Privacy Policy

Last updated: 8 October 2026 · Data controller: ApeX Altus, Thailand · support@apexaltus.com

What we collect when you buy

• Your email address and name, as entered at Stripe checkout — to send your license key and contact you about your order.
• Order details: plan, amount, currency, and Stripe reference numbers.
• Card details are handled by Stripe and never reach us. For trials we receive a card fingerprint from Stripe (not the card number) to allow one trial per card.

Your shop account

You can create an account on this site to see your licenses, send yourself a new key and manage a subscription. There is no password — you sign in with Google or with a one-time link we email you.

• Account record: your email address, the Stripe customer reference for your purchases, whether the account is active, and the dates it was created and last signed in.
• Sign-in link by email: we store a one-way hash of the link (the link itself exists only in your email), the email address it was sent to, and the IP address that asked for it. Each link works once and expires in 15 minutes. Recently issued links are also what we count to limit how often a link can be requested.
• Sign in with Google: we ask Google only for your email address, whether Google has verified it, and a permanent account identifier. We never receive your Google password or any other Google data. The identifier is stored so that you keep the same account if you later change your email address at Google.
• While you are signed in: a one-way hash of your session cookie, whether you signed in by email or with Google, and your browser's user-agent string (first 200 characters).
• Cloudflare Turnstile checks that the sign-in form is used by a person and not a bot.

What the Software sends when it checks the license

• Your MetaTrader account number, broker server name and account type (real or demo).
• The Software version and your license key (we store only a one-way hash of the key).
• A one-way hash of your computer's identifier (not the identifier itself).
• Your IP address, as seen by our server.

The license check does not send your balance, positions, orders or trading history to us. Features you connect yourself (for example Telegram) send data only to the service you set up, using your own settings.

How long we keep it

• License check records are deleted automatically after 90 days.
• Order and payment records: 5 years, as required by Thai accounting and tax law.
• The list of accounts linked to your key is kept while the license exists, so the account limit can be enforced.
• Sign-in links are deleted one day after they expire.
• Sign-in sessions are deleted when they expire (30 days) or as soon as you sign out.
• Your account record is kept until you ask us to delete it.

Who processes it for us

• Stripe — payments.
• Cloudflare — hosting of this site and the license server, the Turnstile bot check on the sign-in form, and Cloudflare Web Analytics (visitor statistics, described under "Cookies and this site").
• Google (Gmail) — sending your license email and your sign-in links.
• Google — only if you choose "Sign in with Google".

We do not sell your data or use it for advertising.

Your rights

Under Thailand's Personal Data Protection Act (PDPA) you can ask us to:

• see the personal data we hold about you, and get a copy of it;
• correct data that is wrong or out of date;
• delete your shop account and the data tied to it;
• object to, or ask us to stop, a particular use of your data;
• withdraw consent where we relied on it — this does not affect what was done before you withdrew it.

Email support@apexaltus.com from the address you used at checkout and we will answer within 30 days. Two limits apply: deleting license data ends the license, and we must keep order and payment records for the period set by tax law above. If you are not satisfied with our answer, you can complain to Thailand's Personal Data Protection Committee (PDPC).

Cookies and this site

This site uses cookies only to run the account area. It does not use tracking or advertising cookies, and it does not share cookie data with anyone.

• __Host-apx_sid — keeps you signed in for up to 30 days. It cannot be read by scripts (HttpOnly), is sent over HTTPS only, and is not sent from other sites. Signing out removes it and deletes the session on our server.
• __Secure-apx_oa_s and __Secure-apx_oa_v — set only while you sign in with Google and valid for 10 minutes. They protect that exchange from being tampered with.

Your language and currency choice is kept in your browser's own storage, not in a cookie, and never reaches our server.

To count visitors, public pages of this site and of apexaltus.com use Cloudflare Web Analytics. It sets no cookies and does not identify you or follow you across other sites. It records the page address, the referring site, and your browser, device type and country. It is not used on your account page, the order confirmation page or the sign-in link page.

Some guides on apexaltus.com include a YouTube video. Until you press play, the page shows only an image stored on our own site and nothing is loaded from YouTube. When you press play, the video loads from YouTube's privacy-enhanced domain (youtube-nocookie.com), and YouTube may then store data in your browser under its own privacy policy.