Privacy Policy

This policy explains what personal data APEX Flow and APEX Academy process, for what purpose, who it is shared with and what rights you have over it. It applies to the website somosapex.com, to the APEX Flow mobile apps and to applications to APEX Academy, which are made on the website.

1. Who processes your data

2. What data we process

We only process the data needed to provide the service to you and the data you choose to give us. Much of it is optional: if you do not provide it, the service works just the same, with less personalization.

2.1 Account data (required)

• Name or username and email address.
• Password, always stored as a one-way hash: the password itself is never stored, so no one can read it, not even us.
• If you sign up to connect an account, your email's confirmation code, stored as a hash, which expires after 15 minutes, and the number of attempts.

2.2 Profile data (optional)

• WhatsApp number, country, city, date of birth and occupation.
• Time zone, used to display the dates of your trading correctly.
• Profile photo, if you choose to upload one.

2.3 Trading profile (optional)

• Experience, trading style, markets of interest, goal, weekly hours dedicated and how long you have been trading.
• Declared capital, if you choose to provide it. This is a figure that you enter: it is not verified, it is not shared and it is only used to put your own metrics in context.

2.4 Your trading account data (only if you connect it)

See section 4, which describes it in detail.

2.5 Content you create

• Discipline rules you declare and their tracking.
• Entries in your trading journal.
• Your instrument list and the price alerts you set up.
• Your daily check-in answers (preparation, routine, plan for the day) and the tags you add to your trades.

2.6 Payment data

• Customer and subscription identifiers from the payment gateway, and the status of your subscription.
• To apply the refund rule, for every charge we record whether you connected a cTrader account and on which days (with the time and the screen) you opened My trading with your account’s real data.
• The WhatsApp number you provide when paying: it is sent to the payment gateway with the billing details and, if you do not uncheck the box, we use it for marketing communications (see section 3).
• We do not store your full card number or its security code. They are processed directly by the payment gateway; we do not receive them or have access to them.
• If you use or used the free month of the monthly plan: the dates of your free month and of your first charge, the card brand and the last four digits of your card (to show them to you in My account and in the reminder before the first charge) and the fingerprints described in section 2.16.
• When the free month starts, the payment gateway authorizes a minimal amount to verify your card and cancels it immediately: it is not a charge.

2.7 Technical and security data

• IP address and access log, to detect unauthorized use of the account. The log keeps the date and time, the IP address, the page and whether the access was from the website, from the Android app or from the iPhone app. The IP address of your account's last recorded access from the website (also from the site installed on your device) is also used to locate the account approximately (see section 2.14).
• Date of last access, last page visited and session status.
• Identifier of the device registered for notifications, if you enable them.

2.8 Messages you send us

• If you write to us through the contact or support form: your name, your email address, your phone number if you choose to provide it, and the content of your message.
• The IP address from which it is sent and the page from which you send it, solely to limit the automated sending of spam.
• If you leave a request or a suggestion in “We're listening” on the website: the type of request, your message, your email address (if you are signed in, your account's email), your plan, your language, whether you write from the browser or from the site installed on your device, the APEX Flow version, the page you write from and the follow-up we do on your request. If you choose to provide them, also your WhatsApp number and how you prefer us to reply. To stop automated submissions we only use an irreversible fingerprint of your IP address, which expires within a day.
• Your choice in the news box of “We're listening”, with its date and the wording you saw.
• You can write to us without having an account. In that case, that is the only data we hold about you.

2.9 Community

• Discord identifier, only if you choose to link your account to access the community.

2.10 Subscription data (only if you buy through the App Store)

• If you buy APEX Flow Pro inside the app, Apple processes the payment. From Apple we receive a subscription identifier, the product purchased (monthly or annual), its status and its validity dates.
• To link the purchase to your account we use our own identifier, generated without personal data. Apple handles your card details and other payment data: we only receive the status of the purchase.
• We use this data to activate and keep your Pro access while the subscription is active, to answer your questions about it (see section 3) and, in the marketing analysis in section 2.17, to know that you subscribed through the App Store and until when your Pro is valid.

2.11 If you apply to APEX Academy

• You can apply without having an account. You give us your name, your email address and your WhatsApp number.
• Your answers to the application form: what you would like to achieve with trading, your trading experience, what you tried before to learn, what you find hardest today, how many hours a week you can devote to it, which markets interest you, how much you plan to start trading with (optional, in broad ranges), what you would like to resolve in the interview and how you found us.
• The answer about how much you plan to start trading with is up to you and is used only to understand your plan and to talk about the risk of trading in the interview.
• The page language, the date of your application, the confirmation of your email and the status of your application (for example, whether you have already booked the interview).
• The IP address you apply from, to prevent abuse and automated submissions.
• If you book the interview, the scheduling service receives your name, your email, the time slot you choose and anything you write in its booking form (see section 5).

2.12 Visits to the website

• When you open a page of the website and keep it in view for a few seconds, your browser (also the site installed on your device) sends a request to our server, at most once per tab and per type of contact (for videos, once per video; see section 2.15), or once per page if your browser does not allow the marks described in the Cookie Policy (section 2.3) to be stored. This applies to any page of the site, whether or not you are signed in —the public ones (such as the home page, the information pages, the contact page, the app help page, the blog posts or the legal texts), the sign-in and sign-up pages, the APEX Flow pages, including the start screen (/start/) and the Lab (/lab/), and the Academy pages when they are available—, save for the exceptions listed at the end of this section. The content of the request includes no data about you or your account: at most, a fixed marker, the same for everyone, that indicates the type of contact (visit, use, installation or playing a video; see sections 2.13 and 2.15) and, for videos only, the number of the video and whether it was started or reached 75% or the end; and, if you arrived through a link of ours that indicates it, the code of the social network or channel of that link (see section 2.15). With it, we use your IP address at that moment to know where our visitors come from: with a geolocation database stored on our own server (DB-IP), we obtain the approximate location that corresponds to your IP and, if it is less than 120 km from a city on our list (capitals and main cities of each country) and in the same country, we assign it to the nearest one; otherwise, we keep only the country. Your IP address is not sent to DB-IP.
• For this, we do not store your IP address: it is used at that moment and discarded, without writing it to our database or to our application's logs. We also look at some technical data of the request at that moment, such as the browser type, without storing it, only to filter out robots, the apps and our own tests. The visit is not linked to your account, even if you are signed in, except for what section 2.17 explains for new accounts (the code of the network or channel you came from and, where applicable, the campaign and the entry page). As with any page of the site, the hosting provider keeps a technical record of the requests the server receives (see sections 5 and 7).
• We keep a single record per place, not per visit or per person: the country, the city if there is one and the time, rounded, of the last visit from that place, which is overwritten with each new visit. If the place has already joined the community list (section 2.13), the record also keeps the day it joined, how many installations there were from there and the type of contact the place came from —use of APEX Flow in the browser, installation, accounts or, if there were any, the Android app openings described in section 2.13—, with no data about any person. Apart from this record, we keep daily aggregate counters by country and city, which are explained in section 2.15; playing a video only adds to those counters: it does not put any place in this record or on the map. The record contains no IP address, cookies or identifier of yours.
• To stop automated submissions, we use a fingerprint calculated from the network of your IP address —never from the full address— with a key that is replaced every hour. That fingerprint is deleted when the key changes or at the next hourly clean-up.
• We publish on the site the list of countries and, where applicable, cities from which there were visits in the last 20 days, with no quantities or visit times, to show it on a map. The list is updated every hour and a place can appear on it with a single visit.
• Your visit is counted even if you choose “Necessary only” in the cookie notice and even if your browser sends the “Global Privacy Control” or “Do Not Track” signal. It is an anonymous figure: since it keeps nothing that identifies you, it is always counted and there is no way to separate your visit from the others. This count is not made inside the APEX Flow apps for Android and iPhone, nor at the addresses you return to from the payment processor, nor at the addresses for recovering or creating the access password. On the pages that show the card payment form (for example, the APEX Flow main page), the visit is counted as on any other page, but the tool does not read or send anything you type in that form.

2.13 Use and installation of APEX Flow from the browser, and the community map

• When you start using APEX Flow from the browser —the APEX Flow start screen (/start/), the Lab, which is your account's working screen (/lab/), or the APEX Flow Pro page— or when you install APEX Flow on your device from the browser, the same tool described in section 2.12 sends our server a request with a fixed marker, the same for everyone, that only indicates that it is a use or an installation. Although /lab/ is a private screen of your account, the tool does not read anything from your account, your trades or your trading data, and the only thing it puts in the request is that marker; if you are signed in, your browser sends it, like any request to this site, with your session cookie, but our server does not use it to know who you are —except for what section 2.17 explains for new accounts—: it treats the request as anonymous. With your IP address at that moment we obtain the country and the nearest city on our list, in the same way as in section 2.12; the IP is not stored or sent to DB-IP, and the use or installation is not linked to your account, even if you are signed in, except for what section 2.17 explains. For the map, of a use or an installation we keep only the record of the place described in section 2.12: the approximate country and city, its dates, how many installations there were from there, as an aggregate figure with no data about you, and the type of contact the place came from. In addition to that record, each use and each installation adds one to the daily aggregate counters in section 2.15, which keep no data about you. Unlike a visit to the rest of the site, that place joins the community list and stays on it. To stop abuse there is a daily limit on new places: once the limit is reached, a use counts only as a visit and an installation is not counted. So that it is not sent again, your browser stores marks with no identifier, explained in the Cookie Policy (section 2.3).
• Your use or installation is counted even if you choose “Necessary only” in the cookie notice and even if your browser sends the “Global Privacy Control” or “Do Not Track” signal. Since we keep nothing that identifies you, they are always counted and we cannot know which place corresponds to your use. If you think a published place could identify you, write to us at soporte@somosapex.com and we will remove it from the list, although it may appear again if someone uses or installs APEX Flow from there again, or if there are accounts located there.
• Today, the APEX Flow apps for Android and iPhone contribute no data to the map: their openings are not counted, and accesses made from them are not used to locate your account. If that changes, we will say so in this policy before we start counting them. The data on the map comes from the website, also from the site installed on your device (sections 2.12 and 2.13); from the accounts located as described in section 2.14; and from places that the APEX team adds to the list by hand, with country and city only, based on aggregate statistics from third parties or on what it knows about the reach of the community, with no data about any person.
• On October 10, 2026, for a few hours, the count of openings of the Android app was active. If any opening was counted, only the record of the place was kept —the country, the city if there is one, the day it joined the list and how many first openings there were from there—, with no IP address, cookies or identifier of yours, and that place remains on the community list. If you think it could identify you, write to us at soporte@somosapex.com and we will remove it.
• We publish on the site the list of countries and, where applicable, cities where there are accounts located as described in section 2.14, from which APEX Flow was used or installed from the browser as described in this section, that the APEX team added to the list by hand, or where any of the openings mentioned above was recorded, with a level per city that shows, in ranges and without the exact figure, how many people there are (1: up to two; 2: three to nine; 3: ten or more), to show it on a map. That level is calculated with the larger number among the sources for that place —the accounts located there at that time, the installations and the first openings of the Android app recorded from there—, without adding them up, so as not to count the same person twice; a place added by hand enters with level 1 or with the level those sources already give it. A city can appear even if there is a single account, a single installation or a single use there, with no name or exact number, and, once on the list, it stays, even if that account stops counting.

2.14 Approximate location of accounts

• If you have an APEX account, whether you pay or not, we include it in the community count, which we recalculate about every six hours. To locate it, we use only the IP address of your account's last recorded access (section 2.7), if it was from the website (also from the site installed on your device): with the geolocation database on our server (DB-IP), we obtain the nearest city on our list if it is less than 120 km away and in the same country; otherwise, only the country. The IP address is read at that moment and is not copied anywhere else. Accounts of the APEX team and test accounts are not counted.
• Accesses from the Android and iPhone apps are not used for this, and neither are the country or the WhatsApp number in your profile. If your last recorded access was from an app, your account is not located.
• From the count we keep only the aggregate result: how many accounts there are in each place, with no data about each person. A city can appear on the map even if there is a single account there, without your name or the exact number (see section 2.13). The place joins the community list and stays on it. If you ask to delete your account, it stops counting at the next recalculation.
• You can object by writing to soporte@somosapex.com from your account's email address: we exclude your account from the count and it stops counting at the next recalculation. The place may remain on the list, because the list of places is kept. If you think it could identify you, tell us: after excluding your account we remove it from the list, but it appears again if other accounts are or become located there, or if someone, including you, uses or installs APEX Flow from the browser there; and a visit to the site from there shows it as a visit for about 20 days. Your visits to the website and your uses and installations from the browser are counted separately, as anonymous figures that are not linked to your account (sections 2.12 and 2.13), and so they are still counted.

2.15 Aggregate statistics on reach and use

• In addition to the map list (sections 2.12 to 2.14), we keep daily aggregate counters, by country and city, of the contacts already described in sections 2.12 and 2.13 and, in addition, of video playback: how many times the website was visited; how many times the APEX Flow start screen (/start/) was opened for use; how many times the Lab (/lab/), your account's working screen, or the APEX Flow Pro page was opened —this figure includes people who do not have a paid plan, because the tool does not look at your account or your plan—; how many installations of APEX Flow were made from the browser (or first openings as an installed app); and how many times one of the help or learning videos on the APEX Flow screens (/start/ and /lab/) was started and how many times it reached 75% or the end. Each counter is a number per day, country and city (or per country only, if your approximate location does not match a city on our list). For videos we also keep a number per day and per video, with no country.
• If you arrive through a link of ours that indicates which social network or channel you come from (for example, one posted on Instagram that ends in “?r=ig”), we also count, in aggregate, which network or channel each visit, use or installation came from: only a code from a closed list (Instagram, TikTok, Facebook, WhatsApp, YouTube, Telegram, X, LinkedIn or “Google ad” —the latter when the address carries Google’s campaign parameter (utm_source=google or gclid), even without “?r=”—; any other value counts as “other” and is not stored), added up by day and country, never the link or anything that identifies you, and with the same retention periods as the rest of these counters. Your browser remembers that code while the tab stays open, so that what you use afterwards in it is also counted (Cookie Policy, section 2.3). If you do not want us to count it, open a new tab with an address without “?r=”, without “utm_source=google” and without “gclid”.
• It is the same tool as in sections 2.12 and 2.13 and follows the same rules: it counts at most once per tab and per type of contact —and, for videos, once per video and per type in that tab—, with a per-network limit to stop automated submissions. With your IP address at that moment we obtain the approximate country and city and apply the limit, in the same way as in section 2.12; the IP is not stored and the counters are not linked to your account or to any identifier of yours. For videos, the page listens to the messages that the video player (Vimeo) already sends to the page when you play a video and sends our server a request with a fixed marker, the number of the video that was played —the video's number, not the person's— and whether the video was started or reached 75% or the end; our server only counts it if that number corresponds to a video on our site. We load no new third-party script or service for this. To avoid repeating the submission, your browser stores a session marker with no identifier, which the Cookie Policy explains (section 2.3).
• When you are signed in on the website (not in the apps), we also count, in aggregate, how many times each APEX Flow screen is opened (for example, Market, Context, Risk or Discipline), how many times the “Connect my account” button is shown and how the connection with your broker comes back (connected, cancelled or with an error). Each counter is one number per day: it carries no name, no email, no account and no IP address of yours and uses no new cookie; your session is only used to know that it is a user account and not a team, test or account-closure one, nor one whose owner has objected, and it is not stored in the counter. Unlike the earlier counters, these are not summed into a monthly total: the daily detail is deleted after 13 months. We use them to know which parts of the service are used and at which step people stop when connecting their broker, so we can improve APEX Flow and decide what to show in our communication and advertising. Basis: legitimate interest. If you do not want us to count your screen openings, write to us at soporte@somosapex.com from your account email: from then on we exclude you from these counters and from the internal tool in section 2.17, and you stop receiving the emails about connecting your broker.
• They are counts of entries, not of people: they keep nothing per person and nothing that says who came in, and someone who comes back another day adds another entry. We do not use these counts to try to find out who is behind them, not even in places with very few entries. All of this is counted even if you choose “Necessary only” in the cookie notice and even if your browser sends the “Global Privacy Control” or “Do Not Track” signal. Since they carry nothing that identifies you, visits, uses, installations and videos are always counted. None of this is counted inside the APEX Flow apps for Android and iPhone, nor at the addresses you return to from the payment processor, nor at the addresses for recovering or creating the access password.
• We use them to know which countries and cities APEX reaches, which parts of the service are used and whether the videos are watched, and so decide where and how to make the service known: that is, to plan our communication and our advertising. We do not use them to target advertising at specific people or to build profiles: they help us decide in which countries and cities to communicate, not to whom. They are seen only by the people who administer the site, on a private screen from which they can download them in a file to analyse them, and in the internal management tool described in section 2.17: they are not published (unlike the map list) and the system does not send them to third parties or to advertising platforms. For marketing analysis we place them next to the account figures in section 2.17 (for example, how many visits and how many new accounts came from each social network or channel), and they remain aggregate figures. Basis: our legitimate interest in knowing, in aggregate, the reach and use of our service in order to plan its communication. Since these figures keep nothing that identifies you, we cannot separate or delete one person’s entries. What is counted while you are signed in (the APEX Flow screens) can be objected to as indicated above, for what is counted from that moment on.
• We keep the daily detail for up to 13 months. After that, the counters of visits, uses, installations, videos and networks are added up into a monthly total per country and city (and per video), which no longer distinguishes one day from another; that monthly total is kept with no automatic deletion period. Database backups may keep this data longer, only to restore the service after a failure.

We do not process special categories of data (health, ideology, biometrics), we do not build advertising profiles, we do not sell or transfer data to third parties for commercial purposes, and we do not use your data to train artificial intelligence models.

2.16 Fingerprints to prevent the free month from being repeated

The free month of the monthly plan is granted only once per person.

To check that the free month is used only once per person, when someone starts the free month we calculate and store irreversible fingerprints of this data (if you use or used the free month, also of each trading account you connect afterwards):

• your email address, normalized (without dots or anything after a “+” at providers that ignore them)
• the first 6 and the last 4 digits of your card
• your card identifier given to us by the payment processor
• your trading account identifier, if you connect it

A fingerprint is a code calculated with a one-way mathematical function and with our own secret key, which is not in the database. It does not allow the data to be reconstructed: neither we nor anyone else can obtain your email, your card or your trading account from it; it only serves to check whether a new piece of data matches one already used. Each fingerprint is stored with the date of the free month and an internal account identifier.

What for: so that the free month is used only once per person and to prevent abuse and fraud of the offer. Basis: legitimate interest in preventing fraud. You can object by writing to soporte@somosapex.com; if you do, we will not be able to offer you the free month, but you will be able to subscribe by paying from the first day. The retention period is in section 7.

Before the free month starts we also check whether any trading account you have connected has already used it. That check is done on the spot and stores nothing about people who do not use the free month.

If a fingerprint matches one already used, the free month is simply not offered to you: we tell you before charging you anything and you can subscribe by paying from the first day. Your account and your access to the Start plan are not blocked.

2.17 How you came to APEX (origin of your account)

• The first time you use your account on the website (not in the apps), we store with your account the date, the fact that this first use was on the website, and the approximate country and city that we obtain at that moment from your IP address, with the same geolocation database as in section 2.12 (the IP address is not copied anywhere else). If you came in through one of our links that says which social network or channel you come from (for example, one ending in “?r=ig”) and, within the 6 hours after that first use, in that same tab, the count in section 2.15 sends that code, we also store it with your account: only the code from the closed list in that section. These are the exceptions to what sections 2.12 to 2.15 say: the country and city of that first use, and that code, which is counted there without linking it to anyone, are also recorded in your account. If, on that visit, the address carried “?r=”, a campaign parameter (“utm_…”) or “gclid”, we also store the path of the page you came in through (for example, /calculadora-de-lotaje/) and, if it carried the name of one of our campaigns (the “utm_campaign” parameter), that name (only letters, numbers, hyphen and underscore, up to 40 characters), within those same 6 hours and under the same conditions; for this, your browser keeps in its session storage a marker with only those two items (Cookie Policy, section 2.3). If you came in from one of our ads on Google (the address carries “utm_source=google” or “gclid”), the code stored is “Google ad”. For accounts created before October 14, 2026 we store neither the code nor the campaign nor the page.
• We use it for APEX’s marketing analysis: to know which networks and channels, which countries and which cities bring new accounts and subscriptions, and to compare this with the aggregate figures in section 2.15 and with your account data (your name and email, sign-up date, language, plan and how you subscribed —website, App Store or gift—, the coupon you used, until when your Pro is valid, the dates of the free month, of the charges (with their amount and status), of failed charges, of the end of the period and of the next charge, the status of your subscription, last access and whether it was from the website or from an app, whether the connection with your broker is active, the name of the broker you connected, whether the account is real or demo and which email notices from section 3 we sent you and when; never your card number or details, your password, your trading account number or your trades). We do not use it to send you personalised advertising and we do not share it with third parties or with advertising platforms. It is seen only by the people who administer APEX, in an internal management tool that runs on the administrator’s own computer and downloads it from the site over an encrypted and authenticated connection; it keeps only the latest copy, which is replaced at every update.
• Basis: our legitimate interest in knowing which communication channels work. You can object by writing to soporte@somosapex.com from your account email: we delete this data from your account, do not store it again and, from that moment on, your account is left out of that internal tool, of the account count in section 2.14 and of the screen counters in section 2.15, and you stop receiving the emails about connecting your broker. It is kept while your account exists and is deleted with it, within the periods in section 7.

3. What we use it for

• Providing the service: creating and maintaining your account, calculating and displaying your metrics, saving your rules, your journal and your lists. Basis: performance of the contract.
• Managing the subscription: charges, renewals, cancellations and support. Basis: performance of the contract.
• Activate your Pro access if you buy through the App Store: confirm the status of your subscription with Apple and keep your access while it is active. Basis: performance of the contract.
• Sending the alerts you set up (price alerts) and operational communications about your account or the service. Basis: performance of the contract and your consent for notifications.
• Handling your inquiry: replying to the messages you send us through the contact form and following up on the conversation. Basis: your consent and, if you are already a customer, performance of the contract.
• Listening to your requests and suggestions from “We're listening”: reviewing them to improve APEX Flow and letting you know, by email or, if you chose it on the website, by WhatsApp, when we have reviewed them and when what you asked for is ready. Updates that come from a request carry the “Requested by the community” mark, without your name. Basis: our legitimate interest in improving the service with what you ask us for.
• Your application to APEX Academy: reviewing it, preparing and scheduling your interview, writing to you about it by email and WhatsApp, and learning through which channels people find us. Basis: the pre-contractual steps you ask us to take when you apply and your consent to be contacted, which you give by ticking the box in the form.
• Confirming your email when you sign up and stopping mass sign-ups. Basis: performance of the contract and legitimate interest in the security of the service.
• Security: preventing unauthorized access, abuse and fraud. Basis: legitimate interest.
• Helping you get started with your Pro: if you signed up for Pro (paid or with the free month, on the website or in the App Store) and have not yet connected your broker account, we email you at most twice in total, the first from 24 hours and the second from 3 days after your Pro starts, and never once two weeks have passed since it started, to remind you how to connect it. Basis: performance of the contract and our legitimate interest in you being able to use what you signed up for. If you do not want these emails, write to us at soporte@somosapex.com.
• Notices to help you make the most of your Pro: if you signed up for Pro (paid or with the free month, on the website or in the App Store), in addition to the notices about connecting your broker we email you at most once for each of these situations: (1) from the day after your trading account is first synchronised, once it has trades (never after two weeks), to show you where to start; (2) if 14 to 45 days go by without you signing in, with one concrete thing to see when you come back: your new trades, if there are any; how to connect your trading account, if you have not done so yet; or the market context, in this last case only in the 30 minutes before the New York Stock Exchange opens, on market days; and (3) if you cancel the free month on the website, to confirm until when you keep Pro and how to come back. To prepare them we use your first name, your language, the date of your last access, the type of Pro and its dates and, if you connected your trading account, the connection status, the name of the broker and the number of synchronised trades (all of them, or the new ones since your last access). We store with your account which notice we sent you, when and with what figure, and the date of the first synchronisation of your trading account; we see this in the internal tool in section 2.17, together with whether you signed in again afterwards. Like all our emails, they are sent by our email provider, which records their delivery, whether they are opened and which links are clicked (section 5); the internal panel does not use that data: whether you came back is measured by your last access. Basis: performance of the contract and legitimate interest for notice (1), and our legitimate interest in communicating with our customers for notices (2) and (3), which respect your opt-out from news and include the link to unsubscribe. For all of them, you can object by writing to soporte@somosapex.com from your account email.
• Preventing the free month from being repeated: if you use the free month of the monthly plan, storing irreversible fingerprints of your email, your card and your trading account (see section 2.16). Basis: legitimate interest in preventing fraud and abuse of the offer.
• Handling complaints and claims and preventing fraud after the account is closed: keeping your closed account for 60 days before deleting it. Basis: legitimate interest.
• Statistical analysis and service improvement: using pseudonymized metrics, without your name, your email or your account number (see “How to delete your account”). Basis: legitimate interest.
• Marketing analysis: knowing through which channels, campaigns, countries and cities accounts arrive and what they do next —the plan they choose, their charges and whether they connect their broker—, by combining the origin of your account with its data, including your name and your email, in an internal tool that only the people who administer APEX see (see section 2.17). That data stays within APEX: no personalised advertising and no sharing with third parties. Basis: legitimate interest. You can object by writing to soporte@somosapex.com from your account email.
• Knowing the reach and use of the website and of APEX Flow: knowing in aggregate which countries and cities the website is visited from and showing it on a map (see section 2.12), and which parts of the service and which videos are used, with daily counters that only the people who administer the site see, to plan our communication and our advertising (see section 2.15). Basis: our legitimate interest in knowing, in aggregate, the reach of our website and the use of our service. Since they are anonymous figures, they are always counted; for what is counted while you are signed in (the APEX Flow screens, section 2.15) you can object by writing to soporte@somosapex.com from your account email.
• Showing where the APEX community is: locating accounts, uses of APEX Flow from the browser and installations approximately, adding the places that the team adds by hand, and showing on a map, in aggregate, which countries and cities they are in (see sections 2.13 and 2.14). For accounts we use, in addition to its security purpose, the IP address of the last access recorded from the website (section 2.7), with the safeguards described in section 2.14. Basis: our legitimate interest in showing, in aggregate, the reach of the community. For your account, you can object by writing to soporte@somosapex.com from your account's email address (section 2.14); uses and installations are anonymous figures and are always counted, and if a published place could identify you, we remove it from the list (section 2.13).
• Marketing communications: sending you APEX news and offers by email and, if you gave us your number when paying, by WhatsApp. We only write to you if, when you gave us the data, you left the corresponding box checked (at checkout it comes checked and you can uncheck it; if you unsubscribed before, your choice is respected), and until you unsubscribe: using the link in every email, from My account or by replying BAJA or STOP on WhatsApp. If you change your mind, you can start receiving the news by email again from My account, on the website. Basis: our legitimate interest in communicating with our customers.
• News from “We're listening”: if you tick the news box when you send your request, we email you APEX news and offers until you unsubscribe, using the link in every email (if you unsubscribed before, your choice is respected). If you write without signing in, the box comes unchecked. If you write while signed in on the website, it shows your account's current choice (checked if your account has no preference yet), and what you choose updates your account's news preference: checked subscribes you; unchecked unsubscribes you. Your WhatsApp number, if you left it, is used to reply to you; to send you news by WhatsApp we wait for your “yes” in that conversation. Basis: your consent if you write without signing in; if you are already a customer, legitimate interest.
• Legal obligations that may apply. Basis: compliance with a legal obligation.

4. Your trading account data

This is the processing in the service that calls for the most care, which is why it is explained separately.

If you choose to connect your broker account, you do so through the technology provider's authorization procedure. You never give us your broker password: authorization is granted within the provider's environment and we only receive a revocable technical permission.

The permission is read-only. APEX Flow cannot open or close trades, modify orders, or move or withdraw funds. This limitation is enforced by the system itself; it does not rely on a promise.

With that permission, information about your activity is synchronized and stored: trades and orders (instrument, volume, entry and exit prices, stop loss, take profit, result, commissions and dates), changes in balance and capital, instruments traded, general account information and the evaluations of your rules.

For each account you connect, we store whether it is real or demo and its broker's name, to apply your plan's rules: with the Start plan, only demo accounts from brokers on the published list are analyzed. When someone connects an account from a broker we have not classified yet, we record only the broker's name, with no personal data, to review it. Accounts your plan does not include stay linked and paused: we do not sync their data while they remain so.

If you connect an Interactive Brokers (IBKR) account, you do it differently: you create a read-only query and token for the Flex service in your IBKR portal and enter them in APEX. With them we read your report when you connect the account and then once a day, and from it we keep your account number, your executions (instrument, quantity, price, date and time, order type, exchange, commissions and result), cash movements (deposits, withdrawals, dividends, interest and fees, with their description), position transfers if your query includes them, daily net asset value and its breakdown, open positions (with their cost, value and unrealized result) and base currency; we use them to calculate your analysis and the My trading simulations. Anything else your query returns is discarded without being stored. The Query ID and the token are stored encrypted on the APEX server. If you give us the token’s expiry date, we keep it to show you in My accounts how many days it has left. When you disconnect IBKR, the token and the Query ID are deleted; your IBKR history is kept until you delete it or delete your account and, on account closure, it is deleted in full, without being kept in pseudonymized form, at the end of the 60-day hold in section 7. You can restrict the token to the IP address of the APEX server from your IBKR portal.

That information is used exclusively to show you your own metrics, except for what is explained separately: the irreversible fingerprint of your trading account if you use the free month (section 2.16) and the name of your broker and whether the account is real or demo, which we also use for the APEX analysis described in section 2.17; and the name of your broker and the number of synchronised trades, which we use in the email notices in section 3. The detail of your trades, your balances and your account number are not used for that analysis or for those notices. It is not shared with other users, not published and not sold.

You can revoke the connection whenever you want, from the service or from your broker. Revoking it stops the synchronization of new data; if you also want the data already synchronized to be deleted, you can delete it yourself in My account, using the Delete my trading history option.

5. Who it is shared with

Only with the providers necessary for the service to work, and only with the data each one needs:

• Hosting and distribution network provider — storage of the website and the database.
• Card payment processor — processing of payments and card data: the full number and the security code do not pass through our systems. During payment, its anti-fraud service analyzes technical data from your device and browser to prevent fraud.
• Email provider (Brevo) — sending the service’s emails, for example to recover your password or to notify you of changes to your account, and marketing communications until you unsubscribe. For each email it records its delivery and, with a tiny image and with the email’s links, which go through its server, whether it is opened and which links are clicked. Of that data we use only overall figures —how many emails of each type are delivered, bounce or get clicks—, to know whether our emails arrive and are read; never per person, nor to profile you or for personalised advertising.
• Messaging (WhatsApp, by Meta) — sending marketing communications by WhatsApp, only if you left that box checked and until you unsubscribe; the messages about your application to APEX Academy; and the reply to your “We're listening” request if you choose to be answered by WhatsApp.
• Apple (App Store) — processes purchases and subscriptions made inside the app and tells us the status of each subscription, under its own privacy policy.
• Broker connectivity provider (cTrader / Spotware) — authorization and reading of your account data, only if you connect it.
• Interactive Brokers (IBKR) — if you connect your IBKR account, we read your reports with a read-only token from IBKR’s Flex service; you create the token and the query number (Query ID) in your IBKR portal.
• Market data provider — quotes and economic calendar. It does not receive any of your personal data.
• Discord — only if you link your account to access the community.
• Scheduling service (Calendly) — booking the APEX Academy interview: receives your name, your email and the time slot you choose.
• Video calls (Zoom) — the APEX Academy interview: receives the details you join with and, if you turn them on, your image and voice.
• Font service — may receive your IP address when the website loads.
• Video player (Vimeo) — only if you play a video; it may receive your IP address.
• Push notification services of your device or browser manufacturer, so that we can deliver the alerts you enable.

In addition, data may be disclosed to the competent authorities where there is a legal obligation to do so.

6. Where it is stored

The data is hosted on our providers' servers, which may be located outside your country of residence, including the European Union or other jurisdictions. In such cases, we require the provider to offer adequate protection safeguards in accordance with the applicable regulations.

7. How long it is kept

• Account data and your own content: for as long as your account remains active.
• After the account is deleted: your personal data is kept for 60 days to handle complaints or claims and to prevent fraud, and is then erased; metrics remain pseudonymized (see “How to delete your account”); backups are deleted periodically, although, as of the date of this version, some of them do not yet have a fixed deletion date. Only what must be kept due to a legal obligation is retained for longer, together with, with no time limit, the one-way hash of your contact details, to respect your unsubscribe choice (see “How to delete your account”).
• Free-month fingerprints: while we offer the free month and, if we stop offering it, until 3 years have passed since the date you used your free month; after that they are deleted. They are kept even if you delete your account, because their purpose is that the free month is not repeated (see section 2.16). Database backups may keep them for longer, only to restore the service after a failure.
• Payment records: the record of each payment is kept by the payment gateway or by Apple for the period required by tax and commercial law. In our systems it is deleted with your account, once the 60 days are over.
• Email and phone number for marketing communications: until you unsubscribe, even if you delete your account on the website (including the site installed on your device); if you delete it from the APEX Flow apps for iPhone and Android, you are removed from the list at that moment. After you unsubscribe, they are kept for 60 days and then only their hash remains. If you unchecked the box, they are deleted along with the rest of your data.
• Unused Start plan accounts: if a Start plan account goes 30 days without signing in, we stop syncing its demo accounts until you sign in again. What is already stored follows the periods in this section.
• Access and security logs: for the time necessary for their purpose of preventing abuse.
• Visits to the website: the record for each place is deleted about 20 days after the last visit from that place, unless the place is already on the community list (see below), and the published list of visits covers only those 20 days. The fingerprint used to stop automated submissions is usually deleted within two hours. Database backups may keep this data longer, only to restore the service after a failure.
• Openings of the Android app: the record for each place (country, city, day it joined the list and number of first openings) is kept with no automatic deletion period, because the list of places where the app is used is meant to stay. We can remove a place manually, for example if you ask us to. The fingerprint used to stop abuse is usually deleted within two hours, and database backups may keep this data longer, only to restore the service after a failure.
• Uses and installations of APEX Flow from the browser: the record for each place (country, city, day it joined the list, time of the last visit, number of installations and the type of contact the place came from) is kept with no automatic deletion period, because the community list of places is meant to stay; places that the team adds to the list by hand are kept until we remove them. We can remove a place manually, for example if you ask us to, as explained in section 2.13. Database backups may keep this data longer, only to restore the service after a failure.
• Aggregate statistics on reach and use: the daily detail by country and city (and by video) is kept for up to 13 months; after that it is added into a monthly total, which is kept with no automatic deletion period (see section 2.15). The counters of the APEX Flow screens, counted while signed in, are deleted after 13 months, with no monthly total. Database backups may keep this data longer, only to restore the service after a failure.
• Record of the email notices: which notice we sent you, when and with what figure, and the date of the first synchronisation of your trading account, while your account exists; they are deleted with it, at the end of the 60 days.
• Origin of your account and marketing analysis data: while your account exists; they are deleted with it, at the end of the 60 days (see section 2.17). The internal tool keeps only the latest copy, which is replaced at every update.
• Location of accounts: the number of accounts per place is recalculated about every six hours and is kept only in aggregate; an account whose deletion has been requested, or that is excluded, stops counting at the next recalculation. Places that joined the community list are kept with no automatic deletion period. We can remove one manually if you ask us to, as explained in section 2.14, which also says when it appears again. Whether each access was from the website or from an app is kept with the access log (see “Access and security logs”).
• Contact messages: for as long as the inquiry lasts and for a reasonable time afterwards, so that we can pick it up again if you write about the same matter. You can request their erasure.
• “We're listening” requests and suggestions: for as long as we need them to review them, let you know and track which version resolved them. You can ask us to delete them at any time by writing to soporte@somosapex.com: we delete your requests and, if your email or your WhatsApp number joined our news list from “We're listening”, we also remove them from the list. If you have an account and delete it, your requests are deleted with it, at the end of the 60 days. Your WhatsApp number, if it stayed on the news list, is kept until you unsubscribe or ask us to delete it.
• Applications to APEX Academy: while your application is in progress. If you enrol, they become part of your account. You can ask for them to be deleted at any time by writing to soporte@somosapex.com.

8. Your rights

You may exercise at any time the rights of access, rectification, erasure, objection, restriction and portability of your data, as well as withdraw any consent you have given, without affecting the lawfulness of prior processing.

To exercise them, write to soporte@somosapex.com from the email address associated with your account. We will respond within the period set by the applicable regulations.

If you reside in Brazil, the General Personal Data Protection Law (Law 13,709/2018, LGPD) also grants you, in its Article 18, the rights to confirmation that processing exists, access, correction, anonymization, blocking or deletion, portability, information about whom we share your data with, and revocation of consent. If you reside in the United Kingdom, these rights are granted to you by the UK GDPR.

If you believe your data has not been handled properly, you can lodge a complaint with the data protection authority of your country of residence: in the European Union and the European Economic Area, your country's supervisory authority; in the United Kingdom, the Information Commissioner’s Office (ICO); in Brazil, the National Data Protection Authority (ANPD).

9. How to delete your account

You can delete your account yourself, at any time and without writing to anyone: in My account, section Leave APEX, choose the option to delete your account and confirm it. The option is available on the website and in the apps.

When you delete it, your account is closed immediately: no one can sign in to it again, your device’s notifications are deleted at that moment, and the connection to your trading account is revoked on our servers as soon as our analytics server responds. To handle a possible complaint or claim and to prevent fraud, we keep your data for 60 days; after that, your user and your personal data are deleted—name, email, profile, rules, journal and notes, lists and alerts (except as indicated below about the marketing list). If something fails, the process is retried and, if it is not completed, we review it. Your trading and discipline metrics (trades already synchronized, statistics, check-ins and tags) are kept in pseudonymized form: without your name, your email, your account number or the exact date of deletion, under a random identifier, and are used only for statistical analysis and service improvement. So that the process can be retried if something fails, the system keeps a technical link between your account and that identifier for at most 5 days after the deletion, and then erases it. If another APEX account used the same trading account, that trading data is not changed. Messages you sent us through the platform are kept without your contact details; emails that reached our support inbox are kept for the time needed to reply to you and, if there was a claim, for as long as its legal deadlines last. Backups that still include you are used only to restore the service after a failure and are deleted periodically; as of the date of this version, some of those backups do not yet have a fixed deletion date. In addition, we keep whatever the law requires and a one-way hash of your email and, if you unsubscribed from our WhatsApp messages, of your phone number, so that we never write to you again by mistake. Deletion is irreversible.

The free-month fingerprints (section 2.16) are not deleted with the account: they are kept for the period in section 7, so that the free month cannot be repeated by deleting the account and creating another.

If you have a subscription purchased on this site, it is canceled automatically when you delete your account, and you will not be charged again.

If you have an Apple subscription, cancel it in Apple first (Settings → your name → Subscriptions): Apple keeps renewing it until you cancel it there.

If you are on our marketing list and you delete your account on the website, your email and, if you gave it when paying, your phone number remain on it until you unsubscribe: you can check the unsubscribe box on the deletion screen itself, and you can also unsubscribe using the link in every email or by replying BAJA or STOP on WhatsApp. If you delete your account from the APEX Flow apps for iPhone and Android, you are removed from the list at that moment.

10. Push notifications

Notifications are voluntary and require you to enable them and grant the corresponding permission on your device. In order to deliver them, a technical device identifier is recorded, which does not identify you on its own.

You can turn them off at any time from the service or from your device settings. Only alerts you have set up and operational communications from the service are sent: they are not used for advertising purposes.

11. Security

We apply reasonable technical and organizational measures to protect your data: encrypted connection, passwords stored using one-way hashing functions, access control to the systems and access logging.

No system is completely invulnerable. If a security breach affecting your data occurs, we will inform you and notify the authorities where the regulations so require.

12. Minors

The service is intended exclusively for people who are at least 18 years old. We do not knowingly collect data from minors. If we detect an account or an application belonging to a minor, it will be deleted.

13. Changes to this policy

This policy may be updated due to changes in the service or in the regulations. The version in force is always the one published here, with the date from which it applies, and it describes what the service does from that date. Material changes will also be notified by email to account holders.

14. Contact

For any questions about privacy or to exercise your rights: soporte@somosapex.com.

Version 2.7.10 · In force since October 23, 2026.
Previous version: 2.7.9, of October 17, 2026. You can request a copy at soporte@somosapex.com.

Related documents

• Legal Notice
• Terms and Conditions
• Cookie Policy