RegisterGo to the app

GDPR & Data Rights Notice

Effective Date: 01 June 2026

Last Updated: 21 September 2026

This GDPR & Data Rights Notice summarises how Avex AI processes personal data in accordance with applicable data protection laws, including the UK GDPR and, where applicable, the EU GDPR.

1. Our Data Protection Approach

Avex AI is built around a privacy-conscious architecture intended to minimise unnecessary exposure of personal data, particularly in AI-enabled workflows and imported financial data environments.

Our approach includes, where appropriate:

  • data minimisation;
  • purpose limitation;
  • pseudonymisation and masking of identifying data;
  • role-based access controls;
  • regional data handling options; and
  • limited retention windows for certain imported files.

2. Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so, including:

  • performance of a contract with you;
  • our legitimate interests in operating, securing, and improving the Platform;
  • your consent, where required;
  • compliance with legal and regulatory obligations.

3. Open Banking and Consent-Based Access

Where you connect accounts using open banking or aggregation partners, data access is generally read-only, permissioned, and based on your explicit consent. Such consent may be revoked at any time through the relevant provider or, where available, through the Platform.

4. Pseudonymisation and AI Safety Controls

In line with the Platform’s intended design, directly identifying information may be pseudonymised before being submitted to certain AI or analytics processes.

This means personal data may be processed in a form that cannot be attributed to a specific person without the use of additional information held separately and subject to safeguards. While pseudonymisation reduces privacy risk, it does not render data fully anonymous.

5. Product Usage Analytics

We process limited information about how registered users interact with the Platform — the area accessed, the interface element activated, how long a view remained open, the client and application version, and the country associated with the connection — in order to evaluate feature adoption and improve our services. Our legal basis is legitimate interests under Article 6(1)(f). We do not process uniform resource locators, text entered by users, search terms, financial information, IP addresses, or device identifiers, and nothing is stored in or accessed from users’ terminal equipment for this purpose.

Event-level records are deleted after 90 days and aggregated statistics after 400 days; all records associated with an account are deleted when that account is deleted. Data subjects may object at any time under Article 21 by contacting privacy@avexai.io, without effect on access to the Platform or the availability of any feature. Section 7 of the Privacy Policy sets out this processing in full.

6. Data Residency

Subject to service availability and technical implementation, users may be offered a choice of regional data handling or storage environments, including Zurich, New York City, and Dubai.

Where cross-border transfers occur, we take steps intended to ensure they are made in accordance with applicable data protection law.

7. Your Rights

Under applicable data protection law, you may have the right to:

  • be informed about how your personal data is used;
  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of your personal data;
  • request restriction of processing;
  • object to certain forms of processing, including product usage analytics (see section 5);
  • request portability of data you have provided to us; and
  • withdraw consent where processing is based on consent.

8. Data Export and Erasure

Avex AI intends to provide users with access to data export functionality and account deletion controls in keeping with applicable privacy requirements. The current platform design contemplates rights of access and erasure, including a potential 30-day grace period prior to permanent deletion in certain cases.

9. Uploaded Files

Imported statements and similar documents may be retained only for a short processing window and may then be deleted automatically. Current product design provides for a 24-hour retention period for certain uploads.

10. Automated Processing

Avex AI uses automated systems and AI-assisted tools to generate informational outputs, scenario models, summaries, alerts, and analyses. These features support user interpretation and organisation of data, but do not constitute regulated advice or produce legally binding decisions.

We do not rely on solely automated decision-making to produce legal or similarly significant effects on users within the meaning of applicable data protection law, unless expressly stated and lawfully implemented.

11. Contact

To exercise your rights or ask questions about our data practices, contact:

Avex AI
Email: privacy@avexai.io
Address: Avex Fintech SRL, Str. Dr. Petre Herescu 12, Bucharest, Romania