Privacy Policy

1. Data we collect

Data you provide:

• Account data: email address, username, password (stored only as a bcrypt hash), interface language.
• Trading data: trades, positions, accounts, notes, trading-system rules, ideas, watchlists and data you import (for example, MT5 reports or history sent by the read-only MT5 Expert Advisor).
• Exchange API keys: the key and secret you connect (the secret is stored encrypted).
• Communications: support requests and their content, the email address for replies, and information you provide in refund requests (including a wallet address and transaction ID).
• Telegram: your Telegram chat ID, if you link report delivery to Telegram.

Data collected automatically:

• Technical data: IP address, browser user agent, device and browser characteristics, date and time of requests, server logs.
• Anti-abuse identifier: a technical identifier derived at registration from your IP address and browser user agent, used to prevent multiple accounts from abusing the free quota.
• Usage data: the number and type of AI operations (Generations), plan and limit status, actions required for billing.
• Analytics data (only with your consent): pages visited, clicks, scrolling and other interactions, referring source, device type, approximate location derived by Google Analytics and Yandex Metrica, and session replays recorded by Yandex Metrica Session Replay (Webvisor) as described in section 5.

Data from third parties:

• Connected exchanges: trade history, positions and related account information retrieved with your read-only API keys.
• AxiomisPay payment service: invoice ID, amount, currency, network, payment status and transaction hash. We never receive your wallet private keys or seed phrases.
• Referral program: which referral link or code you used to register.

2. Purposes and legal bases

• Providing the Service — account, journal, statistics, imports, AI audits and reports, delivery to Telegram (performance of the contract).
• Processing payments, granting and extending Plans, handling refunds and payment issues (performance of the contract; legal obligations).
• Security and abuse prevention — protecting accounts, rate limiting, preventing multiple accounts and fraud (our legitimate interests).
• Customer support and service communications — receipts, plan expiry reminders, important notices (performance of the contract; legitimate interests).
• Analytics and improvement of the Service with Google Analytics and Yandex Metrica (your consent, which you may withdraw at any time).
• Compliance with law and protection of our rights — responding to lawful requests, resolving disputes (legal obligations; legitimate interests).

3. AI processing

To produce AI Output, the relevant trading data and your trading-system rules are transmitted to our AI model provider (Anthropic) via its commercial API. Under the provider’s commercial terms, data submitted via the API is not used to train its models. We send only the data needed for the specific analysis and never send your API secrets, password or payment data.

AI audits are automated assessments of your own trades against your own rules. They do not produce legal effects or similarly significant effects concerning you.

4. Cookies and similar technologies

Cookies are small text files stored by your browser. We use the following categories:

• Strictly necessary (always active): axiomis_token — authentication session, httpOnly, up to 24 hours; ax_consent — stores your cookie choice, 12 months.
• Functional: axiomis_locale — interface language, 12 months; ax_ref — referral code from the link you followed, 90 days. Local storage in your browser keeps interface preferences such as the selected trading account.
• Analytics (only with consent): Google Analytics cookies _ga and _ga_<ID> — distinguish visitors and sessions, up to 2 years; Yandex Metrica cookies _ym_uid, _ym_d (distinguish visitors, 1 year), _ym_isad, _ym_visorc and other _ym_* cookies (session and session replay, from 30 minutes to 2 days).

When you first visit the Service, a banner asks for your choice. Analytics cookies are not set and Google Analytics and Yandex Metrica are not loaded until you click “Accept all”. You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the site; on withdrawal we stop analytics and delete analytics cookies set for our domain. You can also block or delete cookies in your browser settings, but strictly necessary cookies are required for signing in.

5. Analytics services

With your consent we use Google Analytics 4, provided by Google, to understand how the Service is used in aggregated form. Google Analytics 4 does not log or store full IP addresses. We do not use Google Analytics data for advertising and do not combine it with the contents of your Account. Analytics data is retained for no longer than 14 months.

More information: Google’s explanation of how it uses data from sites that use its services (policies.google.com/technologies/partner-sites). You can also install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

With your consent we also use Yandex Metrica, provided by Yandex, to see which pages and elements people use: click and scroll maps, conversion funnels and session replay (Webvisor). Session replay records page layout, mouse movements, clicks and scrolling. The contents of input fields are not recorded, and areas with personal or financial information (exchange API keys, personal notes and journal entries) are hidden from recordings. We do not use Yandex Metrica data for advertising and do not combine it with the contents of your Account.

More information: the Yandex Metrica terms of use (yandex.com/legal/metrica_termsofuse). You can also block Yandex Metrica with the official opt-out browser add-on (yandex.com/support/metrica/general/opt-out.html).

6. Who we share data with

We share personal data only with recipients who need it to provide the Service, under confidentiality and data-protection obligations:

• Infrastructure and hosting providers — storage and operation of the Service.
• AI model provider (Anthropic) — generation of AI Output.
• Email delivery provider — verification emails, receipts and notifications.
• Telegram — report delivery, only if you link it.
• AxiomisPay payment service — creating invoices and accepting payments. Refunds are made by us manually.
• Google — Google Analytics (only with consent).
• Yandex — Yandex Metrica, including session replay (only with consent).
• Cryptocurrency exchanges — only the requests you initiate by connecting a read-only API key.

We may also disclose data where required by law or a binding request of a competent authority, to protect the rights, property or safety of Axiomis and users, or to a successor in the event of a reorganisation or transfer of the Service, provided that it continues to protect the data under this Policy.

If you create a public share link, the shared content is visible to anyone who has the link.

We do not sell personal data and do not share it for cross-context behavioural advertising.

7. International transfers

Our service providers may process data in different countries, including outside your country of residence. Where required, we rely on appropriate safeguards such as standard contractual clauses approved by the European Commission or equivalent mechanisms.

8. Data retention

• Account and trading data — while your Account exists; deleted within 30 days after your Account is deleted.
• Payment records — as long as necessary for accounting, dispute resolution and fraud prevention, but no longer than 5 years after the payment.
• Support requests — up to 2 years after the request is closed.
• Server logs and technical data — up to 90 days, unless needed longer to investigate a security incident.
• Anti-abuse identifier — while the associated Account exists.
• Analytics data — no longer than 14 months.

Backups are overwritten on a rolling basis and may retain deleted data for a limited time before it is permanently erased.

9. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS/TLS), encryption of exchange API secrets (AES-256-GCM) that are never displayed after saving, password storage only as bcrypt hashes, httpOnly session cookies inaccessible to scripts, access control and rate limiting. No method of transmission or storage is completely secure, but we work continuously to protect your data and will notify you of a personal data breach where required by law.

10. Your rights

Depending on your country of residence (including under the GDPR, the UK GDPR and the California Consumer Privacy Act), you may have the right to:

• access your personal data and receive a copy of it;
• correct inaccurate data;
• request deletion of your data;
• restrict or object to processing based on our legitimate interests;
• receive your data in a structured, machine-readable format (portability);
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a data protection supervisory authority.

To exercise your rights, send a request via the “Contact Support” form from the email linked to your Account. We may ask you to confirm your identity and will respond within 30 days. We will not discriminate against you for exercising your rights.

11. Children

The Service is intended only for persons aged 18 and over. We do not knowingly collect data of minors. If you believe a minor has provided us with data, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy. The current version is always available on this page with its last-updated date. We will notify you of material changes by email or in the Service.

13. Contact

For any questions about this Policy or your personal data, contact us via the “Contact Support” form available on the website and in your Account settings.