Privacy and Cookie Policy
Version 2026-10-13 · effective 2026-10-13 for new customers, 2026-11-12 for existing customers
MetaTrader API is a product of Apex Vanguard Dynamics LLC ("we", "us"). This policy explains what personal data we process when you visit our website, use the dashboard or call the API, why, with whom we share it, how long we keep it and what your rights are. The Service is offered to businesses only; this policy covers the people who act for them.
1. Controller and contact
The controller is Apex Vanguard Dynamics LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Our data protection contact is Robin Jones: write to support@metatraderapi.net with the subject "Privacy", or call +1 (929) 333-6422. When we process data on your behalf (for example the trading data of the MetaTrader accounts you connect), you are the controller and we are your processor under our Data Processing Agreement (https://www.metatraderapi.net/en/dpa/).
2. What we process
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Account: name, email, password (stored only as a salted scrypt hash), optional two-factor secret (encrypted) | Create and secure your account | Contract (Art. 6(1)(b)) | While your account exists; deleted when you ask us to close it |
| Billing: Stripe customer and subscription identifiers, invoices | Charge for seats, accounting | Contract; legal obligation (Art. 6(1)(c)) | As required by tax law |
| Connected MetaTrader accounts: login, server, password (encrypted with AES-256-GCM), and the trading data that passes through the API | Connect the accounts you add and deliver API responses | Contract; processed on your behalf under the DPA | While the account is connected; deleted 7 days after its seat is removed |
| Sign-up answers: how you found us, what you are building, the terms version you accepted and when | Product and marketing decisions; proof of acceptance | Legitimate interest (Art. 6(1)(f)); contract | While your account exists |
| Sign-in and security data: IP address, country derived from it, network operator, browser and operating system, time zone, language, screen size, cookie-banner choice | Account security, fraud prevention, support (e.g. your local time) | Legitimate interest (Art. 6(1)(f)) | 13 months after last seen |
| Dashboard usage: which pages of the dashboard you open, which buttons and links you click (by their label), the broker-server names you search for, the documentation endpoints you try and, for links, the page they lead to, with the time. Nothing else you type into fields (never passwords, logins or keys) and never the content of your API requests | Understand what customers need, improve the dashboard and the product, give better and faster support | Legitimate interest (Art. 6(1)(f)); you can object at any time by writing to us | 13 months |
| Website pages you read, linked to your account — only if you accepted cookies on our website | The same: understand your interests and support you better | Consent (Art. 6(1)(a)) — withdraw it any time with the cookie banner; withdrawal stops further linking (to have past visits removed, write to us) | 13 months |
| Telegram username, if you enter it | So support can reach you on Telegram | Consent (Art. 6(1)(a)) — remove it any time in Settings | Until you remove it or close the account |
| Support conversations (chat, email, Telegram) | Answer your questions, keep a history | Contract; legitimate interest | While your account exists; deleted on request |
| Server access logs: IP address, time, requested URL, user agent | Security and troubleshooting | Legitimate interest | 7 days |
| Developer and AI-agent documentation fetches (llms.txt, /docs/*.md, openapi.json): time, page, user agent, referring site and a pseudonymised (hashed) IP address with its country and network; matched to your account only if you are signed in to the dashboard from the same address | See which documentation developers and their coding agents use, improve it and support you better | Legitimate interest (Art. 6(1)(f)); you can object at any time by writing to us | 13 months |
| API usage totals: number of requests and connected minutes per day | Billing, capacity planning, abuse prevention | Contract; legitimate interest | While your account exists |
| Newsletter and lifecycle emails: address, sends, opens and clicks | Product news and onboarding help; you can unsubscribe in every email | Legitimate interest (existing customers, Art. 6(1)(f)); consent for newsletter-only subscribers | Until you unsubscribe or close the account |
We do not read or analyze what your software does through the API (the content of your requests). We do not sell personal data and we do not make automated decisions with legal effect about you.
3. Cookies and similar technologies
- Essential: the dashboard session cookie, and a record of your cookie-banner choice. Always on.
- Our own analytics without consent: anonymous page views (page, referring site, country, device type). No cookie and no identifier is stored on your device.
- With your consent only: a first-party visitor cookie ("mtv", 12 months) that links your first visit to a later sign-up.
- Google Analytics and Google Ads (conversion measurement): the Google tag loads on every page with Google Consent Mode set to "denied". Until you accept, Google sets no cookies and receives only cookieless signals; after you accept, Google cookies are used for measurement. You can change your choice at any time via the cookie banner.
4. Who receives data (subprocessors)
We share personal data only with service providers that process it for us under contract, and only as far as needed:
| Provider | Purpose | Location |
|---|---|---|
| Cloud hosting providers (names on request) | Servers for the website, dashboard, API and MetaTrader connections; encrypted database backups | EU (Finland, Germany); private-hosting seats: the region you choose (for example the USA) |
| Cloudflare, Inc. | DNS, TLS termination, DDoS protection and content delivery for all our domains | Global edge network; USA |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments and invoicing (your billing contact only) | Ireland; USA |
| Proton AG | Receiving and storing email sent to us | Switzerland |
| Email sending infrastructure (our own mail server, hosted by a cloud provider) | Sending account and product emails | United Kingdom |
| Telegram FZ-LLC | Delivering support chat messages to our support team (only what you write to support) | Global |
| Google Ireland Ltd. / Google LLC | Website analytics and ad conversion measurement, only with consent (Privacy Policy section 3); receives no data we process on your behalf | Ireland; USA |
The same list, with transfer safeguards, is Annex 3 of our Data Processing Agreement (https://www.metatraderapi.net/en/dpa/). The full legal name of every subprocessor is available to customers on request. We announce new subprocessors in advance as described in our Data Processing Agreement. Authorities receive data only where the law requires it.
5. International transfers
Our company is based in the USA and some providers above process data outside the EEA. Where a provider is in a country without an EU adequacy decision, the transfer relies on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as applicable. Our servers that store your account and connection data are in the EU. If you choose private hosting in a region outside the EU (for example the USA), the MetaTrader connections of those seats, and the trading data passing through them, are processed in that region.
6. Security
All connections use TLS. Broker passwords and two-factor secrets are encrypted at rest; account passwords are stored only as salted hashes. Administrative access to our servers is only possible over a private network with individual keys. Database backups are encrypted. More detail: https://www.metatraderapi.net/en/trust/.
7. Your rights
You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy in a portable format. Where processing is based on consent, you can withdraw it at any time. Write to support@metatraderapi.net; we answer within one month. You can also complain to a data-protection supervisory authority, for example in the EU country where you live or work.
8. Minors
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from minors.
9. Changes
We version this policy; the date at the top shows the current version. Material changes are announced in the dashboard or by email.
10. Contact
Questions about privacy or this policy:
Apex Vanguard Dynamics LLC (Wyoming Filing ID 2025-001713271)
30 N Gould St Ste R
Sheridan, WY 82801
Email: support@metatraderapi.net
Phone: +1 (929) 333-6422