Shape 1 — Personal Sentiment Journal: Compliance Research

Status: Research only. This document does NOT constitute legal or tax advice. Before shipping any Shape 1 feature or relying on this analysis, consult a securities attorney (Investment Advisers Act background) and a privacy attorney (CCPA / CPRA background), each licensed in applicable jurisdictions. Last updated: 2026-06-05. Sources as of that date — verify freshness before filing.

TL;DR

Shape 1 — where a user labels their own emotional state before and after trades, and Raxx surfaces only that user's own historical results filtered by those labels — sits in the lowest-exposure position of the three shapes because the platform is not providing advice, is not aggregating across users, and is not scoring or ranking. The Investment Advisers Act ABCs test is almost certainly not triggered when no recommendation is made and the user's own data is echoed back. However, three design choices can silently erode that position: pre-selecting or auto-suggesting a label, auto-tagging from P/L or time-in-position signals, or placing user-own-data backtest results on a public marketing page. The emotion label data is likely "inferences" under CCPA and requires a privacy-policy update, a brief in-flow notice, and a retention/ deletion pathway before shipping.

Part 1 — Claim Verdicts

Claim 1: "Shape 1 has the lowest legal exposure of the three shapes."

Verdict: CONDITIONALLY TRUE — with design guardrails in place.

The condition is that the architectural principle in Claim 3 holds: user always asserts first, Raxx never auto-classifies. If that principle is maintained, the analysis below supports the lowest-exposure position. If it erodes, exposure climbs toward Shapes 2 and 3.

1A. SEC Advisers Act §202(a)(11) — "investment adviser" definition

Primary source: Investment Advisers Act of 1940, §202(a)(11), 15 U.S.C. §80b-2(a)(11); SEC Release IA-1092 (1987) (establishing the three-prong ABCs test).

The ABCs test requires all three prongs to be present for registration to be required:

• A — Advice: Provides advice, or issues reports or analyses, concerning securities.
• B — Business: Is in the business of providing such advice.
• C — Compensation: Receives compensation for such advice.

Shape 1 analysis — Prong A (Advice):

Shape 1 has the user tell Raxx how they felt. Raxx then retrieves the user's own historical trade outcomes filtered by that label. This is retrospective data retrieval, not advice. The platform is not recommending a security, a strategy, a position size, or a timing decision. It is mirroring the user's own labeled history back to them.

The SEC's ABCs test requires advice "concerning securities" — meaning the platform must be advising on whether to buy, sell, hold, or otherwise transact in a security. Showing a user that their iron condors closed profitably on the 14 occasions they marked "Disciplined" is not a recommendation concerning any security; it is a historical filter of self-reported data.

The closest analog in SEC no-action guidance is the line of letters distinguishing passive information tools from advisory activity. SEC Release IA-1092 (1987) notes that a person who provides general financial information not tailored to individual circumstances is not providing "advice" in the regulatory sense. Courts confirmed in Lowe v. SEC, 472 U.S. 181 (1985) that non-personalized, non-interactive financial publishing does not constitute advisory activity. Shape 1, applied to the user's own data, is functionally less advisory than the Lowe-protected publisher — it is not even commentary; it is data retrieval.

Prong B (Business): Even if Prong A were somehow satisfied, Prong B requires the advice to be a primary purpose of the business, not an incidental feature. Raxx's primary purpose is strategy automation and execution management. Sentiment labeling is a metadata layer on the user's own trades. Incidental provision of information does not satisfy Prong B. See SEC IA-1092 ("merely incidental" test for broker-dealer exception by analogy).

Prong C (Compensation): Raxx charges a subscription for the platform. The subscription is not specifically for advice — it is for the platform as a whole. If Prongs A and B are not satisfied, Prong C is moot. If A and B were somehow satisfied, C would be satisfied by the subscription, which is why keeping A and B clean is the whole game.

Conclusion on §202(a)(11): Shape 1 as designed does not satisfy Prong A and therefore does not trigger the investment adviser definition. This is consistent with the "inanimate tool" framing in prior attorney discussions (questions I1 and P6 in docs/business/questions-for-attorney.md). Confirm with a formal written attorney opinion before launch — see Q1 in the attorney intake section below.

1B. SEC S7-18-22 — Digital Engagement Practices / Predictive Data Analytics

Primary source: Proposed Rule, "Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers," File No. S7-18-22; see also SEC Rulemaking Activity page, https://www.sec.gov/rules-regulations/rulemaking-activity.

Status as of 2026-06-05: The S7-18-22 Predictive Data Analytics (PDA) Proposal was withdrawn June 12, 2025, as part of the incoming SEC administration's rollback of several Gensler-era proposed rules. It was never finalized.

Shape 1 analysis: Because the rule was withdrawn, it creates no current obligation. However, the underlying concern it addressed — that platforms using AI or algorithmic tools to nudge user behavior toward outcomes that benefit the platform — remains a live anti-fraud theory under existing Advisers Act §206 and Exchange Act §10(b).

Shape 1 as designed does not create this concern: the platform shows the user their own labeled history without nudging them toward any particular trade, product, or behavior. No conflict of interest arises from mirroring back the user's own data.

Watch: If Raxx ever uses sentiment data to surface "users who marked Disciplined more often had higher returns — would you like a suggested label?" — that crosses from neutral data retrieval into potential nudging, which could trigger §206 anti-fraud scrutiny even without a finalized PDA rule. Keep Shape 1's label-suggestion pathway clean (see Claim 3 below).

1C. FINRA Rule 2210 (Communications with the Public) and Rule 2360 (Options)

Primary sources: - FINRA Rule 2210: https://www.finra.org/rules-guidance/rulebooks/finra-rules/2210 - FINRA Rule 2360: https://www.finra.org/rules-guidance/rulebooks/finra-rules/2360 - FINRA Communications Reference Guide (Sept. 2020): https://www.finra.org/sites/default/files/2020-09/communications-public-rules-reference-guide.pdf

FINRA Rule 2210 analysis:

FINRA Rule 2210 applies to FINRA member firms — broker-dealers and their associated persons. Raxx is not a FINRA member. Rule 2210 does not apply to Raxx directly.

The rule does govern communications by FINRA members — so if a Raxx user is a registered representative at a broker-dealer and uses Raxx in connection with their member firm's business, the member firm may have supervisory obligations over that use. That is the member firm's problem, not Raxx's, provided Raxx's own communications are accurate and non-misleading.

FINRA Rule 2360 analysis:

Rule 2360 covers options account conduct by FINRA members. Same analysis: Raxx is not a FINRA member. Rule 2360 does not apply to Raxx directly.

The indirect question — is Raxx's sentiment backtest filter a "communication"?

Even if Raxx were a FINRA member (it is not), an in-app display of a user's own historical results filtered by their own labels would be an internal communication (member-to-its-own-system), not a communication "with the public." FINRA 2210(a)(3) excludes internal communications from most rule requirements. There is no third-party communication here.

Conclusion: FINRA 2210 and 2360 do not apply to Shape 1 as a direct compliance obligation. The correct framing for the attorney is: "Raxx is not a FINRA member; does any Raxx feature create broker-dealer nexus?" — not "does 2210 apply to this screen?" See Q-SHAPE1-4 in the attorney questions below.

1D. Regulation Best Interest (Reg BI)

Primary source: Exchange Act Rule 15l-1, 17 C.F.R. §240.15l-1; SEC Final Rule, "Regulation Best Interest: The Broker-Dealer Standard of Conduct," Release No. 34-86031 (June 5, 2019).

Analysis: Reg BI applies to broker-dealers and their associated persons when making recommendations to retail customers. Raxx is not a broker-dealer. Reg BI does not apply to Raxx.

Confirmed N/A. No further analysis required for Shape 1. The relevant question for the attorney engagement is the §202(a)(11) Advisers Act analysis (Prong A above), not Reg BI.

1E. State UDAP / FTC Section 5

Primary sources: - FTC Act §5, 15 U.S.C. §45 - Pennsylvania UTPCPL, 73 P.S. §§201-1 to 201-9.3 (as strengthened by Gregg v. Ameriprise Financial Services, Inc., 664 Pa. 69 (2021) — strict liability for deceptive conduct, no reliance element required)

Shape 1 UDAP / FTC analysis:

UDAP / FTC §5 exposure arises when a business makes a deceptive or unfair claim to consumers. For Shape 1, the potential framing risk is:

• Framing 1 — "Trading psychology" or "emotional discipline" narrative. If Raxx markets Shape 1 as a tool that "helps you trade better" or "identifies emotional patterns that hurt returns," that is a causal performance claim. FTC substantiation standard requires competent and reliable evidence for such claims. Raxx does not have longitudinal data across users to substantiate this claim.

• Framing 2 — Neutral self-reflection framing. If Shape 1 is presented as a journaling and self-review tool — "log how you felt, see how your trades went when you felt that way" — there is no performance claim, and UDAP exposure is minimal. The distinction is between "this makes you a better trader" (requires substantiation) and "this shows you your own history" (factually accurate, no claim to substantiate).

Required: Neutral framing. All UI copy, marketing copy, and in-app language for Shape 1 must describe it as a self-reflection tool, not a performance-improvement tool. See Disclaimer Set in Part 4 below. The Pennsylvania UTPCPL strict-liability standard (Gregg) means that a deceptive framing creates liability even without intent — so the framing discipline is not optional.

1F. CCPA / State Privacy Laws — Emotion Label Storage

Addressed fully in Part 5 below.

Claim 2: "Backtest results must be auth-gated, never on marketing pages."

Verdict: TRUE for general hypothetical-performance displays; NUANCED for user-own-data filtered results — but the safe position is auth-gate all backtest output.

Background: The September 2023 SEC Enforcement Sweep

Primary sources: - SEC Press Release, "SEC Charges Nine Investment Advisers for Advertising Hypothetical Performance Without Proper Policies" (Sept. 11, 2023): https://www.sec.gov/news/press-release/2023-163 - SEC Marketing Rule, Rule 206(4)-1(d), 17 C.F.R. §275.206(4)-1(d) - BCLP analysis: https://www.bclplaw.com/en-US/events-insights-news/sec-enforcement-sweep-regarding-hypothetical-performance.html - Mayer Brown analysis (Apr. 2024): https://www.mayerbrown.com/en/insights/publications/2024/04/sec-charges-five-registered-investment-advisers-for-marketing-rule-violations

The September 2023 enforcement sweep charged nine registered investment advisers for advertising hypothetical performance (including backtested results) on their public websites without: (a) policies and procedures ensuring the content was relevant to the likely financial situation of the intended audience, and (b) sufficient information for the audience to understand assumptions and risks. The violations were procedural — the data was not alleged to be inaccurate.

The SEC explicitly stated that hypothetical performance "should not appear on websites accessible to the general public" because the general public is not an appropriate intended audience for such materials.

The Direct Rule Application Question

Does Rule 206(4)-1 apply to Raxx?

Rule 206(4)-1 applies to registered investment advisers. As established in Part 1A, Raxx is not a registered investment adviser and, as designed, should not be one. This means the Marketing Rule does not directly bind Raxx.

However, two indirect constraints apply:

1. Anti-fraud provisions (Advisers Act §206 and FTC §5): Even without direct Marketing Rule application, placing misleading performance statistics — whether hypothetical or user-own-data — on a public page can constitute deceptive advertising under FTC §5. The spirit of the Marketing Rule's public-audience concern applies via FTC general deceptive-advertising standards.

2. The "intended audience" principle applies regardless of registration status. The enforcement actions' core rationale — that the general public cannot assess backtested performance appropriately — is a consumer-protection concern that FTC §5 reaches independently of SEC registration. A fintech platform showing backtested results on a public marketing page, labeled as illustrative, still risks FTC §5 challenge if a reasonable consumer would interpret the display as a performance claim.

User-Own-Data vs. General Hypothetical — Is There a Distinction?

The question: Is a screenshot showing "your trades where you marked Disciplined: +34% avg" on a marketing page different from "this is what an iron condor would have made"?

The research-supported answer: Substantively different, but practically the same from a marketing-page-risk standpoint.

The user-own-data result is more accurate (it is not hypothetical — it reflects actual trades the user actually made). However, on a public marketing page:

• The visitor has not yet authorized Raxx to their account. They have no account. The "your results" framing is illustrative, not actual for them.
• Any number shown ("+34%") will be read as a performance claim by the reasonable consumer visiting the marketing page, regardless of the label "user example."
• FTC §5 substantiation analysis asks whether the reasonable consumer would interpret the display as a performance claim. The answer is yes.

The practical rule: Do not place any backtest output — user-own-data or otherwise — on a public marketing page. If Shape 1 success stories are used in marketing, they must carry the full FTC testimonial framework (16 C.F.R. Part 255, 2023 revised Endorsement Guides), including disclosure that results are not typical and disclosure of any material connection.

Auth-gating is the correct default. A user who is authenticated has established their own profile context. Showing them a filter of their own labeled trades within the Raxx platform is not a marketing communication — it is product functionality. The auth-gate is what separates "product" from "advertisement."

Conclusion: Claim 2 is TRUE. Auth-gate all backtest output. The user-own-data distinction provides some theoretical space but does not make public-page placement safe under FTC §5 analysis.

Claim 3: "User always asserts first, Raxx never auto-classifies."

Verdict: TRUE — this constraint is load-bearing for the lowest-exposure position.

This architectural constraint is what keeps Shape 1 in the "data mirror" category rather than the "advisory / inference" category. The legal exposure consequence of each design erosion scenario follows.

Design Choice Analysis

Scenario A: Suggested label prompt that pre-selects based on prior history

If Raxx displays "Based on your past 23 trades in similar conditions, you usually feel Confident — is that right?" and pre-selects "Confident" in the label UI:

• The user is no longer asserting freely. Raxx is making an inference about the user's current psychological state based on their behavioral history.
• This inference is "inferences drawn from personal information to create a profile about the consumer's psychological trends" under CCPA §1798.140(ae) — which adds Sensitive Personal Information handling obligations.
• More significantly, the pre-selection provides a nudge toward a particular label, which is functionally a prediction about the user's emotional state. If the prediction is wrong and the user accepts the default, Raxx's label will misclassify actual trade outcomes — creating a data-quality problem and potentially a misleading analytics problem downstream.
• From an Advisers Act standpoint, if the system is using prior performance data to influence the user's state-of-mind label (which then influences how outcomes are analyzed and potentially fed back as "Disciplined trades perform better"), this begins to look like a feedback loop designed to influence trading behavior — which is exactly what S7-18-22 was targeting before withdrawal. Even without the PDA rule, the §206 anti-fraud provision reaches misleading or manipulative advisory conduct.

Erosion risk level: HIGH. Do not implement pre-selecting suggestions.

Scenario B: Default label that pre-fills "Confident" because most users picked that

Softer version of Scenario A. If "Confident" pre-fills because it is the most common prior choice, the user still has to actively change it — but the friction of changing the default biases label distribution.

• CCPA inference concern: If the default is derived from aggregated user data (most users pick Confident), and this is applied to the individual user, Raxx is making an inference about this user's likely state from other users' data. This is not user- asserted data; it is platform-inferred data.
• The design principle that protects Shape 1 is that the user's label reflects the user's actual state, not the platform's expectation. A biased default undermines the analytical integrity of the feature and the regulatory cleanliness.

Erosion risk level: MEDIUM. Avoid population-mean defaults. A blank field or "Select your state" placeholder preserves the clean assertion principle.

Scenario C: Auto-tagging based on time-in-position or P/L sign

If Raxx automatically applies "Panicked" to any trade closed in under 2 minutes, or "Disciplined" to any trade that hit the target profit, the platform is:

• Creating inferences about the user's psychological state from behavioral signals.
• Storing and surfacing those inferences as if they were the user's own self-report.
• This is the most significant erosion. The label is no longer the user's; it is the platform's inference.

From a CCPA standpoint, this is clearly "inferences drawn from personal information to create a profile about the consumer's psychological trends" — Sensitive Personal Information requiring opt-in or right-to-limit-use disclosures.

From an Advisers Act standpoint, a system that automatically classifies a user's trades as "Disciplined" or "Panicked" and then surfaces that classification as a basis for analyzing their performance is beginning to function as a behavioral advisory tool, not a neutral data mirror.

Erosion risk level: CRITICAL. Auto-tagging from behavioral signals converts Shape 1 from a user-assertion tool to a platform-inference tool. This fundamentally changes the regulatory exposure profile.

Part 2 — Required Disclaimer Set

The following disclaimer language is research-based. The exact text requires review by a securities attorney and a privacy attorney before shipping.

Pre-Trade Label UI

Placement: Immediately adjacent to or below the label selection control (not buried in a modal or help text).

Required elements: - Clarify this is the user's own self-assessment - Clarify no causal claim is made between the label and trade outcome - No disclaimer about investment advice is required here because no advice is being given — but the absence of implied advice framing in the UI itself is critical

Suggested language (attorney must review):

"Your label. This is your self-assessment — Raxx does not suggest, score, or interpret your emotional state. Labels are for your personal review only."

Note: If the UI includes any descriptive language for the labels (e.g., "Panicked: you felt pressure to exit before your plan"), that language must not imply that Raxx is diagnosing behavior. Keep label definitions neutral or user-defined.

Post-Trade Outcome Label Prompt

Placement: Same as pre-trade — adjacent to the control.

Additional element: If the post-trade label is presented alongside actual P/L or outcome data, the juxtaposition itself creates a framing risk. The UI should not present the label prompt immediately next to a gain or loss number in a way that implies "this outcome is explained by your emotion."

Suggested language (attorney must review):

"Your reflection. This is your assessment of your own decision-making process — not Raxx's evaluation of your trade. Labels are for your personal review and are not used to score, rank, or recommend."

Backtest-Filter Results Page

This page is the highest-risk surface for disclaimers.

Placement: Top of the results page, above the filter result display — not as a modal that can be dismissed, and not at the bottom of the page.

Required elements:

1. Results shown are the user's own historical trade outcomes filtered by their own self-reported labels. Raxx did not generate, predict, or model these results.
2. Past performance within the user's own history does not predict future performance.
3. The label taxonomy reflects self-reported psychological state, not objective trade quality assessment.
4. Results are not investment advice and should not be used as the basis for future trading decisions without independent analysis.
5. This display is private and personal to this account — not a comparative benchmark against other traders (until Shape 2, if ever built).

Suggested header language (attorney must review):

"Your historical results, filtered by your labels. This display shows how your own trades performed when you reported feeling [label]. Raxx did not classify, score, or interpret these trades. Past outcomes — even in your own history — do not predict future performance. This is not investment advice. Do not use this display as the sole basis for a trading decision."

Cross-reference: This framing is consistent with the backtest-results redlines in the earlier Public.com review and the getraxx-differentiation copy review. The key word is "your own" — every sentence must make clear this reflects the user's actual history, not a hypothetical or modeled scenario.

Privacy Disclosure for Emotion-Label Storage

This requires MORE than a privacy-policy update alone. It requires an in-flow notice.

Rationale: Under CCPA/CPRA, if Raxx is collecting "sensitive personal information" (discussed in Part 5), users must be informed at or before the point of collection, not just in the policy. Even under non-CCPA-mandatory posture (pre-100K-user threshold), the FTC Section 5 "notice and choice" principle applies — users must know what they're agreeing to.

In-flow notice — first time a user sees the emotion-label prompt:

This is a one-time consent notice, not a blocking modal on every use. It should appear the first time the user encounters the pre-trade label UI and require a positive acknowledgment.

Required elements: - What data is collected (the label: Bullish / Bearish / Neutral / Disciplined / Panicked / etc.) - How it is stored (linked to the specific trade record in the user's account) - Who can see it (only the user — not shared with Raxx employees, not aggregated for other users in Shape 1) - How long it is retained (align with overall trading-data retention from privacy policy Section 7: active + 90 days post-cancellation, subject to DSR deletion right) - How to delete (privacy@raxx.app DSR pathway) - Whether it is used to infer anything (if user-asserted only: "No — your labels reflect what you report and are not analyzed for patterns by Raxx")

Suggested in-flow notice (attorney must review):

"Before you log your first label: Your sentiment labels are stored privately in your Raxx account, linked to your individual trades. Raxx does not use your labels to score you, compare you to other users, or make recommendations. You can delete all label data from your account at any time by contacting privacy@raxx.app. By continuing, you confirm you understand how this data is stored and used."

Part 3 — Privacy Law Mapping (Detailed)

3A. CCPA / CPRA — Is Emotion-Label Data Sensitive Personal Information?

Primary sources: - California Civil Code §1798.140(ae) (CPRA definition of Sensitive Personal Information): https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140. - California AG Opinion on "Inferences" Under CCPA (March 2022): https://www.dwt.com/blogs/privacy--security-law-blog/2022/03/california-ccpa-inferences-disclosures - IAPP analysis of CPRA sensitive-PI categories: https://iapp.org/news/a/brain-power-piecing-together-ccpa-s-opt-in-out-requirements-for-sensitive-personal-information

The CCPA sensitive PI categories (§1798.140(ae)) most relevant to Shape 1:

The statute explicitly lists as Sensitive PI: - "Personal information collected and analyzed concerning a consumer's health" - "Inferences drawn from personal information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes"

Two-pathway analysis for emotion labels:

Pathway 1 — User-asserted labels (user marks "Disciplined" on their own trade): This is user-supplied data, not platform-inferred data. The label reflects what the user said, not what Raxx concluded. The California AG's March 2022 opinion on "inferences" drew a distinction between data the consumer provided and data inferred about the consumer. User-asserted labels are closer to the "provided" category.

However: the stored label, when associated with trade outcomes and analyzed in a filter, becomes a profile element about the user's psychological trading patterns. The AG opinion does not definitively resolve whether user-asserted-but-aggregated data becomes an "inference" when used in profiling. This is an open question. Treat it conservatively: disclose as potentially Sensitive PI.

Pathway 2 — Platform-inferred labels (any of the Scenario C auto-tagging cases): These are inferences. They are clearly Sensitive PI under §1798.140(ae). Do not implement Pathway 2 without a full CPRA Sensitive PI compliance stack (right-to-limit- use notice, opt-out mechanism, revised data-inventory, DPA updates with vendors who process this data).

Conservative position for Shape 1: Treat user-asserted emotion labels as falling within or adjacent to the "inferences / psychological trends" Sensitive PI category, even in the user-assertion pathway, because:

1. The ambiguity in the AG opinion has not been resolved by subsequent regulation or court decision (as of 2026-06-05).
2. The cost of treating it as regular PI when it is Sensitive PI is higher than the cost of treating it as Sensitive PI when it might be regular PI.
3. CCPA mandatory-threshold analysis: As documented in docs/legal/artifacts/ cpra-threshold-self-determination.md and the current PrivacyPolicy.jsx (§10), Raxx does not currently meet CCPA thresholds. This does not eliminate the FTC §5 notice-and-choice principle, and does not protect against future threshold-crossing without a retroactive consent mechanism.

Obligations under Sensitive PI treatment: - Disclosure at or before point of collection (in-flow notice — see Part 2) - Right-to-limit-use: users can direct Raxx to use the data only for the purpose of providing the feature (not for any other analysis or purpose) - Retention policy consistent with overall platform retention - DSR deletion pathway that includes label data

3B. Quebec Bill 25 / PIPEDA

Primary source: Act Respecting the Protection of Personal Information in the Private Sector, RSQ c P-39.1 (as amended by Law 25 / Bill 64).

Raxx geo-blocks Quebec signups. This eliminates the Bill 25 obligation for new users. However: if a user signed up before the geo-block was active (pre-2026-05-23 per memory project_quebec_geoblock_decision.md), Bill 25 may apply to their data.

For Shape 1 specifically: If any pre-block Quebec users exist in the database, emotion labels collected from them would constitute personal information under Bill 25 with the full consent, access, and deletion rights of that statute. Confirm with counsel whether any such users exist and require individual notification.

3C. EU GDPR — Art. 17 Right to Erasure; User Relocation Scenario

Primary source: GDPR Art. 17 ("Right to erasure (right to be forgotten)"): https://gdpr-info.eu/art-17-gdpr/; see also Data Protection Commission Ireland guidance: https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr

The scenario: A US user enrolled in Raxx (before EU geo-block was active), has emotion labels stored, then relocates to the EU. Does Art. 17 apply?

Research finding: GDPR applies based on the location of the data subject, not the data controller. Once a user is in the EU, they acquire GDPR data subject rights — including Art. 17 right to erasure — even if Raxx remains a US-domiciled controller.

Practical implication for Shape 1: The deletion pathway must include emotion labels. The current PrivacyPolicy.jsx Section 8 (Your Rights — How to Submit a Request) includes a deletion right. The in-flow notice in Part 2 should cross-reference this right explicitly.

Important: Raxx geo-blocks EU signups (memory project_eu_geoblock_decision.md). A user who signed up in the US and then moves to the EU is a different scenario from a current EU resident signing up — Raxx's geo-block does not prevent the former. The DSR (Data Subject Request) operating procedure (#1686) should explicitly include "retroactive EU resident" as a request category and include label data in the deletion scope.

Note: Raxx's current position is that EU signups are blocked and therefore GDPR Article 27 (EU representative) is not required. That analysis holds for new users but is complicated by relocating users. Flag for the privacy attorney.

3D. PrivacyPolicy.jsx — Required Updates

File: /frontend/getraxx-landing/src/pages/legal/PrivacyPolicy.jsx

The current policy (effective 2026-05-23) does not cover emotion or sentiment labels as a data category. The following updates are required before Shape 1 ships to any user. All updates require attorney review before publication.

Section 2 (What Data We Collect) — Add new row to the table:

Section 2 "What we do not collect" paragraph — Add:

"We do not infer, auto-classify, or score your emotional or psychological state from behavioral signals (such as trade timing or P/L) in the Personal Sentiment Journal feature. Labels in this feature reflect only what you directly report."

Section 3 (How We Use Your Data) — Add bullet:

Sentiment journal: Processing self-reported emotion labels linked to individual trade records, to display filtered historical views within your private account. This data is not used for cross-user comparison, not shared with third parties, and not used to generate recommendations.

Section 7 (Data Retention) — Add row:

Section 8 (Your Rights) — Add clause:

This includes sentiment and emotion labels stored in your account. If you request deletion of a trade record or your full account, associated sentiment labels are deleted in the same operation.

Section 10 (California Residents) — Add paragraph:

Sentiment / emotion labels and California sensitive personal information: Raxx treats self-reported emotion labels in the Personal Sentiment Journal as potentially within the "psychological trends" category of sensitive personal information under CPRA §1798.140(ae). As a result, you have the right to direct Raxx to limit use of this data to providing the sentiment journal feature only. To exercise this right, contact privacy@raxx.app with subject line "Limit Use — Sentiment Data." Raxx does not sell, share, or use sentiment label data for any purpose other than displaying your own filtered history back to you.

Add new Section — before Section 10 or as subsection of Section 2:

Psychological / sentiment data — special note: The Personal Sentiment Journal feature allows you to record how you felt before and after individual trades. This data is entirely self-reported — you choose your label; Raxx does not infer it. This data is stored linked to your trade records, visible only to you, and subject to the same deletion rights as all other personal data (Section 8). It is not used to profile you, compare you to other users, or generate any recommendation.

Part 4 — Cross-Checks with Prior BLR Research

4A. Cross-check with docs/legal/research/getraxx-differentiation-copy-review-2026-06-04.md

The earlier differentiation copy review (referenced in the task brief but not present in this worktree as of 2026-06-05) established redlines around: - Causal performance claims ("helps you trade better") - Forward-looking framing (Raxx's established architectural principle) - "Explains" language (Raxx surfaces what happened, not why)

Shape 1 consistency check:

• The pre-trade / post-trade label UI must not imply that Raxx is analyzing the causal relationship between emotional state and outcome. The user sees the filter; Raxx does not tell them what it means.
• Copy must not include "trading psychology" in a way that implies Raxx is providing psychological analysis. The feature is a journal, not a psychologist.
• The word "pattern" in copy ("see your emotional patterns") requires care: a pattern claim implies Raxx is finding something. If Raxx is simply returning a filtered list, say "see how your trades went when you felt [X]," not "see your emotional patterns."

4B. Cross-check with docs/legal/research/public-com-compliance-review-2026-06-05.md

The Public.com compliance review (referenced but not present in this worktree) established the SEC enforcement precedent on backtested performance marketing. The relevant points for Shape 1 reconciliation:

Claim 2 above directly incorporates this precedent. The Sept. 2023 enforcement sweep applies to Shape 1's backtest-filter results page if that page is ever surfaced publicly. The distinction between "general hypothetical backtest" and "user's own labeled results" is relevant internally but does not change the public-page prohibition.

Additional reconciliation point — the "not a registered IA" protection: The Public.com review likely established that Marketing Rule 206(4)-1 applies only to registered investment advisers. That protection holds for Shape 1 as well. But it does not eliminate FTC §5 exposure on public-facing displays. The auth-gate principle from the Public.com review applies with equal force to Shape 1.

4C. SEC S7-18-22 Rulemaking Watch

As of 2026-06-05: The PDA Proposal (S7-18-22) was withdrawn June 12, 2025. No longer a pending compliance obligation.

The watch that remains: Anti-fraud provisions under Advisers Act §206 and Exchange Act §10(b) are the live analogs. Any feature design that creates a nudging mechanism — pre-selected labels, gamified sentiment streaks, or platform-generated "insight" about the user's emotional patterns — risks §206 anti-fraud scrutiny under the theory that such nudging constitutes a material omission (not telling users the platform has an interest in how they label their trades, if applicable) or a deceptive practice.

Remove this watch from the attorney intake packet for the PDA rule specifically. Replace with: "Does Shape 1's label-suggestion UI design (if any) create §206 anti- fraud exposure?"

Part 5 — Attorney Questions: Shape 1 Intake Additions

The following questions are new additions to the securities attorney intake packet currently maintained at docs/business/questions-for-attorney.md. They should be added as Section Q (Shape 1 — Personal Sentiment Journal) and brought to the same engagement as P6 (§202(a)(11) inanimate-tool opinion).

Attorney type for all Shape 1 questions: Securities attorney with Investment Advisers Act background (same engagement as P6). Section 3C (GDPR relocation) and Section 3D (privacy policy updates) additionally require privacy attorney review.

Section Q — Shape 1: Personal Sentiment Journal — Attorney Questions

(Intake section for the same securities attorney engagement flagged in sections I, L, P, and O. Shape 1 questions are additive to existing P6 scope — confirm whether they fit the same engagement or require an additional opinion.)

Q1. §202(a)(11) opinion — scope confirmation for Shape 1. Does the §202(a)(11) analysis change when the platform (a) accepts user-supplied emotional labels before and after trades, and (b) returns filtered historical results showing how the user's own trades performed when they reported those labels? Does the "inanimate tool" framing extend to this feature? Is there any aspect of Shape 1's label-storage-and-retrieval mechanism that creates "advice concerning securities" under the ABCs test, given that the output is historical and the user's own data?

Q2. Auto-classification erosion — line-drawing. At what specific point does Raxx's label-suggestion or auto-tagging behavior cross from neutral UI design into providing "advice concerning securities" under §202(a)(11)? Specifically: (a) Is a blank "select your state" field with user-supplied label options unambiguously clean? (b) Does a "most users who felt X in similar conditions selected Y" suggestion tooltip cross the line? (c) Does auto-tagging from behavioral signals (time-in-position, P/L sign) cross the line? If so, is there a safe-harbor framing (e.g., "behavioral tag — not a sentiment label — shown separately")?

Q3. Marketing Rule inapplicability — confirm for Shape 1. Confirm that Marketing Rule 206(4)-1 does not apply to Raxx's in-app backtest-filter display because (a) Raxx is not a registered investment adviser, and (b) an in-app display to an authenticated user of their own data is not an "advertisement." What is the residual FTC §5 exposure from the same display, and what disclaimer placement standard applies under FTC §5 rather than the Marketing Rule?

Q4. FINRA non-applicability — confirm and document. Raxx is not a FINRA member and does not execute trades directly. Confirm: (a) FINRA Rules 2210 and 2360 do not apply to Raxx's in-app communications or sentiment-filter displays; (b) if a Raxx user is a registered representative at a FINRA member firm and uses Raxx's sentiment journal in connection with their firm's business, what — if anything — does Raxx need to disclose or accommodate? (c) Does Raxx's connection to the user's broker account via aggregator API create any FINRA nexus?

Q5. §206 anti-fraud exposure — label-suggestion design. If Raxx implements any label-suggestion feature (pre-populated defaults, "did you mean X?" prompts, or AI-generated label recommendations), does that feature create exposure under Advisers Act §206(1) or §206(2) on the theory that influencing how the user labels their trades, in a way that affects how they interpret their own performance history, is a deceptive or manipulative practice? What is the minimum safe design that preserves the user-assertion principle?

Q6. Backtest-filter as "advertisement" — FTC §5 threshold. At what point does a screenshot of a user's own sentiment-filtered results, used in a testimonial, marketing email, or social media post, become subject to FTC Endorsement Guides (16 C.F.R. Part 255, 2023 revision) and/or FTC §5 deceptive- advertising standards? What disclosure is required alongside such a screenshot: (a) in a paid testimonial; (b) in an organic user-shared post; (c) in a case study on the Raxx marketing page?

Privacy attorney questions (separate engagement from securities attorney):

Q7. CPRA Sensitive PI classification — user-asserted emotion labels. Do user-asserted emotion labels (not inferred by the platform) fall within the "psychological trends" Sensitive Personal Information category under CPRA §1798.140(ae)? What is the right-to-limit-use obligation if they do? Does the answer change if labels are linked to financial transaction records (trade outcomes)?

Q8. In-flow consent adequacy. Is the one-time in-flow notice described in Part 2 of the Shape 1 compliance research (2026-06-05) sufficient to satisfy FTC §5 notice-and-choice principles and any applicable CPRA §1798.121 (right to limit use of SPI) disclosure requirements? Or does Raxx need a signed consent separate from the ToS?

Q9. GDPR Art. 17 — relocating user scenario. Raxx geo-blocks EU signups. If a US-enrolled user relocates to the EU after enrollment, and has emotion labels stored in Raxx, does Art. 17 apply to those labels upon relocation? What is the practical mechanism for Raxx to honor an Art. 17 erasure request from a relocating user, given that we are a US company with a EU geo-block?

Part 6 — Estimated Billable Hours: Shape 1 Opinion Letter

Context: The prior securities attorney engagement scope (sections P, I, L, O in docs/business/questions-for-attorney.md) covers a broad D-scope opinion letter on IA Act perimeter, marketing rule, and backtested performance. Estimated cost for that full D-scope engagement: see prior BLR notes (not replicated here).

Shape 1 marginal cost estimate:

Shape 1 questions Q1 through Q6 are additive to the existing §202(a)(11) analysis already scoped in P6. They add specificity to the inanimate-tool framing rather than opening a new area of law.

*Rate assumption: Philadelphia securities attorney with IA Act background. Ballard Spahr, Duane Morris, or Faegre Drinker range. Unsourced — confirm with attorney. Rates in metropolitan PA markets for securities regulatory work typically run $400–$700/h at senior associate level, $600–$900/h at partner level.

Total Shape 1 marginal opinion cost: $4,950 – $10,100

This is materially lower than a full D-scope opinion because: 1. The §202(a)(11) inanimate-tool analysis is already in scope for P6 — Shape 1 is an incremental application of the same framework. 2. The FINRA non-applicability confirmation is a short memo, not original analysis. 3. The privacy questions are bounded (one feature, one data category).

What this estimate does NOT include: - Any follow-up if the attorney identifies a registration gap requiring remediation. - SEC no-action letter preparation (not recommended unless Q1 analysis is uncertain). - Amendment to the ToS or full privacy policy drafting (separate from review).

Sources

• Investment Advisers Act of 1940, §202(a)(11), 15 U.S.C. §80b-2(a)(11): https://www.govinfo.gov/content/pkg/COMPS-1878/pdf/COMPS-1878.pdf
• SEC Release IA-1092, "Applicability of the Investment Advisers Act to Financial Planners, Pension Consultants, and Other Persons Who Provide Investment Advisory Services as a Component of Other Financial Services" (1987): https://www.sec.gov/files/rules/interp/1987/ia-1092.pdf
• Lowe v. SEC, 472 U.S. 181 (1985): https://supreme.justia.com/cases/federal/us/472/181/
• SEC, "Applicability of the Investment Advisers Act" — ABC test overview: https://www.mayerbrown.com/-/media/files/perspectives-events/events/2025/04/mayer-brown-advisers-act-outline-imu-2025-final.pdf
• SEC Rule 206(4)-1 (Marketing Rule), Final Rule Release IA-5653 (Dec. 2020): https://www.sec.gov/resources-small-businesses/small-business-compliance-guides/investment-adviser-marketing
• SEC Marketing Rule FAQ (staff guidance): https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions
• SEC Enforcement — Nine Investment Advisers / Hypothetical Performance (Sept. 11, 2023): https://www.sec.gov/news/press-release/2023-163
• SEC Enforcement — Five Investment Advisers / Hypothetical Performance (Apr. 2024): https://www.mayerbrown.com/en/insights/publications/2024/04/sec-charges-five-registered-investment-advisers-for-marketing-rule-violations
• BCLP Enforcement Sweep Analysis: https://www.bclplaw.com/en-US/events-insights-news/sec-enforcement-sweep-regarding-hypothetical-performance.html
• Goodwin — Round 2 Marketing Rule Enforcement: https://www.goodwinlaw.com/en/insights/publications/2023/09/alerts-otherindustries-pif-sec-marketing-rule-enforcement-actions
• Dinsmore — SEC Enforcement and Hypothetical Performance: https://www.dinsmore.com/publications/sec-enforcement-actions-related-to-the-marketing-rule-and-hypothetical-performance-data/
• SEC S7-18-22 Predictive Data Analytics proposal (withdrawn June 12, 2025): https://www.sec.gov/rules-regulations/rulemaking-activity
• BU RBFL analysis of S7-18-22 / PDA (Feb. 2025): https://www.bu.edu/rbfl/files/2025/02/Regulation-Fix-Recommendations-for-the-SEC-regarding-Digital-Engagement-Practices-PDA-.pdf
• Exchange Act Rule 15l-1 (Reg BI): https://crsreports.congress.gov/product/pdf/R/R46115
• FINRA Rule 2210 (Communications with the Public): https://www.finra.org/rules-guidance/rulebooks/finra-rules/2210
• FINRA Rule 2360 (Options): https://www.finra.org/rules-guidance/rulebooks/finra-rules/2360
• FINRA Communications Reference Guide (Sept. 2020): https://www.finra.org/sites/default/files/2020-09/communications-public-rules-reference-guide.pdf
• FTC Act §5, 15 U.S.C. §45: https://www.federalreserve.gov/boarddocs/supmanual/cch/ftca.pdf
• FTC Endorsement Guides, 16 C.F.R. Part 255 (revised 2023): https://www.ftc.gov/system/files/ftc_gov/pdf/p204500_endorsement_guides_in_2023.pdf
• PA UTPCPL, 73 P.S. §201 et seq.; Gregg v. Ameriprise Financial Services, Inc., 664 Pa. 69 (2021) (strict-liability standard) — unsourced primary citation, confirm with PA attorney.
• California Civil Code §1798.140(ae) (CPRA Sensitive Personal Information): https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.
• California AG Opinion on CCPA "Inferences" (March 2022): https://www.dwt.com/blogs/privacy--security-law-blog/2022/03/california-ccpa-inferences-disclosures
• CPRA Text, California Privacy Protection Agency: https://www.caprivacy.org/cpra-text/
• IAPP analysis — CPRA SPI opt-in/out: https://iapp.org/news/a/brain-power-piecing-together-ccpa-s-opt-in-out-requirements-for-sensitive-personal-information
• GDPR Art. 17 (Right to Erasure): https://gdpr-info.eu/art-17-gdpr/
• Data Protection Commission Ireland — Art. 17 guidance: https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr
• Quebec Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64): https://www.quebec.ca/en/government/policies-orientations/french-language/modernization-charter-french-language (cross-reference; primary source is RSQ c P-39.1 — obtain directly from Publications du Québec)
• NASAA comment on digital engagement practices: https://www.nasaa.org/comment-letters/nasaa-comment-letter-to-sec-regarding-digital-engagement-practices-and-investment-adviser-use-of-technology/
• Winstead — Publisher's Exclusion under the Advisers Act (Dec. 2025): https://www.winsteadinvestmentmanagement.com/2025/12/navigating-the-publishers-exclusion-under-the-advisers-act/

Before acting on any finding in this document: Consult a securities attorney with Investment Advisers Act background (for sections 1A–1E, Part 3, and Section Q questions Q1–Q6), and a privacy attorney with CCPA/CPRA and GDPR background (for Section 3A–3D and questions Q7–Q9). This research was produced 2026-06-05 for MooseQuest LLC dba Raxx. It is not legal advice. The attorney's opinion — not this document — is the actionable output.