Privacy Policy

Effective date: Pending confirmation
Last updated: 12 September 2026

This Privacy Policy explains how ASTRA LOGIC TECHNOLOGY PTE. LTD. (“GTO Fisher,” “we,” “us,” or “our”) collects, uses, discloses and protects personal data when you use GTO Fisher websites, applications and related services at gtofisher.com and its subdomains (the “Service”).

1. Controller and contact

The controller responsible for the processing described in this Policy is:

ASTRA LOGIC TECHNOLOGY PTE. LTD.
UEN: 202632763H
36 Robinson Road, #21-01
City House
Singapore 068877

Our data-protection contact receives and coordinates privacy matters. Privacy questions, complaints and rights requests may be sent to support@gtofisher.com with the subject line “Privacy Request.”

2. Scope

This Policy applies to personal data we control in connection with the Service, including private-beta access requests, accounts, solver study, Fisher AI, file attachments, practice and profile features, subscriptions, support and website use.

It does not govern:

• an independent poker room, operator or third-party website;
• a payment seller, merchant of record or app store acting as an independent controller for payment, tax, fraud or legal compliance; or
• employee and contractor data handled under separate internal notices.

Where a third party has its own privacy notice, review it before providing data.

3. Personal data we collect

3.1 Data you provide

• Access-request data: email address, stakes or level, poker site or environment, learning objectives and information you include in an invitation request.
• Account data: email address, name if provided, hashed password or authentication credentials, account identifier, language, appearance, settings and consent choices.
• Study and User Content: hand or spot descriptions, completed hand histories, notes, saved configurations, solver navigation, prompts, AI conversations, attachments, feedback and other content you submit.
• Practice data: quiz and decision answers, attempts, accuracy, score, response and session information, selected study settings, assessment responses and training-plan choices.
• Payment and subscription data: plan, price, currency, country or tax location, subscription status, renewal and cancellation information, transaction and invoice identifiers, refund or dispute information. Complete card details are normally collected directly by the payment provider and do not reach our servers.
• Communications: support requests, complaints, survey responses, security reports and correspondence.
• Marketing choices: subscription to optional product news, source of consent and unsubscribe record.

3.2 Data collected automatically

• Device and connection data: IP address, approximate country or region derived from IP, browser, device type, operating system, language, time zone and referral information.
• Security and authentication data: login time, session identifier, authentication events, active sessions, failed attempts, rate-limit events and suspected abuse signals.
• Usage and diagnostic data: pages and features used, buttons or paths, timestamps, performance, errors, crashes, response latency and other service telemetry.
• Cookie and local-storage data: session, security, preference, consent and analytics identifiers as explained in the Cookie Policy.

3.3 Data we derive

We derive educational analytics from practice and study activity, such as accuracy, completion, scores, weak areas, confidence levels, active days, progress trends, recommended topics and learning plans. We may also derive aggregated service statistics and de-identified performance information.

3.4 Data from third parties

We may receive:

• payment status and transaction metadata from a payment processor, merchant of record or app store;
• authentication and security information from identity or infrastructure providers;
• delivery, bounce and complaint information from email providers;
• an authorised-user invitation from an organisation, if enterprise features are later offered; and
• lawful reports about infringement, fraud, security or prohibited use.

We do not obtain live poker-client data, bankroll information or automated real-time hand feeds.

4. Data you should not submit

Do not submit information the Service does not need, including government identifiers, complete payment-card data, passwords for other services, precise location, health information, biometric data, political or religious views, private communications of third parties, or unredacted personal details of other poker players.

When submitting a completed hand history, remove or pseudonymise real names, usernames and other player identifiers where practical. You must have a lawful right to submit any information about another person.

5. Purposes, legal bases and retention

The table below describes our main processing. “Contract” includes steps requested before entering a contract. “Legitimate interests” means interests that we assess and balance against your rights. Where consent is required, it is separate and withdrawable.

Data and activity	Why we use it	EEA/UK legal basis, where applicable	Standard retention
Access requests and invitation screening	Review eligibility, respond and operate the private beta	Contract steps; legitimate interests in a controlled beta	12 months after the last contact if access is not granted; account record if granted
Account, authentication and preferences	Create and manage the account, sign in, remember language and settings	Contract	Account life plus 30 days; limited suppression/security records longer as below
Solver study, saved configurations and requested features	Provide the Service and preserve requested settings	Contract	Until deleted or account closure plus 30 days; backups up to 90 additional days
AI prompts, conversations and attachments	Respond, retrieve nodes, provide chat history and support	Contract	Conversation text and extracted content until the user deletes the conversation or account closure plus 30 days; an original uploaded file up to 30 days unless the interface clearly offers and the user selects longer storage; backups up to 90 additional days
Practice answers, assessments and activity	Score sessions, show progress, build the educational profile and recommend training	Contract	Account life plus 30 days; backups up to 90 additional days
Optional use of private content to improve systems for other users	Product research, model evaluation or training expressly described at opt-in	Consent	For the stated programme until withdrawal or the stated period; irreversible de-identification may end personal-data status
Aggregated/de-identified statistics	Measure and improve reliability, content and learning design	Legitimate interests; not data-protection law once genuinely anonymous	As long as needed, because the data is not reasonably linkable to a person
Subscription, transaction, refund and tax records	Fulfil purchase, manage access, prevent fraud, accounting and tax	Contract; legal obligation; legitimate interests	Normally at least 5 years after the relevant transaction or longer if law, audit or a dispute requires
Service communications and support	Send receipts, security notices and support responses	Contract; legitimate interests	Support records normally 24 months after closure; material legal records for limitation periods
Optional marketing	Send product news and measure permitted engagement	Consent, or legitimate interests where local law permits	Until unsubscribe or 24 months of inactivity; minimal suppression record retained to honour opt-out
Technical, security and abuse logs	Protect accounts, prevent RTA, scraping, fraud and attacks; diagnose incidents	Legitimate interests; legal obligation	Normally 12 months; longer for a documented incident, investigation or legal claim
Non-essential analytics or preference technology	Understand and improve use beyond necessary operations	Consent where required	As stated in the Cookie Policy and consent interface
Legal requests and disputes	Enforce rights, comply with law and resolve claims	Legal obligation; legitimate interests; legal claims	For the applicable legal or limitation period

We may keep data for a different period when required by law, a court order, fraud prevention, a legal claim or a written enterprise contract. We periodically review and securely delete or de-identify data that is no longer needed.

6. How we use personal data

We use personal data to:

• provide, personalise and maintain the Service;
• authenticate users and secure accounts;
• retrieve solver nodes, generate AI explanations and process requested attachments;
• score practice, calculate progress and recommend training;
• operate subscriptions, entitlements, invoices, refunds and customer support;
• communicate service, security, legal and transaction information;
• prevent prohibited RTA, account sharing, scraping, fraud, abuse and attacks;
• troubleshoot, monitor performance and improve reliability;
• conduct optional research or model improvement only under the choice described in Section 9;
• comply with law, sanctions and valid legal process; and
• establish, exercise or defend legal claims.

We do not use the Service to determine eligibility for employment, credit, housing, insurance, education, public benefits or another similarly significant opportunity.

7. Practice profiling and automated analysis

The Service automatically analyses study and practice activity to provide educational scores, weak-area summaries, confidence indicators, recommended scenarios, study plans and progress displays.

The main inputs are your answers, selected configurations, accuracy, completion, practice frequency and other activity within the Service. The general logic is to compare your activity with answer keys, solver data, learning objectives and recent performance, then prioritise topics where performance appears weaker or review is due.

The consequence is limited to what the Service displays or recommends. It does not produce a legal or similarly significant effect. You can ignore a recommendation, change practice settings and contact us if a profile appears incorrect. Where available, deleting practice history or the account removes the associated profile subject to backup and legal retention.

8. AI processing

8.1 You are interacting with AI

Fisher and features labelled “AI” are automated systems, not human coaches. They may retrieve and summarise solver information, analyse a described spot and generate text or other output. AI can make mistakes.

8.2 Inputs and providers

We may send the minimum prompt, relevant solver context and attachment content needed for the requested feature to an AI provider acting for us under contract. We require contractual and technical settings that prevent the provider from using API inputs and outputs to train its general models, except where a separate programme and your affirmative choice expressly permit otherwise.

Do not include sensitive or unnecessary third-party information in a prompt or attachment. More information is in the AI Features and User Content Policy and our Service Provider and Subprocessor List.

8.3 No default training on private content

We do not use the content of your private AI conversations, attachments, hand inputs or notes to train general-purpose AI models, build commercial training datasets, create public examples or improve systems for other users unless you make a separate, informed and affirmative choice.

The product-improvement choice must not be required to receive the core Service. You may withdraw it for future processing in Data Controls or by contacting us. We may still use statistics that have been assessed as genuinely anonymous; removing an email or replacing it with an identifier alone is not anonymisation.

9. Cookies and analytics

We use strictly necessary technologies for security, sessions and requested settings. We use non-essential analytics, performance or preference technologies only after consent where law requires it. We do not use third-party behavioural advertising cookies.

See the Cookie Policy for categories, current technology and choices. Rejecting non-essential cookies does not block the core Service.

10. When we disclose personal data

We do not sell personal data. We do not share it for cross-context behavioural advertising or targeted advertising.

We disclose only what is reasonably needed to:

10.1 Service providers and processors

Providers may process data under contract for:

• cloud hosting, database, storage, backups and content delivery;
• web application firewall, DDoS protection, access control and security;
• identity, authentication and email delivery;
• AI inference, model evaluation where authorised, and content processing;
• customer support, error monitoring and permitted analytics;
• payment, merchant-of-record, invoicing, tax and fraud services; and
• business operations such as document management and professional advice.

Our current public list is at /legal/subprocessors. A provider may act as an independent controller for its own legal, fraud, tax or payment obligations.

10.2 Professional advisers

We may disclose information to lawyers, auditors, accountants, insurers and corporate advisers under professional or contractual duties of confidentiality.

10.3 Legal, safety and integrity reasons

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect a person, the Service or our rights; investigate fraud, attacks or prohibited RTA; or enforce our agreements. We review requests and disclose only what we reasonably believe is required.

We do not routinely send a poker operator identifiable user study history. If we ever introduce a fair-play verification programme that can disclose or confirm account-specific activity to an operator, we will first provide a separate, prominent notice explaining the recipients, data, legal basis and consequences.

10.4 Corporate transactions

Data may be reviewed or transferred as part of a financing, reorganisation, merger, acquisition, sale of assets or insolvency, subject to confidentiality and applicable law. We will notify users if a transaction changes the controller or materially changes how data is used.

10.5 At your direction

We disclose data when you ask us to, authorise an integration or choose to make information public. The current Service does not make private AI chats or practice profiles public by default.

11. International data transfers

We are established in Singapore. Providers and authorised personnel may process data outside your country. Actual processing countries, including remote support and administration locations, are identified in our Service Provider and Subprocessor List. Those countries may have different data-protection laws.

Where required, we use appropriate safeguards, such as:

• contracts requiring a standard of protection comparable to the Singapore PDPA;
• the European Commission’s Standard Contractual Clauses and supplementary measures for restricted EEA transfers;
• the UK International Data Transfer Addendum or another lawful UK transfer mechanism;
• an adequacy decision; or
• another legally recognised exception or mechanism.

You may request information about the relevant safeguard at support@gtofisher.com. We may redact confidential commercial and security information from a copy.

Where an EEA, UK or other local representative is required, the appointed representative’s name, territory and direct contact details are provided in the Legal Notice and the regional contact information shown with this Policy. Our Singapore privacy contact remains available in addition to that representative.

12. Security

We use reasonable technical and organisational measures designed for the nature and risk of the data, which may include encryption in transit, password hashing, access controls, least privilege, session management, logging, rate limits, backups, vulnerability management and incident procedures.

No service is completely secure. You are responsible for protecting your credentials and devices. Notify us promptly at support@gtofisher.com if you believe an account or the Service has been compromised. Security researchers should follow our Security and Vulnerability Disclosure Policy.

13. Data breach notification

We investigate suspected personal-data breaches, take reasonable containment and remediation steps, keep required records and notify regulators or affected individuals when applicable law requires it. Timing and content depend on the jurisdiction, nature, scale and likely harm of the incident.

14. Your choices and rights

14.1 Account and product controls

Depending on feature availability, you may:

• update your name, password, language and appearance;
• review or revoke active sessions;
• delete individual AI conversations or saved content;
• change optional product-improvement consent in Data Controls;
• unsubscribe from marketing;
• cancel a Subscription; and
• request access, correction, export, restriction or deletion by email.

14.2 Singapore

Under the Singapore PDPA, you may request access to personal data we hold about you and information about certain uses or disclosures, request correction, and withdraw consent with reasonable notice. Withdrawal does not affect earlier lawful processing and may prevent us from providing a feature that requires the data. You may complain to our DPO contact and, where appropriate, the Personal Data Protection Commission Singapore.

14.3 EEA, United Kingdom and similar laws

Where applicable, you may have rights to:

• be informed and obtain access;
• correct inaccurate data;
• erase data;
• restrict processing;
• receive data you provided in a portable format;
• object to processing based on legitimate interests and to direct marketing;
• withdraw consent without affecting earlier processing; and
• obtain human review of a solely automated decision that produces legal or similarly significant effects.

You may lodge a complaint with the data-protection authority where you live, work or believe an infringement occurred. We encourage you to contact us first so we can address the issue.

14.4 California and other US state privacy laws

If an applicable US state privacy law covers us and you, you may have rights to know or access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising or qualifying profiling, and appeal a refusal. You have a right not to receive unlawful discrimination for exercising a privacy right.

We do not sell personal information, share it for cross-context behavioural advertising or use it for targeted advertising. We do not use sensitive personal information to infer characteristics about you. We recognise applicable Global Privacy Control signals now and apply the preference to the browser or device and, when recognised, the account. Because we prohibit these advertising uses, the signal preserves that restriction; it does not withdraw all processing or delete an account. We do not require login or identity documents to record an applicable opt-out signal.

Even if a particular statutory threshold does not apply to us, we aim to consider reasonable access, correction and deletion requests consistently, subject to verification, technical feasibility and lawful exceptions.

14.5 Additional regional rights

These provisions apply where the relevant law covers the processing; mentioning a country does not mean the Service is available there.

Brazil. You may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability subject to applicable rules, information about recipients and consent, withdrawal of consent, and review of qualifying decisions made solely by automated processing. A simplified confirmation or access response can be provided immediately; a complete access statement is normally provided within 15 days where LGPD Article 19 applies. Contract, legal obligations and other lawful grounds may require limited retention. You may contact our privacy contact or the ANPD.

Canada, including Québec. We explain collection, use and disclosure and obtain the consent required for the activity. You may request access, correction and withdrawal of consent subject to reasonable notice and lawful limits. Where Québec law applies, you may request eligible computerised information in a structured, commonly used format. We notify you when a decision concerning you relies exclusively on automated processing and explain the personal information and principal factors on request, with an opportunity to submit observations to a person able to review the decision. Privacy questions may be raised with our contact, the OPC or the competent provincial regulator. International processing may make information accessible under foreign law.

Australia. Where the Privacy Act applies, you may request access and correction and complain to our privacy contact. We acknowledge complaints and aim to resolve them within 30 days. If unresolved, you may complain to the OAIC. Our provider list identifies overseas recipient countries where practicable; exceptions to access or correction are explained when required.

Japan. Where APPI applies, you may request notification of purposes of use, disclosure of retained personal data and eligible third-party disclosure records, correction, or cessation/deletion and cessation of third-party provision where the statutory conditions are met. For transfers requiring informed foreign-transfer consent, we provide the recipient country, relevant protections and other required information before the transfer, or use another lawful mechanism with the required continuing measures. Contact us or the Personal Information Protection Commission Japan.

Republic of Korea. Where PIPA applies, you may request access, correction, deletion, suspension of processing, and rights concerning qualifying automated decisions. We provide separate notices and choices where required for optional, sensitive, third-party or overseas processing. A mandatory overseas-transfer notice identifies the recipient and contact, country, data, timing and method, purpose and retention, legal basis and available refusal method and consequences. Information that law requires to be retained is separated from routine use. You may complain to the Personal Information Protection Commission Korea or another competent dispute body.

Other regions. We consider requests under all laws applicable to the actual processing, including laws of an approved market or processing location. We do not require a person to waive a local privacy right to use this form.

14.6 Exercising a right

Email support@gtofisher.com with the subject “Privacy Request” and state:

• the account email;
• your country or state;
• the right or action requested; and
• enough information to identify the relevant data.

We will verify the request proportionately. Do not send a passport or government ID unless we specifically explain why it is necessary and provide a secure method. An authorised agent may act where law permits, subject to proof of authority and identity verification.

We will respond within the applicable time—normally within one month under the GDPR and within the period required by other laws. If we deny or limit a request, we will explain the reason and available appeal or complaint route where required.

Rights are subject to exceptions, including security, another person’s rights, legal obligations, fraud prevention and legal claims.

15. Notice at collection for California residents

This Section summarises the categories of personal information we may collect and is intended to be read at or before collection together with Sections 3–5.

California category	Examples in the Service	Purpose	Retention approach
Identifiers	Email, account ID, IP address, session ID	Account, security, support, access	As stated in Section 5
Customer-record information	Name, transaction and subscription information	Contract, billing, records	As stated in Section 5
Commercial information	Plan, purchases, renewals, refunds	Entitlements, accounting, support	Normally at least 5 years for transaction records
Internet or electronic-network activity	Feature use, logs, device and diagnostics	Provide, secure and improve the Service	Normally 12 months for identifiable logs
Geolocation	Approximate country or region from IP; not precise location	Security, regional availability and tax routing	Normally tied to logs or transaction records
Audio, electronic or visual information	Attachments you choose to upload; no routine microphone collection	Provide requested AI or support feature	Until deletion/account closure plus backup period
Professional information	Information you voluntarily include in an access or support request	Review and respond	Access-request or support retention period
Inferences	Practice score, weak areas, preferences and recommendations	Personalised educational training	Account life plus deletion period
Sensitive personal information	Account credentials; payment account data handled mainly by payment provider	Authentication and payment	Only as necessary; we do not use it to infer characteristics

We collect these categories from you, your device, providers and our derivation of educational metrics. We disclose them to the provider categories in Section 10 for business purposes. We do not sell or share them for cross-context behavioural advertising.

These disclosures apply from the effective date. Information about actual prior-period processing is available on request; any material historical difference is disclosed in the applicable notice and is not retrospectively authorised by this Policy. We do not knowingly sell or share the personal information of persons under 16. Private content may contain sensitive information if you provide it despite our instructions; we limit processing to the permitted purpose and do not use it to infer protected characteristics.

16. Children

The Service is for adults who are at least 18 and the applicable age of majority. We do not knowingly collect personal data from a person who does not meet this requirement. If you believe a minor has provided data, contact support@gtofisher.com. We will investigate and delete or restrict the data as required.

17. Mainland China

This section applies where Mainland China personal-information law governs our processing, including applicable services provided to people in Mainland China. Mainland China residence does not itself exclude eligible adults from the Service. The absence of active marketing does not remove applicable privacy rights.

Our identity and contact details appear in Sections 1 and 20. The categories, purposes, methods and retention periods described in this Policy also apply to the relevant processing here. We rely on a basis permitted by applicable Mainland China law, such as processing necessary to enter into or perform your contract, a legal obligation, or valid consent. References elsewhere to GDPR legitimate interests do not create a separate Mainland China legal basis. Optional marketing, optional analytics and private-content improvement remain separate choices and are not conditions of core access.

Where consent is required, we seek an informed, voluntary and affirmative choice; where the law requires separate or written consent, we obtain that form. You may withdraw consent through the relevant setting or support@gtofisher.com. Withdrawal does not invalidate earlier lawful processing. We do not refuse unrelated services because you decline optional processing. If a necessary operation cannot lawfully proceed, we explain which requested feature is affected.

Our operator is in Singapore. Relevant information may be processed outside Mainland China. Our Service Provider List and any notice shown before the relevant transfer identify actual recipients, locations, contacts, data, purposes and ways to exercise rights. Where applicable, we complete the required transfer assessment or mechanism and obtain separate consent. An exemption from a transfer filing does not by itself remove notice, security or other applicable obligations. We do not treat acceptance of all Terms as blanket transfer consent.

You may request information and explanations, access or a copy, correction or supplementation, restriction or refusal of processing, deletion, withdrawal of consent, account closure and a transfer to another processor where legal conditions are met. You may seek an explanation of an automated decision significantly affecting your rights and refuse decisions made solely by automated means where the law provides that right. We use educational profiles to support study; optional recommendations can be disabled. Submit requests through the Privacy Request Form or support@gtofisher.com. We use proportionate verification, respond within applicable periods, and explain a refusal and available review or complaint routes. This does not restrict access to a competent regulator or court.

We do not request sensitive personal information for ordinary study. Do not upload other people's identifying hand histories or sensitive material. Where a lawful feature requires sensitive information, we explain its necessity and impact and apply the legally required safeguards and consent before processing. The Service is for adults; we do not offer a parental-consent route for minors.

Where required, our designated Mainland China institution or representative and contact details are listed in the Legal Notice. The contact in Section 20 remains available for requests. The protections in this section also apply to relevant processing by personnel or suppliers in Mainland China; they are not waived by choosing Singapore law for a contract.

18. Marketing and do-not-contact choices

We do not add an access requester to marketing merely because they requested beta access. Marketing sign-up is separate. Marketing emails identify the sender and include an unsubscribe method. We keep a minimal suppression record after unsubscribe so we do not re-add the address inadvertently.

Service messages about security, transactions, policy changes or requested support are not marketing and may continue while the account exists.

19. Changes to this Policy

We may update this Policy to reflect legal, technical or product changes. We will post the updated version and date. If a change materially expands how we use personal data, we will provide appropriate notice and obtain consent where required. We do not treat silence as consent when law requires an affirmative choice.

20. Contact and complaints

Email: support@gtofisher.com
Subject: Privacy Request or Privacy Complaint

Postal address:

ASTRA LOGIC TECHNOLOGY PTE. LTD.
Data Protection Contact
36 Robinson Road, #21-01
City House
Singapore 068877