by Dots through its own secure infrastructure. Dots also remits IRS Form 1099 tax reporting on Catalyst's behalf where required by law. Dots collects and processes verification data under its own privacy policy. Although the verification interface appears within our Platform, this data is transmitted directly to and stored by Dots, not by Catalyst.

Catalyst does not directly collect biometric identifiers. Any biometric data processed during identity verification is collected and handled solely by our third-party verification provider under its respective privacy policy.

2.3 Information collected automatically

When you access or use the Services, we automatically collect certain information, including:

• IP address and approximate geolocation data (used for fraud prevention, jurisdiction enforcement, and analytics)
• Device information, including browser type, operating system, unique device identifiers, and device fingerprint data
• Pages viewed, links clicked, and other usage and navigation data
• Referring URL and search terms
• Date, time, and duration of visits
• Log files and server data

We use device fingerprinting and related fraud detection technologies, currently provided by Fingerprint (fingerprint.com/privacy), to identify and prevent duplicate accounts, detect automated or fraudulent activity, and enforce Platform rules. These technologies collect device-level attributes such as browser configuration, installed plugins, screen resolution, and hardware characteristics to generate a unique device identifier. Device fingerprinting for fraud prevention and platform security is strictly necessary for the provision of the service you have requested, and accordingly does not require separate consent under the ePrivacy Directive (2002/58/EC), Article 5(3).

We collect location data, including IP address and country-level geolocation, to enforce geographic restrictions on Platform access as described in the Terms of Use. Catalyst does not collect precise GPS location data.

2.4 Simulated trading data

We collect all data generated through your use of the Platform, including simulated trade activity, position data, order history, evaluation performance metrics, behavioral patterns, and all other activity data (collectively, "Trading Data"). By using the Platform, you grant Catalyst a worldwide, perpetual, irrevocable, royalty-free license to use, reproduce, modify, analyze, distribute, and create derivative works from all Trading Data, as set forth in Section 15 of the Terms of Use.

Catalyst may use Trading Data internally for any business purpose, including but not limited to product development, risk modeling, platform improvement, machine learning and algorithm training, research, marketing, and business intelligence. Trading Data shared with third parties will be in aggregated or de-identified form that cannot reasonably be used to identify you. These activities may be performed automatically without further notice or consent.

2.5 Information from third parties

We may receive information about you from third-party service providers, including payment processors, identity verification providers, fraud detection services, analytics providers, and advertising platforms.

2.6 Communications

If you contact us by email, phone, or through any messaging or support feature on the Services, we collect all information and content you provide in those communications. Catalyst may record telephone calls made to or by Catalyst for quality assurance, training, and compliance purposes. By calling Catalyst, you consent to the recording and storage of such calls.

We use cookies, pixels, software development kits, and similar tracking technologies (collectively, "cookies") to collect information about your use of the Services, personalize your experience, and analyze traffic.

What are cookies? Cookies are small text files placed on your device when you visit a website. They are used to make websites function properly, improve performance, and provide information to site operators.

Our consent management platform. We use Cookiebot (operated by Usercentrics A/S) as our consent management platform to obtain, record, and manage your cookie preferences. When you first access the Services from the European Economic Area, the United Kingdom, or Switzerland, you will be presented with a cookie consent banner allowing you to accept all cookies, reject all non-essential cookies, or customize your preferences by category. Non-essential cookies will not be set on your device until you provide consent. You may change or withdraw your consent at any time by clicking the privacy trigger icon located in the bottom-left corner of any page on the Services.

Categories of cookies we use

Necessary cookies are required for the Services to function and cannot be disabled. They enable core functionality such as security, network management, account authentication, session management, and fraud prevention (including device fingerprinting under the strictly necessary exemption described in Section 2.3).

Preferences cookies enable the Services to remember information that changes the way the Services behave or look, such as your preferred language or region.

Statistics cookies help us understand how visitors interact with the Services by collecting and reporting information anonymously. We use Google Analytics for this purpose.

Marketing cookies are used to track visitors across websites in order to display advertisements that are relevant and engaging to individual users. These include cookies set by third-party advertising and retargeting platforms.

Cookie Declaration. A complete and current list of every cookie used on the Services, including the cookie name, provider, purpose, type, and expiration, is set forth in the Cookie Declaration that appears below this Policy or on a linked Cookie Declaration page. The Cookie Declaration is updated automatically following monthly cookie scans.

Analytics. We use analytics tools, including Google Analytics, to collect aggregated information about how visitors navigate and interact with the Services. Where consent is required, Google Analytics is loaded only after you consent to Statistics cookies. We have configured Google Consent Mode v2 to transmit your consent choices to Google.

Advertising and retargeting. We use third-party advertising and retargeting technologies, including tracking pixels and cookies from advertising platforms, to serve targeted advertisements based on your browsing history and interests. These technologies may collect information about your use of the Services over time so that third-party advertising networks and social media platforms may display advertisements on other websites, applications, or services. Where consent is required, these technologies are loaded only after you consent to Marketing cookies.

Your choices. You may change or withdraw your cookie consent at any time using the privacy trigger icon described above. Most web browsers allow you to control cookie settings through browser preferences. You may block or delete cookies at any time. However, disabling cookies may affect the functionality of the Services. To opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout. You may learn more about interest-based advertising and available opt-out mechanisms through the Network Advertising Initiative at networkadvertising.org/choices and the Digital Advertising Alliance at aboutads.info/choices.

We use the information we collect for the following purposes:

• Providing the Services: to create and administer your account, process challenge purchases, deliver the simulation experience, determine evaluation outcomes and payout eligibility, and complete other administrative matters
• Payment Processing: to process payments for challenge purchases and to facilitate payout disbursements through our third-party payout provider
• Identity Verification and Compliance: to facilitate identity verification, sanctions screening, and anti-money laundering checks conducted by our third-party provider as required for payout disbursement
• Fraud Prevention and Security: to detect, investigate, and prevent fraud, abuse, and violations of the Terms of Use, including device fingerprinting, IP intelligence, duplicate and linked account detection, behavioral risk scoring, velocity and abuse monitoring, and chargeback monitoring
• Automated Decision-Making: to make automated determinations regarding account eligibility, evaluation outcomes, fraud detection, and payout approval based on algorithmic analysis of Trading Data, behavioral patterns, and risk indicators. These automated decisions may affect your eligibility for payouts or continued use of the Platform. Where required by applicable law, we will provide notice before making an automated decision that significantly affects your account. See Section 10.3 for your right to opt out of such profiling where applicable under your state's law
• Communications: to send transactional messages (e.g., account confirmations, evaluation results, payout notifications) and, with your consent where required, promotional and marketing communications via email and SMS. See Section 4.1 for additional information about text messages
• Platform Improvement: to analyze usage patterns, improve the Services, develop new features, and conduct internal research
• Trading Data Analysis: to use, aggregate, analyze, and create derivative works from Trading Data for product development, risk modeling, machine learning and algorithm training, marketing, business intelligence, research, and any other internal business purpose, as described in Section 2.4 and Section 15 of the Terms of Use
• Advertising: to deliver targeted advertisements, measure ad performance, attribute conversions, and manage affiliate and referral programs
• Legal and Regulatory: to comply with applicable laws, regulations, and legal processes, to enforce our Terms of Use, and to protect the rights, property, or safety of Catalyst, our users, or others

4.1 Text messages (SMS/MMS)

If you opt in to receiving text messages from Catalyst, we may send you text messages at the telephone number you provide, including account alerts, evaluation results, payout notifications, and promotional offers relating to the Services. Consent to receive text messages is not a condition of purchasing any product or service from Catalyst. Message frequency varies. Message and data rates may apply. You may opt out of receiving text messages at any time by replying STOP to any message or by contacting us at [email protected]. Even if you opt out of promotional text messages, we may still send you transactional and administrative messages related to your account. We do not share, sell, or rent mobile phone numbers or SMS opt-in consent to third parties or affiliates for their own marketing purposes. Mobile numbers are disclosed only to our SMS delivery provider solely to transmit the messages you have requested, and to service providers as necessary to operate the Services.

We do not sell your personal information as that term is defined under applicable law. We may share certain information with advertising partners for targeted advertising purposes as described in Section 5.2; to the extent this constitutes "sharing" under applicable state law, you may opt out as described in Section 10.3. We may otherwise share your information in the following circumstances.

5.1 Service providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processing
• Payout disbursement, identity verification, AML/KYC screening, and tax documentation
• Email and SMS delivery
• Customer support and help center services
• Website analytics
• Device fingerprinting and fraud detection
• Advertising, retargeting, and conversion attribution
• Affiliate and referral program management

These service providers are authorized to use your information only as necessary to provide services to us and in accordance with their own privacy policies and our agreements with them.

5.2 Advertising partners

We share certain information with advertising networks, social media platforms, and affiliate partners to deliver targeted advertisements, measure campaign effectiveness, attribute conversions, and manage referral and affiliate programs. This may include identifiers such as hashed email addresses, device identifiers, IP addresses, and cookie data. Where required by applicable law, we will obtain your consent or provide an opt-out mechanism before sharing information for targeted advertising purposes.

5.3 Trading data

As described in Section 2.4, Catalyst has a perpetual, royalty-free license to use, reproduce, modify, analyze, distribute, and create derivative works from all Trading Data generated through your use of the Platform. Catalyst may use Trading Data internally for any business purpose without restriction. Trading Data shared with third parties will be in aggregated or de-identified form that cannot reasonably be used to identify you.

5.4 Legal and compliance disclosures

We may disclose your information to respond to subpoenas, court orders, legal process, law enforcement requests, legal claims, or government inquiries, and to protect and defend the rights, interests, safety, and security of Catalyst, our affiliates, users, or the public.

5.5 Business transfers

In the event of a merger, acquisition, reorganization, sale of assets, or similar transaction, your information may be transferred to the successor entity. We will notify you of any such change by posting the updated Policy on the Services.

5.6 Affiliates

We may share information, including personal information and Trading Data, with our affiliates and related entities for purposes consistent with this Policy, including product development, risk modeling, and business operations.

5.7 Aggregated and de-identified data

We may share aggregated or de-identified data that cannot reasonably be used to identify you for any business purpose, including research, product development, marketing, and licensing to third parties.

5.8 With your consent

We may share your information for other purposes with your express consent.

We retain personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations (including tax and regulatory requirements), resolve disputes, prevent fraud, enforce our agreements, and as otherwise permitted by applicable law.

Trading Data is retained in accordance with the perpetual license granted under Section 15 of the Terms of Use and Section 2.4 of this Policy. Trading Data may be retained indefinitely, including in aggregated or de-identified form, for any business purpose described in this Policy.

When you exercise your right to delete personal information (see Section 10.3), we will honor that request except where retention is required by law, necessary for fraud prevention, or permitted under applicable exceptions.

Specific retention periods: (a) account information is retained for the duration of your account and for seven (7) years following account closure for tax and regulatory compliance purposes; (b) transaction records are retained for seven (7) years for tax reporting purposes; (c) fraud prevention data (device fingerprints, IP logs, behavioral risk scores) is retained for three (3) years following your last interaction with the Platform; (d) marketing and analytics data is retained until you withdraw consent or opt out; (e) communications with support are retained for two (2) years following resolution. These periods may be extended where required by law or active legal proceedings.

We implement reasonable and appropriate physical, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of your information. These safeguards include encryption of data in transit and at rest, access controls, and regular security assessments.

However, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee the absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and applicable regulatory authorities within the timeframes required by law (generally seventy-two (72) hours for EEA/UK authorities under GDPR Article 33, and as required by applicable U.S. state breach notification laws).

Catalyst is based in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than your country of residence.

Where required by applicable law, we use appropriate safeguards for international data transfers, including standard contractual clauses approved by the European Commission, the UK International Data Transfer Addendum, or other legally recognized transfer mechanisms. For transfers to countries not subject to an adequacy decision, we conduct transfer impact assessments as appropriate and implement supplementary measures where necessary to ensure an essentially equivalent level of protection.

The Services are restricted to individuals eighteen (18) years of age or older. We do not knowingly collect or solicit personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take reasonable steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at [email protected].

10.1 Marketing communications

You may opt out of receiving promotional emails and SMS messages at any time by following the unsubscribe instructions in the communication, replying STOP to any text message, or by contacting us at [email protected]. Even if you opt out of promotional communications, we may still send you transactional and administrative messages related to your account and the Services.

10.2 Account information

You may review and update the personal information associated with your account by logging in and accessing your account settings, or by contacting us at [email protected].

10.3 U.S. state privacy rights

If and when applicable U.S. state consumer privacy laws apply to our processing of your personal information (based on the thresholds established by each state's law), you may have additional rights regarding the personal information we collect. These rights are available to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, Virginia, and other U.S. states with applicable consumer privacy legislation, and include:

• Right to Know/Access: the right to know what personal information we have collected about you and to request a copy of that information in a portable format
• Right to Delete: the right to request deletion of personal information we have collected from you, subject to certain exceptions
• Right to Correct: the right to request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: the right to opt out of the sale or sharing of your personal information for targeted advertising. To the extent our advertising practices constitute "sharing" under applicable law, you may opt out by contacting us at [email protected] or by enabling Global Privacy Control (see Section 13)
• Right to Limit Use of Sensitive Personal Information: the right to direct us to limit the use and disclosure of your sensitive personal information to only those purposes necessary to perform the Services, as permitted under the CPRA. Because Catalyst's third-party provider collects sensitive personal information solely for identity verification, payout processing, and legal compliance, use is already limited to these necessary purposes
• Right to Non-Discrimination: the right not to be discriminated against for exercising your privacy rights
• Right to Opt Out of Profiling/Automated Decision-Making: the right to opt out of automated decision-making or profiling that produces legal or similarly significant effects, to the extent applicable under your state's law. Catalyst uses automated systems for fraud detection, evaluation outcome determination, and payout eligibility decisions that may affect your ability to receive payouts or continue using the Platform. To exercise this right, contact us at [email protected] with the subject line "Opt Out of Profiling." Upon receipt of a valid request, we will ensure that a qualified human reviewer is involved in any decision that significantly affects your account
• Right to Appeal: if we deny your privacy rights request in whole or in part, you have the right to appeal that decision. To submit an appeal, contact us at [email protected] with the subject line "Privacy Rights Appeal." We will respond to your appeal within the timeframe required by applicable law (generally forty-five (45) days). If your appeal is denied, you may contact your state attorney general's office to submit a complaint

To exercise any of these rights, please contact us at [email protected]. If applicable state privacy law requires us to respond to your request, we will acknowledge receipt within ten (10) business days and respond substantively within forty-five (45) days (or as otherwise required by your state's law). If we need additional time, we will notify you of the extension and the reason.

10.4 California residents

Under California's "Shine the Light" law (California Civil Code Section 1798.83), California residents may request information about personal information disclosed to third parties for their direct marketing purposes. To make such a request, please contact us at [email protected] with the subject line "Your California Privacy Rights."

10.5 Nevada residents

Nevada law permits Nevada consumers to opt out of the sale of certain personal information. Catalyst does not currently sell personal information as defined under Nevada law. If you are a Nevada resident and wish to submit a request, please contact us at [email protected].

10.6 European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, you may have rights under the General Data Protection Regulation (GDPR) or equivalent legislation, including the right to access, correct, delete, restrict processing of, or port your personal data; the right to object to processing; and the right to withdraw consent. You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu/about-edpb/members. For UK residents, the relevant authority is the Information Commissioner's Office (ico.org.uk). For Swiss residents, the relevant authority is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

We process your personal data on the following legal bases: (a) performance of our contract with you (providing the Services, processing payments, administering evaluations); (b) compliance with legal obligations (sanctions screening, tax reporting); (c) our legitimate interests (fraud prevention, platform improvement, data analytics, Trading Data analysis for internal business purposes); and (d) your consent (marketing communications, non-essential cookies, targeted advertising and sharing of personal data with advertising partners).

Automated Decision-Making (Article 22). Catalyst uses automated processes to make decisions regarding fraud detection, evaluation outcomes, and payout eligibility that may affect your rights under our contract. Where such processing is based on our contract with you or your explicit consent, you have the right to obtain human intervention, express your point of view, and contest the decision. To exercise this right, contact us at [email protected].

Cookie Consent. If you are located in the EEA or UK, we will obtain your consent before placing non-essential cookies or similar tracking technologies on your device. You may manage your cookie preferences at any time by clicking the privacy trigger icon located in the bottom-left corner of any page on the Services, or by adjusting your browser settings. We will not set non-essential cookies on your device until you provide consent.

EU Representative (Article 27). As Catalyst does not maintain an establishment in the European Union, we have appointed DataRep, with a registered address at 107-111 Fleet Street, London EC4A 2AB, United Kingdom (email: [email protected]) as our representative in the Union pursuant to Article 27 of the GDPR. You may contact our EU representative regarding any matter relating to the processing of your personal data.

To exercise any of these rights, please contact us at [email protected].

10.7 Canadian residents

If you are a resident of Canada, you may have rights under applicable Canadian privacy legislation, including the right to access, correct, and withdraw consent for the processing of your personal information. Upon request, you may be informed of the existence, use, and disclosure of your personal information, provided with an account of third parties to which your information has been disclosed, and given information about our privacy policies and practices. To exercise these rights, please contact us at [email protected]. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your applicable provincial privacy commissioner.

The following categories of information considered sensitive under applicable law may be collected and processed in connection with the Services:

• Government-issued identification numbers (e.g., Social Security Number, passport number)
• Government-issued photo identification documents
• Financial account information (e.g., bank account and routing numbers)

These categories of sensitive personal information are collected and processed entirely by our third-party payout and verification provider, not by Catalyst directly. Although the verification interface appears within our Platform, Catalyst does not receive, store, or have access to this data. Our provider collects and uses this information solely for the following purposes:

• To verify your identity and protect against fraud
• To facilitate payout disbursements
• To comply with applicable legal and regulatory obligations, including sanctions screening and tax reporting
• For the performance of the agreement between you and Catalyst

We do not sell sensitive personal information or share it for purposes of cross-contextual behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those specified above.

The Services may contain links to or integrate with third-party websites, services, or platforms. This Policy does not apply to information collected by third parties. We are not responsible for the privacy practices of these third parties, and the information practices of these third parties are not covered by this Policy. We encourage you to review the privacy policies of any third-party services you access in connection with the Services.

Some web browsers transmit "do not track" (DNT) signals to websites. Because there is no universally accepted standard for how to respond to DNT signals, we do not currently take action in response to DNT signals.

We do honor Global Privacy Control ("GPC") signals where required by applicable law, including but not limited to California, Colorado, and Connecticut. When we detect a GPC signal from your browser, we will treat it as a valid opt-out request for the sale or sharing of personal information, as those terms are defined under applicable state law. You can learn more about GPC at globalprivacycontrol.org.

We reserve the right to modify this Policy at any time. Changes will be effective upon posting to the Services at tradecatalyst.com/privacy-policy. Material changes will be communicated to you by email or by prominent notice on the Services. Your continued use of the Services after any modification constitutes acceptance of the revised Policy. We recommend you review this Policy periodically.

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact: