Privacy Policy
Last updated: February 2026
1. Who We Are
Hedge Layer ("we," "us," or "our") operates the website at hedgelayer.ai. We act as the data controller for personal data collected through our platform. For privacy inquiries, contact us at privacy@hedgelayer.ai.
2. Data We Collect
Account data
When you sign in, we collect your email address via MetaMask wallet sign-in. We use this to identify your account and deliver authentication emails.
Session data
When you use the AI research chat, we store your conversation messages, Market Briefs, bookmarked markets, and related metadata in our Supabase PostgreSQL database, linked to your user ID.
Usage & analytics data
With your consent, we use Vercel Analytics and Vercel Speed Insights to collect anonymised page-view and performance data. These services do not use cookies for tracking and process data in accordance with Vercel's privacy policy.
Technical data
Our servers automatically receive your IP address, browser user-agent, and referrer URL on each request. IP addresses are used for geolocation-based access restrictions (see Section 7) and are not stored long-term.
3. How We Use Your Data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Account authentication & session management | Contract performance (Art. 6(1)(b)) |
| Storing & displaying your chats, Market Briefs, and bookmarks | Contract performance (Art. 6(1)(b)) |
| Processing market discovery, feed screens, and dry-run allocator plans | Contract performance (Art. 6(1)(b)) |
| Anonymised analytics & performance monitoring | Consent (Art. 6(1)(a)) |
| Geolocation-based access restrictions | Legal obligation / legitimate interest (Art. 6(1)(c)/(f)) |
| Preventing fraud & enforcing terms | Legitimate interest (Art. 6(1)(f)) |
4. Cookies & Local Storage
We use the following browser storage mechanisms:
| Name / type | Purpose | Category |
|---|---|---|
| Supabase auth cookies | Session authentication | Strictly necessary |
hl_cookie_consent (localStorage) | Remembering your cookie preference | Strictly necessary |
hl-sidebar-collapsed (localStorage) | Remembering whether your history sidebar is collapsed | Strictly necessary |
| Vercel Analytics | Anonymised usage analytics | Analytics (consent required) |
Strictly necessary storage cannot be disabled as it is essential for the site to function. Analytics storage is only activated when you accept cookies via our consent banner.
5. Third-Party Services
| Service | Data shared | Purpose |
|---|---|---|
| Supabase (US) | Email, chat, Market Brief, bookmark, profile, and token metadata | Auth, database |
| OpenRouter and AI model providers (US) | Chat messages (in-flight only) | AI market research and Market Brief generation |
| Polymarket (US) | Market queries | Market data and outbound market links |
| Vercel (US) | Anonymised analytics | Hosting & analytics |
| Resend (US) | Email address | Auth email delivery |
Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses or equivalent safeguards.
6. Your Rights
Under the UK GDPR, you have the right to:
- Access your personal data — view your chats and bookmarks in the app or export chats via the API.
- Rectification — update your profile information.
- Erasure — delete individual chats or request full account deletion in Settings.
- Data portability — export your chats via the API (
GET /api/assessments?list=true). - Withdraw consent— change your cookie preferences at any time by clearing your browser's local storage.
- Lodge a complaint— with the UK Information Commissioner's Office (ICO) at ico.org.uk.
We will respond to data subject requests within 30 days. Contact privacy@hedgelayer.ai for any request.
7. Geographic Restrictions
We restrict access to trading features in certain jurisdictions based on regulatory requirements. IP-based geolocation is used solely for this purpose and is not stored. See our Terms of Service for the full list of restricted jurisdictions.
8. Data Retention
Assessment data is retained until you delete it or request account deletion. Authentication session data expires automatically. Anonymised analytics data is retained by Vercel per their retention policy.
9. Security
We employ encryption in transit (TLS), row-level security in our database, API token hashing, and scoped access controls. We do not store passwords - authentication uses a browser wallet signature.
10. Children
Hedge Layer is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the website. Continued use of the service after changes constitutes acceptance of the updated policy.