What we collect,
and why.

1. Data Controller

ApexVol Ltd. is the data controller responsible for your personal data.

EU Representative

If you are located in the European Economic Area (EEA) and wish to exercise your data protection rights, you may contact us directly at [email protected]. A formal EU representative will be appointed as required.

2. Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide

2.2 Information Collected Automatically

3. How We Collect Your Data

• Direct interactions: When you create an account, subscribe to a plan, contact support, or fill out forms
• Automated technologies: Through cookies, server logs, and similar technologies as you navigate our Services
• Third-party sources: Payment processors (Stripe) for transaction verification

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following lawful bases:

5. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve our options analytics platform
• Account Management: To create and manage your account, authenticate access, and process subscriptions
• Payment Processing: To process payments and prevent fraudulent transactions
• Communications: To send transactional emails (receipts, password resets, service updates) and, with your consent, marketing communications
• Support: To respond to your inquiries and provide customer service
• Analytics: To understand usage patterns and improve user experience
• Security: To detect, prevent, and address fraud, abuse, and security issues
• Legal Compliance: To comply with applicable laws and regulations

6. Data Sharing & Third Parties

We do not sell your personal data. We may share your data with:

6.1 Service Providers

All service providers are bound by Data Processing Agreements (DPAs) requiring them to protect your data and use it only for the specified purposes.

6.2 Other Disclosures

We may also disclose your data:

• To comply with legal obligations, court orders, or government requests
• To protect the rights, property, or safety of ApexVol, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice to you)

7. International Transfers

Your data may be transferred to and processed in countries outside the UK or European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries deemed adequate by the UK Government
• Standard Contractual Clauses (SCCs): UK-approved contractual protections with recipients
• Supplementary Measures: Additional technical and organizational safeguards where required

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Policy:

After the retention period, data is securely deleted or anonymized.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: TLS 1.3 for data in transit; AES-256 encryption for data at rest
• Access Controls: Role-based access, multi-factor authentication for staff
• Secure Sessions: HTTPOnly, Secure, and SameSite cookie flags
• Password Security: Passwords hashed using industry-standard algorithms (bcrypt)
• Regular Audits: Security assessments and vulnerability testing
• Incident Response: Documented breach notification procedures (within 72 hours per GDPR)

While we strive to protect your data, no method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

11.1 Your California Rights

11.2 Do Not Sell or Share My Personal Information

While we do not currently sell or share personal information, you may still submit an opt-out request for the record. We will honor such requests and notify you if our practices change in the future.

11.3 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, IP address, account ID
• Commercial Information: Subscription history, transaction records
• Internet Activity: Browsing history on our site, interactions with our Services
• Geolocation Data: Approximate location based on IP address
• Inferences: Preferences derived from usage patterns

11.4 How to Exercise Your California Rights

11.5 Shine the Light

Under California Civil Code Section 1798.83 ("Shine the Light"), California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated above, we do not share your personal information with third parties for their direct marketing purposes.

12. Automated Decision-Making

Under UK GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

ApexVol may use automated processing in the following limited circumstances:

• Fraud detection: Automated systems may flag suspicious account activity (e.g., unusual login patterns, payment anomalies) for security purposes
• Subscription management: Automated systems process subscription changes, billing, and access tier assignments

We do not use automated decision-making to profile users for marketing purposes or to make decisions that produce legal or similarly significant effects without human review. If you believe an automated decision has significantly affected you, you have the right to:

• request human review of the decision;
• express your point of view; and
• contest the decision.

Contact [email protected] to exercise these rights.

13. Cookies

We use cookies and similar technologies to operate our Services. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

14. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification for significant changes
• Displaying a notice within the Services

Your continued use of the Services after changes become effective constitutes acceptance of the updated Policy.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: