RegisterGo to the app

Privacy Policy

Effective Date: 1st of June 2026

Last Updated: 28th of October 2026

This Privacy Policy explains how Avex AI (“Avex”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you access or use our website, platform, applications, and related services (the “Platform”).

We are committed to handling personal data with care, transparency, and appropriate technical and organisational safeguards. We process personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (“EU GDPR”).

1. Who We Are

Avex AI is the controller of personal data processed in connection with the Platform, except where this Privacy Policy states otherwise.

Contact:
Avex AI
Email: privacy@avexai.io
Address: Avex Fintech SRL, Str. Dr. Petre Herescu 12, Bucharest, Romania

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Identity and Contact Data

  • name;
  • email address;
  • telephone number;
  • account login credentials and authentication information.

2.2 Profile and Onboarding Data

  • base currency and regional preferences;
  • wealth horizon inputs, targets, objectives, tolerances, convictions, exclusions, and settings;
  • notification preferences, billing status, and platform configuration choices.

2.3 Financial and Account Data

  • connected account metadata and sync information;
  • balances, holdings, positions, transactions, dividends, and cash data;
  • uploaded statements and imported files;
  • property, private investment, and portfolio-related information you choose to provide or connect.

2.4 Technical and Usage Data

  • IP address, browser type, operating system, device identifiers, and log data;
  • platform interactions, page views, feature usage, clickstream events, and session diagnostics;
  • security events, fraud prevention signals, and access logs.

IP addresses and device identifiers within this category are processed in connection with security, access, and diagnostic logging. They do not form part of the product usage analytics described in section 7, which is limited to the categories set out in that section.

2.5 Communications Data

  • messages, prompts, support requests, feedback, and correspondence with us;
  • chat interactions and platform-submitted queries.

2.6 Billing and Transaction Data

  • subscription plan information;
  • billing history and invoice data;
  • limited payment metadata supplied by our payment processor.

We do not store full card numbers. Payment card processing is handled by our third-party payment providers.

3. How We Collect Personal Data

We collect personal data:

  • directly from you when you register, subscribe, connect accounts, upload files, or contact us;
  • from third-party account aggregation and open banking providers where you authorise such access;
  • from your financial institutions, brokers, or data sources as enabled by your connection choices;
  • automatically through cookies, analytics, logs, and similar technologies; and
  • from service providers supporting billing, infrastructure, security, and customer communications.

4. How We Use Personal Data

We use personal data for the following purposes:

  • to create and administer your account;
  • to provide, operate, maintain, secure, and improve the Platform;
  • to ingest, structure, display, and analyse financial and account data;
  • to generate dashboards, reports, AI-assisted outputs, alerts, and scenario models;
  • to manage subscriptions, trials, billing, renewals, and invoices;
  • to communicate with you regarding service updates, security matters, and support;
  • to detect, prevent, investigate, and respond to fraud, abuse, and security incidents;
  • to comply with legal, regulatory, tax, and contractual obligations; and
  • to monitor performance, troubleshoot issues, and improve user experience.

5. Legal Bases for Processing

We process personal data on one or more of the following legal bases:

5.1 Contract

Processing is necessary to perform our contract with you, including to provide the Platform, manage your account, process subscriptions, and deliver requested functionality.

5.2 Legitimate Interests

Processing is necessary for our legitimate interests, including to operate and improve the Platform, maintain security, understand usage, prevent misuse, support users, and develop new features, provided those interests are not overridden by your rights and freedoms.

5.3 Consent

Where required by law, we rely on your consent, including in connection with certain cookies, certain marketing communications, and certain third-party data connections or permissions.

5.4 Legal Obligation

Processing is necessary to comply with our legal and regulatory obligations.

6. AI Processing and Pseudonymisation

Certain Platform features involve automated analytics and AI-assisted processing. In connection with such processing, we implement measures designed to reduce unnecessary exposure of directly identifying information.

Where reasonably practicable, data submitted to AI-enabled workflows may be pseudonymised, minimised, masked, or tokenised before further processing. This is consistent with the Platform’s intended privacy architecture and compliance posture.

However, no method of pseudonymisation or anonymisation is infallible, and you acknowledge that sophisticated data processing environments may still involve privacy risks. We therefore encourage you not to submit unnecessary sensitive or special category personal data unless specifically requested by the Platform.

7. Product Usage Analytics

We process limited information about how registered users interact with the Platform in order to evaluate feature adoption, identify usability issues, and improve the performance and reliability of our services. For this purpose we process the area of the Platform accessed, the interface element activated, the period for which a view remained open, the client and application version used, the country associated with the connection, and a session reference used to group activity within a single visit.

This processing is deliberately constrained. It does not involve uniform resource locators or query strings, text you enter, search terms, holdings, balances, transactions or any other financial information, IP addresses, or device identifiers. No information is stored in, or accessed from, your terminal equipment for this purpose: the session reference is held in volatile memory only and is discarded when the application is closed.

This information is associated with your account, so that we are able to distinguish the number of distinct users of a feature from the frequency of its use. Our legal basis is our legitimate interests in operating, securing, and improving the Platform under Article 6(1)(f) UK GDPR and, where applicable, EU GDPR; we have assessed that those interests are not overridden by the rights and freedoms of data subjects, given the limited and non-sensitive nature of the information concerned.

Event-level records are deleted after 90 days and aggregated daily statistics after 400 days. All records associated with your account are deleted when that account is deleted. You may object to this processing at any time under Article 21 by contacting privacy@avexai.io; doing so does not affect your access to the Platform, your subscription, or the availability of any feature.

8. Open Banking, Connected Accounts, and Imported Data

Where you choose to connect financial accounts, we may receive data through authorised account information or aggregation providers. Such access is generally read-only, consent-based, and may be revoked by you or expire in accordance with the relevant provider’s rules and applicable law.

We process connected account data solely for the purposes described in this Privacy Policy and do not use such access to initiate transactions or move funds.

9. File Uploads and Retention

If you upload statements, exports, PDFs, CSVs, spreadsheets, or similar documents, we may temporarily store and process those files to extract, map, and display relevant information within the Platform.

Unless otherwise stated or required for troubleshooting, audit, or security purposes, uploaded files are intended to be retained for a limited period and may be automatically purged after processing. The current product specification provides for a 24-hour upload retention window for certain imported files.

10. Data Sharing

We may share personal data with:

  • account aggregation, open banking, and financial connectivity providers;
  • cloud hosting, infrastructure, storage, and security providers;
  • payment processors and billing platforms;
  • analytics, communications, support, and email delivery providers;
  • professional advisers, auditors, insurers, and legal counsel; and
  • courts, regulators, law enforcement, or other authorities where required by law or to protect rights and safety.

Advertising partners: Google Ireland Limited and Meta Platforms Ireland Limited (see Advertising).

We do not sell your personal data.

11. International Transfers and Data Residency

Depending on the configuration of the Platform and your selected settings, your data may be processed in one or more regional environments. Current product architecture may allow users to select a preferred data residency region, including Zurich, New York City, or Dubai.

Where personal data is transferred outside the UK or EEA, we take steps intended to ensure appropriate safeguards are in place, which may include adequacy regulations, standard contractual clauses, or equivalent transfer mechanisms.

Google and Meta may transfer data to their US affiliates under the EU-US Data Privacy Framework and its UK Extension.

12. Data Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, disclosure, alteration, and destruction. Such measures may include:

  • encryption in transit and at rest;
  • access controls and authentication mechanisms;
  • role-based permissions;
  • monitoring, logging, and alerting;
  • secure infrastructure practices; and
  • vendor and environment controls.

While we seek to use commercially reasonable safeguards, no system can be guaranteed to be completely secure.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Platform, maintain records, resolve disputes, enforce agreements, and comply with legal, tax, accounting, and regulatory obligations.

Retention periods may vary depending on the category of data, the sensitivity of the information, the nature of the service relationship, and our legal obligations.

Specific retention periods apply in respect of product usage analytics (section 7) and uploaded files (section 9).

14. Your Data Protection Rights

Subject to applicable law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete personal data;
  • request erasure of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • request portability of certain personal data; and
  • withdraw consent where processing is based on consent.

We may need to verify your identity before acting on your request. Certain rights are subject to exemptions and limitations under applicable law.

In relation to product usage analytics, the right to object is addressed in section 7.

15. Account Deletion and Data Export

You may request deletion of your account or export of your data through the Platform or by contacting us. The product specification currently contemplates data export functionality and account deletion workflows, including a 30-day grace period in some cases before permanent deletion is completed.

We may retain limited information where necessary to comply with law, prevent fraud, resolve disputes, or enforce our rights.

16. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Platform, remember preferences, maintain sessions, measure usage, improve performance, and support analytics and security functions.

Where required by law, we will request your consent before placing non-essential cookies on your device.

With your consent, we also use marketing cookies (Google Ads tag, Meta Pixel). See Advertising.

17. Advertising

We advertise Avex on Google and Meta. If you accept marketing cookies, we use the Google Ads tag and the Meta Pixel, and send a hashed version of your email address to Google Ireland Limited and Meta Platforms Ireland Limited when you create an account, to measure which ads bring new users and to avoid showing ads to existing users. You can withdraw consent at any time in Cookie settings or in your account settings.

18. Children

The Platform is not directed to children, and we do not knowingly collect personal data from individuals under 18 years of age.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, including by posting the revised version on the Platform and updating the “Last Updated” date above.

20. Contact and Complaints

If you have questions, requests, or complaints regarding this Privacy Policy or our handling of personal data, please contact:

Avex AI
Email: privacy@avexai.io
Address: Avex Fintech SRL, Str. Dr. Petre Herescu 12, Bucharest, Romania

If you are not satisfied with our response, you may have the right to lodge a complaint with the Information Commissioner’s Office or your local supervisory authority.