Privacy Policy

MMK ENTERPRISES ("we", "us", "our") is the data controller responsible for your personal data processed through Logvexa (the "Service"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data in compliance with the General Data Protection Regulation (GDPR, Regulation 2016/679) and the Dutch Implementation Act (UAVG).

Data Controller: MMK ENTERPRISES

Address: Prins Hendrikweg 35, the Netherlands

KvK number: 42088884

Contact email: privacy@logvexa.com

This Privacy Policy applies to all users of Logvexa, including visitors to our website and registered users of the Service.

We collect the following categories of personal data:

We process your personal data on the following legal bases:

• <strong>Contract performance (Art. 6(1)(b))</strong> — to provide the Service you signed up for, including account management, trade journaling, broker sync, and analytics
• <strong>Legitimate interests (Art. 6(1)(f))</strong> — to improve and secure the Service, prevent fraud, and ensure platform integrity
• <strong>Legal obligation (Art. 6(1)(c))</strong> — to comply with applicable laws, including tax and accounting retention requirements
• <strong>Consent (Art. 6(1)(a))</strong> — where you have given explicit consent (e.g., for optional data processing), which you may withdraw at any time without affecting prior processing

For special categories of personal data (Art. 9 GDPR), such as data revealing your trading behaviour or emotional state, we process these based on your explicit consent or the performance of the contract, as you voluntarily provide this data for your own journaling purposes.

We use your personal data to:

• Provide, operate, and maintain the Logvexa platform
• Sync your trade data from connected broker accounts (read-only)
• Generate analytics, reports, scores, and AI-assisted insights based on your input data
• Process subscription payments and manage your account
• Send you service-related communications (account, billing, security, and policy updates)
• Respond to your support requests
• Detect, prevent, and address fraud, abuse, and security issues
• Comply with legal obligations

We do not use your personal data for profiling that produces legal or similarly significant effects. We do not sell your personal data to third parties.

Given the sensitive nature of broker API credentials, we apply additional safeguards:

• Credentials are encrypted at rest using AES-256 encryption
• Access to credentials is restricted to the backend systems necessary for sync functionality
• Credentials are used solely for read-only data import — never for placing trades or moving funds
• Credentials are deleted when you disconnect a broker within Logvexa
• We conduct periodic reviews of our broker integration security

You are responsible for using read-only API keys where available and for revoking access in your broker settings when you no longer wish to use the sync feature.

We do not sell your personal data. We share personal data only with the following categories of recipients, under appropriate data processing agreements where required:

• <strong>Cloud hosting and infrastructure providers</strong> — the platform infrastructure that hosts and processes your data (located within the EEA where possible)
• <strong>Broker API providers</strong> — only the data necessary to establish and maintain your read-only connection
• <strong>Stripe</strong> — our payment processor for subscription billing
• <strong>AI/LLM service providers</strong> — used to generate optional insights, reviews, and reports based on your data, under data processing agreements
• <strong>Authorities</strong> — where required by law, court order, or to protect our legal rights

A current list of sub-processors is available upon request. We will notify you in advance of any new sub-processor that processes your data, giving you the opportunity to object.

Your data is stored and processed primarily within the European Economic Area (EEA). Where personal data is transferred outside the EEA (for example, to a cloud provider or AI service located outside the EEA), we ensure that appropriate safeguards are in place in accordance with GDPR requirements, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Additional measures where required to ensure a level of protection essentially equivalent to that within the EEA

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• <strong>Active accounts:</strong> Your data is retained for as long as your account is active
• <strong>After account deletion:</strong> We delete your personal data within <strong>30 days</strong> of account deletion, except where we are required to retain it for legal, tax, or accounting purposes
• <strong>Broker credentials:</strong> Deleted immediately when you disconnect a broker or delete your account
• <strong>Support messages:</strong> Retained for up to 12 months after resolution, then deleted
• <strong>Billing records:</strong> Retained as required by applicable tax and accounting law (typically 7 years)

When data is no longer needed, it is securely deleted or anonymized.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data transmission
• Encryption at rest (AES-256) for sensitive credentials such as broker tokens and API keys
• Row-level security (RLS) to ensure users can only access their own data
• Strict access controls and authentication for internal systems
• Regular security reviews and monitoring
• Separation of duties and least-privilege access principles

Despite these measures, no system can be guaranteed to be completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals as required by GDPR Articles 33 and 34.

As a data subject under the GDPR, you have the following rights regarding your personal data:

• <strong>Right of access (Art. 15)</strong> — request a copy of the personal data we hold about you
• <strong>Right to rectification (Art. 16)</strong> — request correction of inaccurate or incomplete data
• <strong>Right to erasure (Art. 17)</strong> — request deletion of your personal data ("right to be forgotten")
• <strong>Right to restriction (Art. 18)</strong> — request that we limit processing of your data in certain circumstances
• <strong>Right to data portability (Art. 20)</strong> — receive your data in a structured, machine-readable format and transmit it to another service
• <strong>Right to object (Art. 21)</strong> — object to processing based on legitimate interests or for direct marketing
• <strong>Right to withdraw consent (Art. 7)</strong> — withdraw consent at any time without affecting the lawfulness of prior processing
• <strong>Right to lodge a complaint (Art. 77)</strong> — lodge a complaint with the supervisory authority

To exercise any of these rights, contact us at privacy@logvexa.com. We will respond within one month of receiving your request. If we cannot fulfil your request, we will explain why.

To protect your security, we may ask you to verify your identity before responding to a request.

Logvexa uses AI and LLM (Large Language Model) technology to generate optional insights, trade reviews, and reports based on your input data. These outputs are:

• Generated from your own data and input
• For informational and educational purposes only
• Not used for automated decisions that produce legal or similarly significant effects about you
• Not a substitute for professional advice

You are not subject to solely automated decision-making that produces legal or similarly significant effects (GDPR Article 22).

Logvexa is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected personal data from a minor, please contact us at privacy@logvexa.com and we will promptly delete it.

We do not use cookies, tracking pixels, or similar tracking technologies on Logvexa. We do not use third-party analytics cookies, advertising cookies, or social media tracking. The Service functions without any tracking technologies that would require a cookie banner or consent under the ePrivacy Directive.

Essential session functionality is handled through standard browser mechanisms that do not require consent under applicable law.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or the Service. We will notify you of significant changes via email or in-app notification at least 30 days before they take effect. The "Effective date" at the top of this page indicates when the policy was last updated.

For privacy-related questions, requests to exercise your rights, or any other privacy concern, contact us at:

MMK ENTERPRISES
Prins Hendrikweg 35, the Netherlands
Email: privacy@logvexa.com

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your personal data in accordance with the law:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
Website: autoriteitpersoonsgegevens.nl

You can also contact us through the contact us page.