Datenschutzerklärung / Privacy

Controller: Benjamin Hofmann, WashedBlackDryTrading Product & Software Engineering, Wilhelm-Backhaus-Str. 6a, 50931 Köln (GDPR Art. 4(7)).

Account data (email, name, auth provider id) is processed to provide the service (Art. 6(1)(b) GDPR). Positions, order logs, agent settings and EU AI Act records are stored per user to operate the desk.

Where it lives: account email, name, country attestation, employee settings, rails, logic, fills, the EU AI Act log, support notes, and any exchange API keys you paste are stored in our database in the European Union (Postgres, EU region). Your balances stay on the exchange you chose — Apex never holds or custodies crypto or cash; the balance shown on the desk is read from your exchange. We invoice only our subscription, extra-seat and volume-fee revenue.

Sign-in may use Google or X via the platform broker, or email/password stored in this app’s database. Optional Telegram, WhatsApp and exchange keys you enter are stored on your account so the agent can notify you and, if you enable Live, attempt venue orders. We do not take custody of your funds. You may delete keys by clearing the fields.

AI prompts sent to the worker model contain your book and public prices, not identity documents. Do not paste personal data into the desk.

We do not sell your personal data. We do not give it to third parties for their marketing or other commercial use. We share data only where necessary to provide the service you asked for (for example an exchange, payment or messaging provider you connect) or where the law requires it so we can comply and stay legal: courts, regulators, tax authorities and similar bodies, and only to the extent required.

Administrators of WashedBlackDryTrading (the owner seat and admins they appoint) may access account, desk, billing and crash data where necessary to operate the service, patch faults, block illegal use (AML, sanctions, fraud) and comply with law (Art. 6(1)(c) and 6(1)(f) GDPR). Anonymous worker fingerprints are not shown to other customers; they are visible to ops only. Legal holds and compliance logs may be retained after a block or erasure request where EU or national law requires it.

You may request access, rectification, erasure, restriction and portability (Art. 15–21 GDPR), and lodge a complaint with LDI NRW. Use Security → Your data on the desk, or see the GDPR page. EU AI Act records are kept for the service and issued as a file on request — they are not shown as a live feed on the desk. Worker logs may be used in anonymous fingerprint form to improve the product only if you tick consent. Extra workers are custom configurations you instruct; they are not a separate legal person.

Retention (engineering checklist, not certified counsel): account, desk, billing and AI Act decision rows are kept while the account is active. There is no automated “delete after N days” job in SQL yet — erasure is on request (desk → Security → Your data / gdprErase). Agent memory lessons (`apex_agent_memory`) are wiped on erasure. EU AI Act / compliance logs may be retained after erasure where Art. 17(3)(b) or other law requires a record. Ops access and legal holds are described above.

This notice is a product starting package, not a substitute for counsel.