Legal
Privacy Policy
Effective March 10, 2026 · Last updated March 10, 2026
1. Introduction
Rail Technology Concept (“Rail”, “we”, “us”, or “our”) operates the Rail Money platform, an automated wealth management application. This Privacy Policy explains how we collect, use, disclose, and protect personal information of users (“you”) who access our services.
By using Rail, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
Information You Provide
- Full name, date of birth, nationality
- Email address, phone number, residential address
- Bank account details, transaction history, deposit and withdrawal records
- Government-issued ID documents and selfie/liveness images (collected via our KYC provider)
- Tax identification number (where required)
Information Collected Automatically
- Device type, operating system, unique device identifiers
- Pages visited, features used, timestamps, session duration
- IP address, approximate geolocation derived from IP
Information from Third Parties
- Identity verification results from our KYC provider
- Brokerage account status, trade confirmations, and portfolio positions from Alpaca Securities
- Deposit confirmations and transfer status from Bridge Network
3. How We Use Your Information
- Provide our services: Process deposits, execute the automatic allocation split, manage your spending and investment balances
- Verify your identity: Comply with KYC/AML obligations under applicable law
- Operate your brokerage account: Create and manage your brokerage account for automated investment
- Communicate with you: Send transaction confirmations, security alerts, and service updates
- Comply with legal obligations: Respond to regulatory requests, prevent fraud, and maintain audit records
- Improve our platform: Analyse usage patterns to improve product features and performance
We do not sell your personal data to third parties.
4. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Account creation and service delivery | Performance of contract |
| KYC/AML verification | Legal obligation |
| Fraud prevention | Legitimate interests |
| Marketing communications | Consent (opt-in only) |
| Analytics and improvement | Legitimate interests |
5. Data Sharing
We share your data only with:
- Bridge Network — KYC verification, virtual account creation, and crypto custody
- Alpaca Securities LLC — brokerage account creation and trade execution
- SendGrid (Twilio) — transactional email delivery
- Legal authorities — where required by law, court order, or regulatory obligation
All third-party processors are bound by data processing agreements and are required to maintain appropriate security standards.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and identity data | 7 years after account closure |
| Transaction records | 7 years |
| KYC documents | 5 years after relationship ends |
| Usage/log data | 90 days |
| Marketing preferences | Until withdrawn |
7. Data Security
- AES-256-GCM encryption at rest for all sensitive data
- TLS 1.3 encryption in transit for all API communications
- Role-based access controls with principle of least privilege
- JWT tokens with short expiry, optional two-factor authentication
- SOC 2-compliant cloud infrastructure
- Automated anomaly detection and security event logging
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated data (subject to legal retention obligations)
- Portability — receive your data in a machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent for marketing communications at any time
To exercise any of these rights, contact us at privacy@userail.money.
10. Children's Privacy
Rail is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete the account and associated data promptly.
11. International Data Transfers
Your data may be processed in the United States where our infrastructure providers operate. We ensure appropriate safeguards are in place, including standard contractual clauses where required.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the change takes effect.
13. Contact Us
Rail Technology Concept
Email: privacy@userail.money
Support: support@userail.money