Privacy policy
Last updated 15 October 2026
This policy explains how fxapis, operated by El Wizard (business ID 207370523), Jacó, Puntarenas 61101, Costa Rica (“fxapis”, “we”, “us”), which is responsible for your personal data, handles it when you visit fxapis.com or docs.fxapis.com, contact us, create an account, or use the fxapis API and console (the “Service”).
Two roles. For your own account, billing and our websites, we decide how and why data is used — we are the controller. For data that you put into the Service about other people, such as the MT5 accounts and trading of your own customers, we act on your instructions as your processor; that is governed by our Data management terms, and your own privacy notice applies to those people.
1. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), role in your workspace, whether your email is verified, the workspace name. | You, when you sign up or are invited |
| Sign-in sessions | Session identifier, IP address, browser user agent, when the session started and was last used. | Your browser, when you sign in |
| API keys | Key name, scopes, environment, a short non-secret hint, when it was last used. The secret part is stored only as a one-way hash. | You, in the console or API |
| Connected MT5 accounts | Account number, broker server, label, connection state, account currency and settings reported by the broker. The account password, encrypted. | You or your systems, through the API |
| Trading activity | Orders and their outcomes, deals, positions, multi-account orders, broker return codes, and the timestamps of each. | Your instructions, and your broker's records |
| Usage and audit | Counts of API calls, orders and other metered actions; an audit log of significant actions (who did what, when, from which key or member). | Generated as you use the Service |
| Billing | Plan, invoices, amounts, payment status, the payment provider's references and the last digits and brand of a card if the provider returns them. We never receive full card numbers or wallet private keys. | You, and our payment providers |
| Enterprise enquiries | Name, work email, company, role, website, phone, what you are building, your message, time zone, the country your request came from, and a keyed hash of your IP address used only to detect abuse. | You, through the contact form |
| Correspondence | Emails you send us and our replies. | You |
| Connected apps | For each AI app you connect by signing in (for example Claude or ChatGPT): its name and web address, what you allowed it to do, the accounts and limits you chose, when you connected it and when it was last used. The app's requests are logged like any API call: the tool, the outcome and the time, never its arguments. | You, when you connect an app; the app, as it is used |
| Technical logs | IP address, request path and method, response status, timing, request identifier, and error details, kept briefly to operate and secure the Service. | Your browser or software, automatically |
We do not ask for, and ask you not to send us, special categories of personal data (such as health or biometric data) or government identity documents.
2. Why we use it, and on what basis
| Purpose | Legal basis (where GDPR or similar laws apply) |
|---|---|
| Providing the Service: accounts, sign-in, connecting MT5 accounts, transmitting orders, recording outcomes | Performance of our contract with you |
| Billing, invoicing and collecting payment; keeping financial records | Contract; legal obligation |
| Security: preventing fraud, abuse and unauthorised access; investigating incidents; rate limiting | Legitimate interests in protecting the Service, our customers and account holders |
| Support, and service emails such as security notices, invoices and changes to the Service | Contract; legitimate interests |
| Replying to Enterprise enquiries and following up on them | Legitimate interests in responding to requests you make; steps at your request before a contract |
| Improving the Service using aggregated, de-identified usage information | Legitimate interests |
| Complying with law, regulators, courts and lawful requests | Legal obligation |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not send marketing email without your consent. We do not sell or rent personal data, or share it for cross-context behavioural advertising.
3. Who we share it with
We share personal data only as needed to run the Service, with providers bound by contract to protect it:
| Recipient | Why | Where |
|---|---|---|
| Railway | Hosting our servers, databases and background workers | European Union (Netherlands) |
| Cloudflare | Domain name service, secure connections and protection of our websites and API from attacks | Global network |
| Resend | Sending service emails, such as notifications and replies | United States |
| ONVO | Processing card payments | Costa Rica |
| NOWPayments | Processing cryptocurrency payments | Outside the European Union |
| Your broker(s) | Logging in to the MT5 accounts you connect and transmitting your orders — necessarily including the account credentials and order details | Wherever your broker operates |
We may also disclose data to professional advisers under confidentiality, to a buyer or successor if our business is transferred (who must honour this policy), or where required by law or a valid order of a court or authority — in which case we disclose the minimum required and, where lawful, tell you first. The current list of providers is kept in our Data management terms.
AI apps you connect. When you connect an app such as Claude or ChatGPT, it receives the data its requests ask for, within what you allowed — that is the point of connecting it. Its provider handles that data under its own terms and privacy policy. You can revoke an app at any time on the API keys page; we then refuse its next request.
4. International transfers
Our servers and databases are hosted in the European Union. Some of the providers above process data in other countries. Where data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism, together with the safeguards described in our Data management terms.
5. How long we keep it
- Account and workspace data — while your account is open, then deleted within 30 days of closure, except as below.
- Broker passwords — until you disconnect the account or close your workspace, when they are erased immediately.
- Sign-in sessions — up to seven days from sign-in, ending sooner after a day unused, or until you sign out.
- Trading history, usage and audit logs — for the life of your workspace, because they are the record a dispute or audit is settled with; deleted within 30 days after the workspace is closed unless you ask us to keep or export them.
- Invoices and payment records — as long as tax and accounting law requires, typically up to 10 years.
- Enterprise enquiries — up to 24 months after our last contact, unless they lead to a contract.
- Technical logs — up to 30 days, longer only when needed to investigate a specific incident.
- Backups — overwritten on a rolling schedule; deleted data leaves backups as they expire.
Full detail is in our Data management terms.
6. How we protect it
All traffic to our websites and API is encrypted in transit. Broker passwords are encrypted individually with keys held outside the database; API keys and account passwords are stored only as one-way hashes. Workspaces are isolated from one another at every query. Internal services authenticate each other with mutual TLS. Staff access to customer data is limited, requires signing in, and is recorded in an audit log. We describe these measures in more detail in our Data management terms. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
7. Cookies and similar technologies
- fxapis.com sets a single strictly necessary cookie when you sign in, to keep you signed in. It is not used for tracking and is removed when you sign out or it expires.
- docs.fxapis.com sets no cookies. It remembers your light or dark theme in your browser's local storage, which never leaves your device.
- We use no advertising cookies, no third-party analytics, and no tracking pixels.
- Our card payment form is provided by our payment provider, which may set its own cookies needed to process the payment securely.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted, where we have no overriding legal reason to keep it;
- restrict or object to our use of it, including where we rely on legitimate interests;
- receive data you gave us in a portable, machine-readable form;
- withdraw consent, where we rely on consent, without affecting what was done before;
- not be discriminated against for exercising these rights.
To exercise them, email [email protected] from the address on your account. We may need to verify your identity, and we reply within 30 days (or sooner where the law requires). Much of your data can also be viewed and exported directly through the console and the API. If your request concerns data a customer of ours put into the Service about you, we will pass it to that customer and help them respond.
You also have the right to complain to your data protection authority — in Costa Rica, where we are established, the Agencia de Protección de Datos de los Habitantes (PRODHAB), under Law No. 8968 on the Protection of Persons in the Processing of their Personal Data; in the European Economic Area or the United Kingdom, the authority where you live or work. We would appreciate the chance to address your concern first.
9. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their personal data.
10. Changes to this policy
We will update this page when our practices change and change the date at the top. If a change materially affects how we use your personal data, we will tell you by email or in the console before it takes effect.
11. Contact
Questions or requests: [email protected]. Postal address: El Wizard, Jacó, Puntarenas 61101, Costa Rica.