What we collect,
and why.

1. Data Controller

ApexVol Ltd. is the data controller responsible for your personal data.

EU Representative

If you are located in the European Economic Area (EEA) and wish to exercise your data protection rights, you may contact us directly at [email protected]. A formal EU representative will be appointed as required.

2. Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide

2.2 Information Collected Automatically

3. How We Collect Your Data

• Direct interactions: When you create an account, subscribe to a plan, contact support, or fill out forms
• Automated technologies: Through cookies, server logs, and similar technologies as you navigate our Services
• Third-party sources: Payment processors (Stripe) for transaction verification

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following lawful bases:

5. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve our options analytics platform
• Account Management: To create and manage your account, authenticate access, and process subscriptions
• Payment Processing: To process payments and prevent fraudulent transactions
• Communications: To send transactional emails (receipts, password resets, service updates) and, with your consent, marketing communications
• Support: To respond to your inquiries and provide customer service
• Analytics: To understand usage patterns and improve user experience
• Security: To detect, prevent, and address fraud, abuse, and security issues
• Legal Compliance: To comply with applicable laws and regulations

6. Data Sharing & Third Parties

We do not sell your personal data. We may share your data with:

6.1 Service Providers

All service providers are bound by Data Processing Agreements (DPAs) requiring them to protect your data and use it only for the specified purposes.

6.2 Other Disclosures

We may also disclose your data:

• To comply with legal obligations, court orders, or government requests
• To protect the rights, property, or safety of ApexVol, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice to you)
• To an AI assistant you choose to connect, at your direction (see section 15)

7. International Transfers

Your data may be transferred to and processed in countries outside the UK or European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries deemed adequate by the UK Government
• Standard Contractual Clauses (SCCs): UK-approved contractual protections with recipients
• Supplementary Measures: Additional technical and organizational safeguards where required

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Policy:

After the retention period, data is securely deleted or anonymized.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: TLS 1.3 for data in transit; AES-256 encryption for data at rest
• Access Controls: Role-based access, multi-factor authentication for staff
• Secure Sessions: HTTPOnly, Secure, and SameSite cookie flags
• Password Security: Passwords hashed using industry-standard algorithms (bcrypt)
• Regular Audits: Security assessments and vulnerability testing
• Incident Response: Documented breach notification procedures (within 72 hours per GDPR)

While we strive to protect your data, no method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

11.1 Your California Rights

11.2 Do Not Sell or Share My Personal Information

While we do not currently sell or share personal information, you may still submit an opt-out request for the record. We will honor such requests and notify you if our practices change in the future.

11.3 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, IP address, account ID
• Commercial Information: Subscription history, transaction records
• Internet Activity: Browsing history on our site, interactions with our Services, including data requests made through Connectors
• Geolocation Data: Approximate location based on IP address
• Inferences: Preferences derived from usage patterns

11.4 How to Exercise Your California Rights

11.5 Shine the Light

Under California Civil Code Section 1798.83 ("Shine the Light"), California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated above, we do not share your personal information with third parties for their direct marketing purposes.

12. Automated Decision-Making

Under UK GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

ApexVol may use automated processing in the following limited circumstances:

• Fraud detection: Automated systems may flag suspicious account activity (e.g., unusual login patterns, payment anomalies) for security purposes
• Subscription management: Automated systems process subscription changes, billing, and access tier assignments

We do not use automated decision-making to profile users for marketing purposes or to make decisions that produce legal or similarly significant effects without human review. If you believe an automated decision has significantly affected you, you have the right to:

• request human review of the decision;
• express your point of view; and
• contest the decision.

Contact [email protected] to exercise these rights.

13. Cookies

We use cookies and similar technologies to operate our Services. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

14. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at [email protected].

15. Claude and Other AI Assistant Connectors

15.1 What This Section Covers

You can connect ApexVol to an AI assistant or developer tool such as Claude, ChatGPT or Cursor, through our hosted MCP server (https://apexvol.com/mcp-server), through API tokens you create under Account, then API Access, or through our open-source package (apexvol-mcp) running on your own computer. Each of these is a "Connector". This section applies to all Connectors and adds to the rest of this Policy.

15.2 Who Is Responsible for What

ApexVol Ltd. is the controller of the personal data we collect through a Connector, as described below. Your AI provider (for example Anthropic for Claude, or OpenAI for ChatGPT) is a separate, independent controller. It decides what happens to your conversations, including the data ApexVol returns to it, under its own terms and privacy policy. We do not control that and are not responsible for it. Please read your AI provider's privacy policy before connecting.

15.3 What We Receive

• When you connect: the name your AI app registers with us and the web addresses it uses to complete sign-in. You sign in to ApexVol directly; your AI provider does not send us your name, email address or AI account details.
• When you use it: the request the assistant sends for specific data, such as a ticker, an expiration date, a strike, or the legs of a strategy or portfolio, together with the time, the IP address of the computer making the request and its software identifier. With the hosted connector that IP address usually belongs to your AI provider, not to you. With a local install it is your own.
• What we do not receive: your conversations, prompts, the assistant's answers, files or images you share with it, or data from other connectors. The assistant decides what to send us based on your conversation, so a request can reflect what you asked about, such as which ticker.

15.4 What We Send to Your AI Provider

When you approve a connection we issue your AI app a read-only access token. We never give it your password, email address, name or billing details. In reply to each request we return market data and analytics such as implied volatility, Greeks or expected moves. If a request needs a higher plan, the reply says which plan includes it.

15.5 What We Store, Why, and for How Long

Positions or strategies you ask about are used to answer that request and are not saved to your account.

15.6 What We Do Not Do

We do not sell Connector data or share it with advertisers. We do not use it to train AI models. We do not use it to make automated decisions that have legal or similarly significant effects on you. Connectors are read-only: they cannot place trades, move money, or change your account or billing.

15.7 Security

Hosted connections use OAuth 2.1 with PKCE. Access is limited to reading data, access tokens expire after one hour, and refresh tokens are replaced each time they are used. Tokens are stored only as one-way hashes or encrypted, all traffic uses HTTPS, and requests are rate limited.

15.8 Your Choices and Rights

• Revoke a connection at any time under Account, then API Access, or by removing ApexVol in your AI assistant's settings. It stops working immediately.
• "Sign out everywhere" on your Account page also disconnects every AI app.
• Deleting your account ends every Connector.
• Your rights in section 10 apply to Connector data. Contact [email protected]. For data held by your AI provider, contact that provider.

15.9 International Transfers

Your AI provider's servers may be outside the UK, for example in the United States. Data we return to your AI provider is sent there at your direction when you use a Connector. Our own transfers follow section 7.

15.10 Running Our Package on Your Own Computer

apexvol-mcp runs on your device and sends requests to our API using your API token. It does not send us analytics or usage tracking. Keep your token private: anyone who has it can read data on your plan until you revoke it.

15.11 AI Answers

AI assistants can misread, round or misstate the data we provide. We do not control their answers. Nothing an AI assistant says using ApexVol data is financial advice from ApexVol.

15.12 Contact

Questions about this section: [email protected].

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification for significant changes
• Displaying a notice within the Services

Your continued use of the Services after changes become effective constitutes acceptance of the updated Policy.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: