Privacy Policy
Last updated: 2026-10-05
1. Controller
WANOLABS SRL, a company established in Romania, is the controller of your personal data. You can reach us at contact@wanolabs.com. This policy applies to systemic.finance, our HTTP API, our MCP server and the docs site at docs.systemic.finance.
2. Data we collect
Account data. Your name, email, profile picture, account tier and visibility, the dates your account was created, last seen and last updated, and your consent choices with the time you gave them. If you sign in with Google, Google shares your name, email and profile picture with us. Account data is required to provide the service.
Content. The strategies and Python modules you build, the data your runs produce, and the API keys you create.
Connected assistants. When you connect an AI assistant such as Claude or ChatGPT through our MCP server, we process the tool calls it makes on your behalf: the arguments it sends and the results we return. These can include your strategies, processors, run data and account details. We do not receive or store your conversation with the assistant or its prompts. A tool call is stored only as the account data or content that the tool writes, such as a new strategy. You can revoke an assistant's access at any time from Connected apps in your account. The assistant's refresh token is revoked at once and it loses access within 15 minutes, the lifetime of an access token.
Payment data. Stripe processes your payments and holds your payment details, such as your card details and billing address. We never see or store your full card number. We keep your Stripe customer id, your billing and credit counters, and the transactions Stripe reports back to us. Payment data is required for paid tiers.
Technical data. Our servers log your IP address, request timestamps and the pages and API endpoints you call.
Analytics and session replay. With your consent, we use PostHog to understand how the service is used and to record sessions. You are identified by your account id only; we do not send PostHog your email or name. Product analytics covers events such as pages visited and features used. Session replay records clicks, mouse movement, scrolling and the content of the page you view, with input fields masked. Analytics and session replay are two separate consent choices, both off by default.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account | Account data, content | Art. 6(1)(b), contract |
| Payments and billing | Payment data | Art. 6(1)(b), contract |
| Support | Account data, your messages to us | Art. 6(1)(b), contract |
| Showing your public strategies | Content, name and profile picture if your profile is public | Art. 6(1)(b), contract |
| Invoices and accounting | Payment data | Art. 6(1)(c), legal obligation |
| Answering legal requests | Any of the above | Art. 6(1)(c), legal obligation |
| Security, abuse prevention and running the service | Technical data, account data | Art. 6(1)(f), legitimate interest |
| Selling or transferring the business | Any of the above | Art. 6(1)(f), legitimate interest |
| Product analytics | Analytics data | Art. 6(1)(a), consent |
| Session replay | Session recordings | Art. 6(1)(a), consent |
We make no decisions about you based solely on automated processing.
4. Recipients
We share personal data with the processors below.
Amazon Web Services, United States, for hosting and sign-in.
Stripe, for payments and billing. Stripe also acts as an independent controller for its own fraud prevention, tax reporting and legal compliance, under its own privacy policy.
PostHog Inc., United States, for product analytics and session replay, only if you consent.
Monitoring providers in the United States, for the logs and metrics we use to run the service.
Google, only if you choose to sign in with Google, to authenticate you.
The provider of the AI assistant you connect, such as Anthropic or OpenAI, only if you connect one. It receives the tool results we return to your assistant, and handles them as an independent controller under its own privacy policy and your agreement with it.
We disclose personal data to law enforcement, regulators, courts and other public authorities when the law requires it or when necessary to protect our rights or the rights of others. If we sell or transfer the business, or part of it, the buyer receives the data needed to continue operating the service, subject to this policy.
5. Public information
If you set a strategy to public, anyone can see it, with or without an account. If your profile is also public, your name and profile picture are shown with it. Setting a strategy back to private stops it being shown from that point on.
6. International transfers
Our processors are located in the United States. Where a processor is certified under the EU-US Data Privacy Framework, we rely on that certification. Otherwise we rely on the European Commission's standard contractual clauses under Implementing Decision (EU) 2021/914. Email us for a copy of the clauses.
7. Retention
We keep your account data and content for as long as your account exists. Data processed for a connected assistant is kept for as long as the account data it belongs to; we keep no copy of the tool calls beyond the content they write and our server logs. If you ask us to delete your account, by writing to contact@wanolabs.com, we delete your data within 30 days, except invoices and payment records, which we keep for 10 years under Romanian accounting law. Server logs are kept only as long as we need them for security and troubleshooting. Analytics and session-replay data are kept until you withdraw consent or delete your account, whichever comes first.
8. Cookies and similar technologies
We use strictly necessary cookies and similar storage for your sign-in session and your consent choice. These are set regardless of consent. We use optional technologies for analytics and session replay, which are off by default and only run once you consent through the banner shown when you first visit. You can change your choice at any time from the "Consent preferences" link in the footer. Withdrawing consent stops collection from that point on and does not affect the lawfulness of processing carried out before.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate or incomplete data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict how we process your data (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21); and
- withdraw consent at any time, for processing based on it (Art. 7(3)).
To exercise any of these rights, email contact@wanolabs.com. We may ask you to confirm your identity before we act on a request. We respond within one month, or up to three months for complex requests, in which case we tell you within the first month.
You also have the right to complain to the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro), or to the supervisory authority of your own country of residence.
10. Children
You must be 18 or older to use Systemic. If we learn that we hold data belonging to someone younger, we delete it.
11. Security
We encrypt data in transit and restrict access to personal data to those who need it to operate the service. To report a vulnerability, email contact@wanolabs.com.
12. Changes
If we make material changes to this policy, we will tell you by email or in the app before they take effect.