Privacy Policy.

FLC is a service operated by Ai Viral Sweden AB, a company registered in Sweden with company registration number 559433-0952 (“FLC”, “we”, “us”). Ai Viral Sweden AB is the data controller for the personal data described in this policy. We operate a platform where managers build a track record on simulated capital and, once qualified, may manage a funded allocation.

If you have any question about this policy or want to exercise your rights, contact us via our contact page. Please tell us which account the request concerns so we can verify your identity.

We collect only what we need to run the platform and meet our legal obligations.

• Account data: name, email address, password hash, country, language, account status and communication preferences.
• Profile and track-record data: display name, fund or strategy description, avatar and public performance statistics you choose to publish.
• Trading and platform activity: simulated orders, positions, equity history, drawdown, risk-rule events, eliminations, statuses, rankings and session activity.
• Verification data: identity documents, date of birth, address and, where required, tax identifiers — collected when needed before payouts or for compliance checks.
• Payment data: purchase records for Qualification retries, activation fees and risk evaluation fees, plus payout details. Card details are processed by our payment providers, not stored by us.
• Support and communications: messages, tickets, attachments and the correspondence history with our team.
• Technical data: IP address, device and browser type, operating system, timestamps, error logs and security events.
• Cookie and usage data: as described in the cookies section below.

We do not knowingly collect data from anyone under 18, and we do not seek special-category data. Identity documents are handled only for verification and anti-fraud purposes.

• To create and operate your account, run the Qualification, enforce risk rules and manage funded allocations — performance of a contract.
• To evaluate performance, decide eligibility, review risk-evaluation requests and calculate profit shares — performance of a contract.
• To process fees and payouts through payment providers — performance of a contract and legal obligation.
• To verify identity and prevent fraud, market abuse, multi-accounting, money laundering and sanctions breaches — legal obligation and legitimate interest.
• To secure the platform, detect bugs, monitor abuse and keep audit trails — legitimate interest.
• To provide support and respond to your requests — performance of a contract and legitimate interest.
• To improve the product and produce anonymised or aggregated statistics, leaderboards and research — legitimate interest.
• To send service messages you cannot opt out of (security, rule changes, account status) — performance of a contract; and marketing emails — consent, withdrawable at any time.
• To establish, exercise or defend legal claims and comply with accounting, tax and regulatory duties — legal obligation and legitimate interest.

Where we rely on a legitimate interest, we have balanced that interest against your rights and freedoms, and we limit processing to what is necessary for the stated purpose.

Parts of the platform run automatically: risk limits, the fixed Qualification loss limit, the funded trailing drawdown, activity counters, rankings and pass/fail evaluation are applied by software without manual review. This is necessary to apply the same rules to everyone and is described in our House Risk Rules.

Decisions with significant effect — granting a funded allocation, approving a risk evaluation, terminating a mandate, or approving a payout — always involve human review. You may contest such a decision and ask for it to be re-examined by contacting us.

We never sell your personal data. We share it only with:

• Infrastructure and hosting providers that run our application, database and storage.
• Payment and payout providers that process your transactions.
• Identity verification, fraud-prevention and compliance providers.
• Email, analytics, error-monitoring and customer-support providers.
• Professional advisers such as accountants, auditors and lawyers, under confidentiality.
• Authorities, regulators and courts where we are legally required to disclose, or to protect our rights.
• An acquirer or successor in the event of a merger, reorganisation or sale of business.

Providers act as processors on our documented instructions under a data-processing agreement, and may not use your data for their own purposes. Public profile and leaderboard information you choose to publish is visible to other users and visitors.

Some of our providers operate outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on an adequacy decision, on the European Commission’s Standard Contractual Clauses, or on another lawful transfer mechanism, together with additional technical and organisational safeguards such as encryption and access control. You can ask us for information about the safeguards applied to a specific transfer.

• Account, profile and trading data: for as long as your account is open, then normally up to 24 months after closure to handle disputes and prevent abuse such as circumventing an elimination.
• Verification records: for the period required by anti-money-laundering and know-your-customer rules, typically five years after the relationship ends.
• Payment, fee and payout records: for the statutory accounting retention period, typically seven years.
• Support correspondence: normally up to 24 months after the case is closed.
• Security and technical logs: normally up to 12 months, longer where an incident is under investigation.
• Anonymised and aggregated statistics: indefinitely, as they no longer identify you.

We may keep specific data longer where necessary to establish, exercise or defend a legal claim, or where a law requires it.

Under the GDPR and equivalent laws you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have data erased where we no longer have a lawful reason to keep it;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out;
• not be subject to a solely automated decision with significant effect, and to obtain human review; and
• lodge a complaint with your supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY).

We respond to requests within one month, extendable by two further months for complex cases. We may ask you to verify your identity first, and we may decline a request where an exemption applies — for example where retention is required for accounting or anti-money-laundering purposes.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, row-level access control in our database, least-privilege access for staff, audit logging, environment separation and monitoring for abnormal activity.

No system is completely secure. You are responsible for using a strong, unique password and for keeping your credentials confidential. If you believe your account has been compromised, contact us immediately. Where a breach is likely to result in a risk to your rights, we will notify the supervisory authority and, where required, you.

• Strictly necessary cookies and local storage: keep you signed in, remember your session and protect against fraud. These cannot be switched off.
• Preference storage: remembers settings such as your chosen views.
• Analytics and performance: helps us understand how the platform is used, so we can improve it. Used only with your consent where required.

You can clear or block cookies in your browser, but strictly necessary cookies are required for signing in and using the platform.

We may update this policy as the platform, our providers or the law change. The “last updated” date at the top always reflects the current version, and we will notify you of material changes through the platform or by email. Your continued use after the effective date means you accept the updated policy. This policy should be read together with our Terms of Service.