1Who we are
GREENWORM is run by EvilAI. GREENWORM and ATM Lab are both part of EvilAI. In this policy "we", "us" and "our" mean EvilAI. We are the controller of the personal data described here.
This policy explains what personal data we collect when you visit greenworm.app, buy a subscription and use the GREENWORM terminal at terminal.greenworm.app, why we use it, who we share it with and the rights you have. It sits alongside our Terms of Service.
Questions about your data: support@greenworm.app.
2What we collect
When you buy
- Your Discord account details, when you sign in with Discord: your Discord ID, username and the email address on your Discord account.
- Your plan, the dates of your subscription and payments, and its status.
- Payment details. Your card is entered on Stripe's page, not ours, and we never see your full card number. Stripe tells us the card brand, its last four digits, its expiry, its country and a fingerprint that identifies the card without revealing it.
- A record that you agreed to our Terms of Service: the version, the time, and the page where you agreed.
- The page or link that brought you to us (for example, which video you came from), if the link carried that information.
When you use the terminal
- Your Discord ID, display name and avatar, and whether your Discord account holds the role that gives access to GREENWORM.
- Your settings, chart layouts, workspaces and the scripts you write, which we store against your account so they follow you between devices.
- Alerts you set up to be sent to you as Discord messages: the instrument, timeframe and indicator they watch.
- Bug reports and feature requests you send us, including any screenshots you attach and a short technical summary of your browser and the app's state at the time.
- If you connect a broker account (for example Tradovate): your broker sign-in passes through our server once to obtain an access token and is never stored. The token is kept in your browser. Orders you place are sent to your broker on your instruction.
- A record of your acceptance of each version of the Terms when you sign in: your Discord ID, the version, the time, your browser's user-agent string and a one-way hashed form of your IP address.
If you joined the GREENWORM waitlist
- Your email address and the markets you chose.
Automatically
- Our hosting providers keep standard server logs (IP address, browser type, the page requested and the time) to run and protect the service.
We do not use advertising or analytics trackers, and we do not sell your personal data.
3Why we use it, and our legal basis
UK data protection law requires us to have a legal basis for each use of your data.
- To provide what you paid for (performance of our contract with you): to create and run your subscription, give you access to the terminal, sync your settings and send the alerts you ask for.
- To take payment and keep financial records (contract and legal obligation): tax and accounting law require us to keep billing records.
- To prove what was agreed (legitimate interests): keeping a record of your acceptance of the Terms.
- To prevent fraud and abuse and protect the service (legitimate interests): for example, to block payment cards, emails or accounts linked to fraud, chargebacks or a breach of our Terms, and to detect misuse such as account sharing or automated scraping.
- To tell you about GREENWORM (your consent, given when you joined the waitlist): news about GREENWORM, its launch and offers. You can withdraw that consent at any time by asking us to remove you.
- To understand which of our videos and pages bring people to us (legitimate interests), using the link you arrived from, without tracking you across other sites.
- To fix problems you report (legitimate interests).
Where we rely on legitimate interests, you can object (section 8).
4Who we share it with
We share personal data only with the service providers who help us run GREENWORM, and only what each needs:
- Stripe: payments and subscriptions.
- Discord: sign-in, the role that grants access, and the alert messages you ask for.
- Vercel: hosting of greenworm.app and the terminal, and storage of bug-report attachments.
- Supabase: the database that holds your synced settings, layouts, scripts, the Terms record and the waitlist.
- Railway: hosting of our website, evilmodel.com, which runs checkout, and of our sign-in, market-data and real-time services.
- Your broker, when you connect one and place orders.
We may also disclose data if the law requires it, to enforce our Terms, or to protect our rights, our users or the public, and to a buyer if the business is sold.
5International transfers
Several of these providers are based in, or store data in, the United States. Where personal data leaves the UK we rely on the UK's adequacy regulations (including the UK–US data bridge for certified organisations) or on the UK International Data Transfer Agreement or Addendum, so that your data stays protected to UK standards.
6How long we keep it
- Billing and payment records: six years after the end of the financial year they relate to, as UK tax law requires.
- Records of your acceptance of the Terms: for as long as you have an account and for six years afterwards, in case of a dispute.
- Your settings, layouts, scripts and alerts: while you are a member and for 90 days afterwards, so they are still there if you come back. Ask us and we will delete them sooner.
- Bug reports: 12 months.
- Waitlist sign-ups: until you ask us to remove you, or until we stop running the waitlist.
- Fraud-prevention records (such as blocked cards, emails and accounts): for as long as needed to prevent the fraud or abuse recurring.
- Server logs: for the short periods our hosting providers keep them.
7Data kept on your device
The terminal stores your settings and cached chart data in your browser's local storage so it opens quickly. evilmodel.com uses a session cookie to keep you signed in during checkout. These are strictly necessary for the service you ask for. We do not use advertising or analytics cookies.
8Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it;
- ask us to delete it;
- object to, or ask us to restrict, how we use it;
- ask for the data you gave us in a portable format.
To use any of these rights, contact us (section 1). We will reply within one month. Some data we must keep by law (for example billing records), and we will tell you if that applies.
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
9Security
We use encrypted connections, access controls and providers with strong security practices. Sign-in tokens expire, broker passwords are never stored, and the IP address in your Terms record is kept only in a one-way hashed form. No system is perfectly secure, but we will tell you and the regulator promptly if a breach puts your data at risk, as the law requires.
10Children
GREENWORM is not for children. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger.
11Changes to this policy
If we change this policy we will update the version and date at the top. If a change materially affects how we use your data, we will tell you in the terminal or by Discord message before it takes effect.