Privacy Policy

Last updated: 2026-05-09

This Privacy Policy describes how Lutz Consulting Group, LLC, doing business as Candella ("Candella," "we," "us," or "our"), collects, uses, shares, and protects information when you use our website at candella.dev and the products and services made available through it (collectively, the "Service"), including the Candella Copytrade product.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Scope

This Privacy Policy applies to information we collect from and about you when you visit candella.dev, create an account, connect a brokerage account, or otherwise use the Service. It does not apply to third-party websites, applications, or services that we link to or integrate with, including your brokerage and SnapTrade. Those third parties have their own privacy policies, and you should review them.

2. Information We Collect

Account information. When you create an account, we collect identifiers such as your name, email address, and a password (stored as a salted hash, never in cleartext). If you make a payment, we collect billing information through our payment processor; we do not store full credit card numbers on our systems.

Brokerage and trading information. When you connect a brokerage account through SnapTrade, we receive information about that account from SnapTrade, including account identifiers, balances, holdings, orders, and transaction history. We use this information to operate the Service. We do not receive your brokerage username or password; SnapTrade handles authentication directly with your broker.

Lead trader information. If you are a lead trader on Candella Copytrade, we collect information about the trades executed in your connected brokerage account so the Service can mirror those trades for your subscribers. We do not collect or distribute your account balance, equity, or non-trade activity to subscribers.

Follower information. If you are a follower on Candella Copytrade, we collect information about your subscriptions, your manual approval decisions, your automated mode settings (if you have opted in), and the orders the Service places on your behalf.

Usage information. We automatically collect information about how you interact with the Service, including the pages you visit, features you use, the timing of your sessions, your IP address, browser type, device identifiers, and similar technical information. We use cookies and similar technologies to do this; see Section 11 below.

Communications. If you contact us, we keep a record of the communication and any information you provide.

We do not collect Social Security numbers, government identification numbers, biometric data, or precise geolocation data. We do not collect information from your device beyond what is necessary to operate the Service.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Authenticate you and protect your account.
• Connect to your brokerage through SnapTrade, retrieve your account data, and place orders that you have authorized.
• Operate Candella Copytrade, including detecting lead trader fills, applying your subscription rules, requesting your manual approval where required, and submitting mirrored orders.
• Process payments and manage subscriptions.
• Communicate with you about the Service, including service announcements, security alerts, and support responses.
• Monitor for fraud, abuse, and violations of our Terms of Service.
• Comply with applicable law and respond to lawful requests from authorities.
• Generate aggregated and de-identified data for analytics and product improvement. Aggregated data does not identify you and is not subject to this Privacy Policy.

We do not sell your personal information. We do not use your information for advertising directed at you on third-party platforms.

4. How We Share Information

We share information only as described in this section.

Service providers. We share information with vendors that support the Service. The vendors we currently use, and the data they receive, are:

• SnapTrade (Passiv Technologies Inc.): brokerage connectivity. SnapTrade receives the credentials you provide during the connect flow and the trading instructions we issue on your behalf, and returns brokerage account data to us. Their privacy policy is at https://snaptrade.com/privacy-policy.
• Supabase, Inc.: database, authentication, and file storage. Hosted in the United States. Their privacy policy is at https://supabase.com/privacy.
• Vercel Inc.: web hosting and edge compute. Hosted in the United States and other regions. Their privacy policy is at https://vercel.com/legal/privacy-policy.
• Stripe, Inc. (when applicable): payment processing. Their privacy policy is at https://stripe.com/privacy.

We update this list as we add or change vendors. Each vendor is contractually limited to using your information only to provide services to us.

Brokerages. When you place an order through the Service, the order is transmitted to your brokerage through SnapTrade. The brokerage receives the order details and is the entity that ultimately executes (or rejects) the order. Your relationship with the brokerage is governed by your agreement with that brokerage.

Other lead traders and followers. If you are a lead trader, your name (or pseudonym, if you set one) and your trade history within the Service are made visible to your subscribers as part of the Service. We do not share your brokerage account balance, your full account holdings outside of subscribed trades, or any personal contact information with subscribers. If you are a follower, your identity is not shared with the lead trader or other followers; the lead trader sees only that they have N subscribers.

Aggregated and de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you with partners, researchers, and the public.

Legal requests and protection of rights. We may share information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that sharing is necessary to protect the rights, property, or safety of Candella, our users, or others.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. If the Service is reorganized into a successor entity (including upon the formation of Candella Inc as described in Section 13), this Privacy Policy will apply to the successor with respect to information collected before the transfer.

5. Data Retention

We retain your information for as long as your account is active and for a reasonable period afterward to support business operations and comply with legal obligations. Specifically:

• Account information: retained for the lifetime of your account, plus 30 days after deletion to allow recovery of accidentally deleted accounts.
• Trading and brokerage data: retained for seven (7) years after the relevant trade or transaction. This is required by financial recordkeeping rules applicable to platforms that touch brokerage accounts.
• Logs: retained for up to 90 days for security and operational purposes.
• Aggregated and de-identified data: retained indefinitely.

After the applicable retention period, we delete or anonymize the information.

6. Security

We use commercially reasonable safeguards to protect your information, including encryption in transit (TLS 1.2 or higher), encryption at rest for sensitive fields, role-based access controls, regular security reviews, and monitoring for unauthorized access. No system is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a breach that affects your personal information, we will notify you and the appropriate authorities as required by law.

7. Your Choices and Rights

Account. You can review and update your account information at any time through your account settings. You can delete your account by contacting us at the address in Section 14; we will delete your information subject to the retention rules in Section 5.

Brokerage connections. You can disconnect any connected brokerage account from your account settings at any time. Disconnection revokes our access to that account and stops the Service from placing further orders on it.

Marketing communications. Service announcements and security alerts are required and cannot be disabled while your account is active. Marketing emails (if any) include an unsubscribe link.

Cookies. You can control cookies through your browser settings. Disabling cookies may break parts of the Service.

Data access and portability. You can request a copy of the personal information we hold about you. We will respond within 45 days.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act ("CCPA") gives you the following rights regarding the personal information we hold about you. We honor these rights for all users regardless of state, but California residents have specific procedural protections.

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the purposes for which we collected or shared it, and the categories of third parties with whom we shared it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to the retention rules in Section 5 and any legal exemptions.
• Right to correct. You may request that we correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. There is nothing for you to opt out of.
• Right to non-discrimination. We will not deny, charge a different price for, or provide a different level of Service to you for exercising your privacy rights.

To exercise any of these rights, contact us at the address in Section 14. We will verify your identity before responding. You may designate an authorized agent to make a request on your behalf.

9. Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child under 18 has provided us information, contact us and we will delete it.

10. International Users

The Service is operated from the United States, and your information will be processed in the United States. Data protection laws in the United States may differ from those in your country. If you access the Service from outside the United States, you consent to the transfer and processing of your information in the United States and other jurisdictions where our service providers operate.

11. Cookies and Tracking

We use cookies and similar technologies to authenticate you, remember your preferences, secure the Service, and understand how it is used. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until they expire or you delete them). We do not use third-party advertising cookies.

You can control cookies through your browser settings. Disabling cookies may prevent you from logging in or using parts of the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or through the Service at least 30 days before the change takes effect. Your continued use of the Service after the change takes effect constitutes acceptance of the updated policy.

13. Future Assignment to Candella Inc

Candella Copytrade and the broader Candella platform are currently operated by Lutz Consulting Group, LLC. The platform is expected to be assigned to a successor entity, currently anticipated to be Candella Inc, upon that entity's formation. On assignment, this Privacy Policy will apply to the successor entity with the same scope and obligations, and we will update the entity name in this document at that time. The assignment will not change the categories of information we collect or how we use it, and you will not need to re-consent to this Privacy Policy because of the assignment alone.

14. Contact

For questions about this Privacy Policy or to exercise any of the rights described above, contact us at:

Lutz Consulting Group, LLC, d/b/a Candella
10120 W Flamingo Rd, Ste 4-2055
Las Vegas, NV 89147-8394
United States
Email: jwlutz65@gmail.com

We will respond to privacy inquiries within 30 days.