Privacy Policy

1. Information We Collect

Here Tomorrow LLC ("Here Tomorrow," "we," "us," or "our") collects the following categories of information in connection with providing commodity trading advisory services, OTC derivatives execution, and related analytical tools:

• Account & Onboarding Information: Legal entity name, LEI (Legal Entity Identifier), authorized signatories, contact details, organizational structure, and beneficial ownership disclosures as required under FinCEN CDD/BOI rules
• KYC/AML Documentation: Government-issued identification, corporate formation documents, proof of ECP (Eligible Contract Participant) status, beneficial ownership certifications, and sanctions screening results
• Financial Documents: P&L statements, balance sheets, cash flow projections, and other business financial data you upload for hedge analysis and suitability assessment
• Trading & Transaction Data: Orders, positions, fills, transaction history, hedge performance metrics, margin balances, and settlement records across all execution venues
• OTC Derivatives Data: ISDA Master Agreement details, Credit Support Annex terms, trade confirmations, novation records, netting set identifiers, and valuation dispute records
• Usage & Behavioral Data: Platform interactions, feature usage patterns, analytical preferences, dashboard configurations, and alert settings
• Device & Security Information: IP address, browser fingerprint, device identifiers, multi-factor authentication tokens, session logs, and geolocation data for security and sanctions compliance
• Information from Third-Party Sources: We may collect information about you from third-party sources, including credit reporting agencies, sanctions screening databases (OFAC, EU Consolidated List), identity verification services, public records, beneficial ownership registries (FinCEN BOI), exchange member databases, and counterparty due diligence platforms. This information is used to verify your identity, assess creditworthiness, comply with regulatory obligations, and maintain the integrity of the platform.

2. How We Use Your Information

• Provide AI-driven hedge analysis and recommendations based on your financial data and market conditions
• Execute and manage hedging positions, including OTC bilateral and cleared derivatives, on your behalf
• Comply with regulatory requirements including CFTC, NFA, SEC, FinCEN, and anti-money laundering obligations
• Maintain audit trails as required by commodity trading regulations and ISDA documentation standards
• Perform counterparty credit assessments and exposure calculations for bilateral trading relationships
• Generate and deliver trade confirmations, valuations, and periodic statements
• Facilitate Swap Data Repository (SDR) reporting and real-time public reporting as required by Dodd-Frank Title VII
• Improve our analytical models, risk engines, and platform functionality
• Communicate important account, margin, regulatory, and service updates

2A. Legal Bases for Processing

We process your personal information under the following legal bases:

• Contractual Necessity: Processing necessary for the performance of our agreement with you, including account management, trade execution, settlement, margin calculations, and delivery of advisory services under our CTA engagement
• Legal and Regulatory Compliance: Processing necessary to comply with our obligations under the Commodity Exchange Act, CFTC Regulations, NFA Rules, Bank Secrecy Act, FinCEN regulations, OFAC sanctions requirements, and other applicable laws and regulations
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, credit risk assessment, platform security, analytics and service improvement, and enforcement of our Terms of Service, provided such interests are not overridden by your data protection rights
• Consent: Where required by law, we process certain data based on your explicit consent, including marketing communications, optional analytics cookies, and sharing of data with third parties for purposes beyond those described above. You may withdraw consent at any time by contacting kale@heretomorrow.us, without affecting the lawfulness of processing performed prior to withdrawal

3. ISDA Schedule Data Obligations

Where you enter into an ISDA Master Agreement with Here Tomorrow or through our platform with a bilateral counterparty, the following data handling obligations apply in accordance with ISDA Master Agreement Schedule Part 4 (Other Provisions) and industry-standard Confidentiality provisions:

• Trade Confirmation Confidentiality: All trade confirmations, including economic terms, notional amounts, payment dates, and calculation methodologies, are treated as Confidential Information under Section 4 of the ISDA Master Agreement. Confirmations are stored in encrypted, access-controlled repositories and are disclosed only to authorized personnel, applicable regulators, and designated Swap Data Repositories.
• Schedule & CSA Terms: The specific terms of your ISDA Schedule, including Specified Entities, Credit Support Annex thresholds, Independent Amounts, and Eligible Collateral definitions, are maintained under strict need-to-know access controls and are never disclosed to other counterparties or third parties except as required by law.
• Permissible Uses of Transaction Data: Transaction data is used solely for: (a) trade lifecycle management, (b) mark-to-market and collateral calculations, (c) regulatory reporting obligations, (d) credit risk assessment within agreed netting sets, and (e) dispute resolution. We do not use your Transaction data for proprietary trading or to benefit other counterparty relationships.
• Cross-Default & Credit Event Notifications: Where your ISDA Schedule includes Cross-Default, Cross-Acceleration, or Credit Event Upon Merger provisions, we may share limited notification data (event type, entity affected, threshold amounts) with counterparties who have a contractual right to receive such information under their own ISDA agreements with you, but only to the minimum extent necessary to effectuate the relevant provision.
• Calculation Agent Data Access: Where Here Tomorrow acts as Calculation Agent, we access Transaction data, relevant market data, and valuation inputs necessary to perform determinations under the applicable Confirmation. All Calculation Agent determinations are documented, auditable, and made available to both parties. Disputes regarding Calculation Agent determinations follow the procedures specified in your ISDA Schedule or the applicable ISDA Definitions booklet.

4. Exchange Data Standards

Here Tomorrow interfaces with regulated exchanges, clearinghouses, and CFTC-registered Designated Contract Markets (DCMs). The following protocols govern our handling of exchange-related data:

• Market Data Identifier (MDI) Protocols: All market data consumed from exchange feeds is handled in compliance with each exchange's Market Data Distribution Agreement. Derived data, analytics, and indices generated from exchange feeds are clearly distinguished from raw market data and are subject to redistribution limitations.
• Pre-Trade Transparency: Indicative pricing, request-for-quote (RFQ) responses, and streaming quotes provided through our platform are subject to pre-trade transparency requirements under CFTC Part 37 (SEF) and Part 38 (DCM) rules. Your pre-trade inquiry data is not shared with other market participants except where required by the applicable execution method (e.g., order book, RFQ-to-3).
• Post-Trade Transparency & Reporting: Executed transactions are reported in accordance with CFTC real-time public reporting rules (Part 43) and regulatory reporting rules (Part 45). Publicly reported data is anonymized and delayed in accordance with applicable block trade and cap size thresholds.
• Position Reporting: Large Trader positions are reported to the CFTC via Form 102/204 and to the NFA as required. Your position data is shared with applicable exchanges for position limit surveillance. We maintain position data with the granularity required for Ownership and Control Reporting (OCR).
• Anonymization of Aggregated Data: Any aggregated trading data used for platform analytics, market intelligence, or research publications is fully anonymized such that no individual counterparty, account, or trading strategy can be identified. Aggregation minimums of 5 participants per data point are enforced.
• Order Routing & Execution Venue Data: Order routing decisions, execution venue selection data, latency metrics, and fill quality statistics are retained for best execution documentation purposes. This data is available to you upon request and to regulators upon examination.

5. Data Security

We implement enterprise-grade security measures commensurate with the sensitivity of OTC derivatives data and regulatory expectations, including:

• Encryption at rest (AES-256) and in transit (TLS 1.3) for all data stores and API communications
• Role-based access controls with principle-of-least-privilege enforcement across all systems
• Comprehensive audit logging of all data access, modifications, and administrative actions with tamper-evident hashing
• Regular third-party penetration testing and SOC 2 Type II compliance assessments
• Financial documents and ISDA agreement data stored in encrypted cloud storage (Supabase) with access restricted to authorized analytical and operational processes
• Hardware security modules (HSMs) for cryptographic key management
• Real-time intrusion detection and anomaly monitoring

While we implement reasonable administrative, technical, and physical safeguards designed to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data. In the event of a security breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law (see Section 5A below).

5A. Breach Notification

In the event of a security breach that results in unauthorized access to, disclosure of, or loss of your personal information, Here Tomorrow will:

• Notify affected individuals without unreasonable delay, and in no event later than required by applicable state and federal law (including but not limited to the applicable state data breach notification statute and, where applicable, GDPR Article 34)
• Notify applicable regulatory authorities, including the CFTC, NFA, and relevant state attorneys general, as required by law
• Provide a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects
• Cooperate with law enforcement and regulatory investigations as appropriate

6. Data Sharing & Counterparty Disclosures

We do not sell your personal information or Transaction data. We may share data with the following categories of recipients:

6.1 Regulatory & Legal Disclosures

• Regulators: CFTC, NFA, SEC, FinCEN, and other domestic or foreign regulatory bodies as required by law, subpoena, or regulatory examination
• Swap Data Repositories (SDRs): Transaction data reported to CFTC-registered Swap Data Repositories pursuant to CFTC Parts 43 and 45
• Law Enforcement: When required by valid legal process or to protect against fraud, market manipulation, or threats to safety

6.2 Counterparty Data Sharing

• Pre-Trade Disclosure: Prior to executing bilateral OTC transactions, limited counterparty information (entity name, LEI, ECP status, credit rating where available) is shared with potential counterparties as necessary for trade negotiation and credit assessment
• LEI Sharing Obligations: Your Legal Entity Identifier is shared as required by CFTC regulations for swap reporting and with counterparties for trade documentation. LEIs are public identifiers maintained by the Global LEI Foundation (GLEIF)
• Bilateral Matching & Affirmation: Trade details are shared with counterparties and, where applicable, middleware platforms (e.g., MarkitWire, Traiana) for electronic matching, affirmation, and confirmation processing
• SDR Reporting: Both parties to a swap transaction have reporting obligations. Where Here Tomorrow is the reporting counterparty, we submit the required data fields to the applicable SDR. Where you are the reporting counterparty, we provide you with the data necessary to fulfill your reporting obligations
• Clearing & Settlement: For cleared transactions, trade data is submitted to the applicable CFTC-registered Derivatives Clearing Organization (DCO)

6.3 Affiliates

• Corporate Affiliates: We may share your information with our corporate affiliates, subsidiaries, and parent entities for purposes consistent with this Privacy Policy, including shared compliance and risk management functions

6.4 Business Transfers

• Mergers, Acquisitions, or Asset Sales: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information and Transaction data may be transferred to the acquiring entity or successor as part of such transaction. We will provide notice to you before your information is transferred and becomes subject to a different privacy policy
• Due Diligence: In connection with any potential corporate transaction, we may share limited information with prospective acquirers and their advisors under strict confidentiality agreements, to the extent permitted by applicable law and our regulatory obligations

6.5 Service Providers

• Cloud Infrastructure: Supabase (database and storage), with data processing agreements and appropriate security certifications in place
• AI Processing: Anthropic (Claude) for hedge analysis and recommendation generation, subject to the AI/Algorithmic Processing disclosures in Section 9
• Document Management: DocuSign for electronic execution of ISDA agreements and trade confirmations
• Market Data Providers: Licensed exchange data feeds for pricing, valuation, and analytics

7. Data Retention

We maintain a comprehensive data retention program designed to satisfy overlapping regulatory requirements applicable to commodity trading advisors, swap dealers, and financial institutions:

• Swap & Trading Records (5-Year Minimum): All swap transaction records, trade confirmations, valuations, and related communications are retained for a minimum of five (5) years from the date of the transaction in compliance with CFTC Regulation 1.31 and Part 45 recordkeeping requirements. Records are maintained in a format that is readily accessible for the first two (2) years and retrievable thereafter.
• KYC/AML Documentation (7-Year Minimum): All Customer Identification Program (CIP) records, Customer Due Diligence (CDD) documentation, Suspicious Activity Reports (SARs), and Currency Transaction Reports (CTRs) are retained for a minimum of seven (7) years following account closure, as required by FinCEN regulations (31 CFR 1010.430) and Bank Secrecy Act obligations.
• Audit Trail Immutability: All audit trail records, including system access logs, data modification records, order audit trails, and compliance event logs, are stored in append-only, tamper-evident data stores. Audit records cannot be modified or deleted and are protected by cryptographic hashing to ensure integrity for regulatory examination.
• Data Lineage Tracking: We maintain complete data lineage records documenting the origin, transformation, and movement of all regulatory and financial data throughout our systems. Data lineage records support regulatory examination requirements and facilitate the reconstruction of any Transaction or analytical output.
• ISDA & Legal Documentation: ISDA Master Agreements, Schedules, Credit Support Annexes, and all amendments are retained for the duration of the trading relationship plus ten (10) years following termination of all outstanding Transactions.
• Backup & Disaster Recovery: All retained data is replicated across geographically separated data centers with a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. Backup integrity is verified through automated daily checksums and quarterly restoration testing.

8. Cross-Border Data Transfers

Here Tomorrow may process and transfer data across international borders in connection with global OTC derivatives markets. The following safeguards govern cross-border data flows:

• EU/EEA Counterparties (GDPR): Where we process personal data of EU/EEA-based counterparties or their representatives, we do so in compliance with the General Data Protection Regulation (EU) 2016/679. Legal bases for processing include: (a) performance of a contract (ISDA/trade execution), (b) compliance with legal obligations (EMIR, MiFID II), and (c) legitimate interests (credit risk assessment, fraud prevention). EU/EEA data subjects have additional rights including data portability, restriction of processing, and the right to lodge a complaint with a supervisory authority.
• EU-U.S. Data Privacy Framework (DPF): Where applicable, Here Tomorrow relies on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as certified by the U.S. Department of Commerce for transfers of personal data from the EU/EEA, UK, and Switzerland to the United States. To the extent that Here Tomorrow processes personal data in reliance on the DPF, it commits to comply with the DPF Principles, and individuals may direct complaints to our contact address or to the applicable DPF dispute resolution mechanism.
• Standard Contractual Clauses (SCCs): Where the DPF does not apply, transfers of personal data from the EU/EEA or UK to the United States or other jurisdictions without an adequacy determination are governed by the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by transfer impact assessments as required by the Schrems II decision.
• Data Localization Requirements: Where a jurisdiction mandates local data storage (e.g., certain Middle Eastern or Asian-Pacific regulatory regimes), we maintain local data processing infrastructure or engage locally hosted service providers subject to equivalent security standards and contractual protections.
• EMIR Reporting: For EU-regulated counterparties, trade data is reported to EU-registered Trade Repositories in compliance with EMIR (Regulation (EU) No 648/2012) and EMIR REFIT requirements. EMIR reporting data is processed within the EU or under appropriate transfer mechanisms.
• UK Data Protection: For UK-based counterparties, data transfers comply with the UK GDPR and the International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.
• Substituted Compliance: Where CFTC substituted compliance or mutual recognition arrangements exist with foreign regulators (e.g., ESMA, FCA, MAS), we leverage these frameworks to minimize duplicative reporting while maintaining full data protection standards.

9. AI & Algorithmic Data Processing

Here Tomorrow utilizes artificial intelligence and algorithmic systems to provide hedge analysis, risk assessment, and trading recommendations. We are committed to transparency regarding how your data interacts with these systems:

• Anthropic AI Processing Disclosures: Financial documents, position data, and market context are submitted to Anthropic's Claude models via API for the purpose of generating hedge recommendations, exposure analysis, and risk commentary. Data is transmitted over encrypted channels and processed under Anthropic's enterprise data processing agreement, which prohibits Anthropic from using your data for any purpose other than providing the requested output.
• Model Training Data Exclusion: Your financial documents, trading data, Transaction details, and any other confidential information submitted through the platform are never used to train, fine-tune, or improve Anthropic's AI models or any other third-party machine learning system. This exclusion is contractually guaranteed through our enterprise agreement with Anthropic and is independently auditable.
• Algorithmic Decision Transparency: AI-generated hedging recommendations, counterparty match suggestions, and risk scores are clearly labeled as algorithmically derived. Each recommendation includes: (a) the data inputs considered, (b) the analytical framework applied, (c) confidence indicators where applicable, and (d) material limitations or assumptions. No AI-generated recommendation is executed without explicit user authorization.
• Right to Human Review: You have the right to request human review of any AI-driven decision that materially affects your account, including hedge recommendations, counterparty risk assessments, credit scoring, and compliance flags. Human review requests are processed within one (1) business day by a qualified analyst. To request human review, contact kale@heretomorrow.us or use the "Request Review" feature within the platform.
• Automated Decision Safeguards: No fully automated decision results in the execution of a trade, the closing of a position, or the termination of a counterparty relationship without human-in-the-loop authorization. Compliance alerts and sanctions screening results are always reviewed by qualified compliance personnel before any action is taken.

10. Your Rights

Subject to applicable regulatory retention requirements and contractual obligations under outstanding ISDA agreements, you may:

• Request a copy of your personal data in a structured, commonly used, machine-readable format (data portability)
• Request correction of inaccurate or incomplete data
• Request deletion of your account and associated personal data (subject to regulatory retention periods outlined in Section 7 and outstanding contractual obligations)
• Opt out of non-essential communications and marketing
• Object to processing based on legitimate interests, subject to overriding regulatory or contractual requirements
• Request restriction of processing in certain circumstances (e.g., while accuracy of data is being verified)
• Receive an explanation of any AI-driven decision affecting your account (see Section 9)
• Lodge a complaint with the applicable data protection authority if you believe your data protection rights have been violated
• Exercise any of these rights without being subject to discrimination, retaliation, or denial of service, except to the extent that the exercise of such rights renders Here Tomorrow unable to comply with its regulatory obligations or perform under the Terms of Service

To exercise any of these rights, contact our Data Protection Officer at kale@heretomorrow.us. We will respond to verified requests within thirty (30) days. Requests that implicate regulatory recordkeeping obligations will be evaluated on a case-by-case basis in consultation with our compliance department.

10A. Cookies and Tracking Technologies

Here Tomorrow uses cookies and similar tracking technologies on the platform. The following categories of cookies may be used:

• Strictly Necessary Cookies: Required for the operation of the platform, including authentication, session management, security tokens, and fraud prevention. These cookies cannot be disabled.
• Functional Cookies: Used to remember your preferences, dashboard configurations, and display settings to enhance your experience on the platform.
• Analytics Cookies: Used to understand how users interact with the platform, including page views, feature usage, and performance metrics. Analytics data is aggregated and anonymized. We use Plausible Analytics and similar privacy-focused tools.

Opt-Out: You may manage your cookie preferences through your browser settings or through our cookie preference controls on the platform. You may also opt out of non-essential cookies by sending a request to kale@heretomorrow.us.

Global Privacy Control (GPC): Here Tomorrow recognizes and honors the Global Privacy Control signal. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information (to the extent applicable) and will limit non-essential tracking accordingly.

Do Not Track: We also honor "Do Not Track" browser signals to the extent required by applicable law.

10B. Children's Privacy

The Service is not directed at, and is not intended for use by, individuals under the age of 18 (or the age of majority in the applicable jurisdiction). Here Tomorrow does not knowingly collect personal information from children under the age of 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take prompt steps to delete such information from our systems. If you believe that a child under 16 has provided personal information to Here Tomorrow, please contact us at kale@heretomorrow.us.

10C. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"). This section supplements the other provisions of this Privacy Policy.

Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA: identifiers (name, email, LEI, government ID); financial information (account balances, transaction history, financial documents); commercial information (trading records, positions); internet or electronic network activity (IP address, browser type, usage data); geolocation data; professional or employment-related information; and inferences drawn from the foregoing.

Your CCPA Rights

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions including our regulatory recordkeeping obligations under the Commodity Exchange Act, CFTC Regulations, and Bank Secrecy Act.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: Here Tomorrow does not sell your personal information as defined by the CCPA. We do not share your personal information for cross-context behavioral advertising. If our practices change, we will provide a "Do Not Sell or Share My Personal Information" link on the platform and honor such requests.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information to purposes necessary to perform the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Submitting a Request

To exercise your CCPA rights, contact us at kale@heretomorrow.us or submit a request through the platform. We will verify your identity before processing your request. You may also designate an authorized agent to submit requests on your behalf by providing written authorization. We will respond to verified requests within forty-five (45) days, with one extension of up to forty-five (45) additional days where reasonably necessary.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or industry standards. Material changes will be communicated to you via email and/or a prominent notice on the platform at least thirty (30) days before the effective date. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

12. Contact

For privacy inquiries, data subject requests, or complaints, contact our Data Protection Officer:

• Email: kale@heretomorrow.us
• Mail: Here Tomorrow LLC, Attn: Data Protection Officer
• Response Time: We acknowledge all privacy inquiries within two (2) business days and provide substantive responses within thirty (30) days