Data controller
Apex Quantum AS, Norwegian org. no. 921 269 692, Norway, is the data controller for personal data collected through apex-quantum.com and its dashboard. Reach us at post@apex-quantum.com.
Information we collect
Account: name, email and authentication via Clerk. Risk attestations and purchase consents: the timestamp and version of the risk confirmations and the withdrawal consent you give are stored on your Clerk user profile and in a consent log in our database, as documentation that the information was provided. Waitlist: if you join the Plus waitlist we store your email address and confirmation time (double opt-in). Plus subscription: subscription status, Stripe customer ID and period end stored as user metadata; at checkout Stripe collects a billing address and, where applicable, a business or VAT number on our behalf. Journal: the ticker, action, thesis, outcome and notes you write in the investment journal are stored in our database (Supabase), not only in your browser. These are free-text fields, so avoid entering health data or other special categories. Max: your Alpaca API keys are stored encrypted (AES-256-GCM), and we additionally store the Alpaca account number, account status and starting balance at connection, along with the engine’s trading decisions, rationales and order outcomes tied to your account, as documentation of the service. Email: as a Plus subscriber you receive the daily morning brief at your registered address; delivery is handled by Resend, and every email carries a one-click unsubscribe. Usage: AI prompts you send, tickers you mark as owned (stored locally in your browser), and technical logs (IP, browser, timestamp) to prevent abuse and diagnose errors.
Legal basis
Processing is based on the agreement between you and Apex Quantum AS (GDPR Art. 6(1)(b)) and our legitimate interest in securing, operating and improving the service (Art. 6(1)(f)), which covers security logging and site analytics. The daily morning brief is sent as part of the Plus subscription you ordered (Art. 6(1)(b)) and can be cancelled at any time. Pure marketing is sent only on consent (Art. 6(1)(a)). Accounting records are kept under legal obligation (Art. 6(1)(c)).
Analytics and performance measurement
We use Vercel Web Analytics and Vercel Speed Insights on every page, including for visitors who are not signed in. Both are cookieless and set no cookies in your browser. Web Analytics counts page views and unique visits using an anonymous value derived from the request (including IP address and user agent) that is rotated daily; the IP address itself is not stored. Speed Insights collects performance metrics such as load time, responsiveness and layout stability, together with the page path, coarse device and browser type, and country. We cannot identify you personally from this data, and it is not used for advertising or profiling. The legal basis is legitimate interest (Art. 6(1)(f)), and you may object under Art. 21 by contacting us. The processor is Vercel Inc. (US).
Retention
Account data is retained while your account is active and deleted no later than 12 months after termination. If you request deletion, we delete account data, journal entries, the consent log and the trading log tied to you and confirm within 30 days. You can delete journal entries yourself in the dashboard at any time. Alpaca keys, account number and starting balance are deleted when you disconnect the broker account. Billing records are kept for the 5 years required by Norwegian accounting law. Waitlist emails are kept until the launch notification has been sent or you request deletion. Technical logs are deleted after 90 days unless tied to a security incident; the logs reside with Vercel, and actual retention there follows the provider settings for the project. Analytics and Speed Insights data is retained by Vercel in aggregate form only. We do not permanently store AI prompts; xAI may retain them per their own privacy policy.
Published recommendations are not personal data
The published signals and morning briefs (with timestamps, price at publication and basis) are general investment recommendations under the EU Market Abuse Regulation (MAR). They contain no personal data and are documentation we must be able to produce for supervisors: they are therefore retained for at least 5 years (COMPLIANCE_RETENTION_YEARS) and are not covered by account deletion. Deleting your account never touches this archive — and the archive never contains anything about you.
Data processors
We use the following processors: Clerk (authentication and user profile, US), Supabase (database, EU region), Vercel (hosting, technical logs and site analytics, Vercel Inc., US), Resend (email delivery, Resend Inc., US), Stripe (payments, EU/Ireland, and an independent controller for card data), xAI (the Grok AI model for signals and analysis, US) and Alpaca (broker API for Max, US). We require a data processing agreement with everyone who processes personal data on our behalf and rely on each provider’s standard processing terms. The work of obtaining, signing and archiving those agreements is not complete for all providers; the status per provider is available on request to post@apex-quantum.com. We never receive card information — Stripe handles all payments directly.
Transfers outside the EEA
Several of our processors are US-based (Clerk, Vercel, Resend, xAI and Alpaca), and Stripe’s parent company is American. For providers certified under the EU-US Data Privacy Framework, transfers rely on that framework; for the others we rely on the EU Standard Contractual Clauses (SCCs) in the provider’s processing terms. We verify certification status per provider and can state the current status on request. Alpaca is an SEC-regulated broker, and the Data Privacy Framework is limited to organisations under the jurisdiction of the FTC or the US Department of Transportation. We therefore proceed on the basis that transfers to Alpaca are necessary to perform the Max agreement you requested yourself (Art. 49(1)(b)), in addition to Standard Contractual Clauses where Alpaca offers them. If you do not connect an Alpaca account, no data is transferred to Alpaca.
Your rights
You have the right to access, rectify, delete, port and restrict processing of your data. You may object to processing based on legitimate interest, such as site analytics (Art. 21), and withdraw consent at any time. You may also lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no). Send requests to post@apex-quantum.com; we respond within 30 days.
Security
Sensitive data is encrypted at rest (AES-256-GCM for Alpaca keys) and in transit (TLS 1.3). We never receive customer funds. Trading happens directly on your own broker account, and payments are processed by Stripe. Stripe webhook signatures are cryptographically verified.
Use of AI
Apex Quantum + uses xAI Grok to generate signals and answer questions about stocks. Your prompts are sent to xAI for processing. We do not send identifying customer data to xAI beyond the prompt itself and a ticker symbol. You are always informed when you are interacting with AI.