Privacy Notice

This Privacy Notice explains how KAPM Limited (“KAPM”, “we”, “us”) uses personal data in connection with the Dragon AI service. We are the controller of that data. Company number 07396679; registered office: [registered office address to be inserted once updated]. Contact: [email protected]. [ICO registration number: to be inserted; the data protection fee must be paid before the Service is offered.]

Account details: your name, email address and country of residence.

Agreement record: which version of the Terms, Important Notice and Privacy Notice you accepted, when, the IP address you accepted from, and your answers to the eligibility acknowledgements. We keep this to be able to show that you accepted before any Signal was delivered.

Billing details: your plan, billing dates, payment status and your customer reference at our payment provider. Your card details are collected and held by the payment provider, not by us.

Portal and sign-in records: your password (stored only as a salted hash, never in readable form), the securities you choose to follow, the times you sign in, your network address and browser type, and the state of your session. We use these to deliver the Service, to enforce the one-active-session rule, to detect misuse and to limit failed sign-in attempts.

Support: messages you send us.

Demo records: the email address a Demo was issued to (kept in a form that lets us refuse a second Demo), and when it started and ended.

Cookies: the Portal uses only essential cookies, to keep you signed in, to protect forms against forgery, and to remember your language. It uses no advertising cookies. The Portal is not indexed by search engines. [Website kapm.uk: describe any cookies or analytics actually used there. Do not publish until this is checked against the live site.]

We do not collect your broker login or credentials, your account numbers, positions, orders, transactions, balances or profit and loss. The Service installs no software on your computer and does not connect to your broker.

To provide the Service and manage your Subscription (performance of a contract).

To keep records the law requires, including for tax and accounting (legal obligation).

To keep the Service secure, prevent sharing of Signals or misuse, and establish or defend legal claims (our legitimate interests).

To send you service messages: demo, billing and renewal reminders, changes to the Service (contract and legitimate interests). We will send marketing only if you have agreed, and you can withdraw that at any time (consent).

We do not use your data for automated decisions that have legal or similarly significant effects on you.

Our payment provider, [Stripe], to take payment and issue receipts.

Service providers that host our systems and send email: [names to be inserted].

Our professional advisers, and public authorities where the law requires.

We do not sell your personal data and we do not share it with brokers or advertisers.

Some providers, including our payment provider, may process data outside the UK. Where they do, we rely on the UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. [To be confirmed per provider.]

Account and billing records: for the life of the Subscription and 6 years afterwards (tax and accounting records, and the limitation period for claims). [Accountant to confirm.]

Agreement records: 6 years after your Subscription ends.

Access logs: 90 days. Support messages: 2 years after the matter is closed. [Retention periods are proposals.]

You may ask us for a copy of your personal data, to correct it, to erase it (subject to records we must keep), to restrict or object to our use of it, and to receive it in a portable form. Write to [email protected]; we will respond within one month.

You may withdraw consent to marketing at any time.

You may complain to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to put things right first.

The Portal is served over an encrypted connection. Passwords are stored only as salted hashes, sessions expire, repeated failed sign-ins are limited, and our systems that publish Signals are separate from the Portal. No system can be completely secure; tell us at once if you think your login has been exposed.

The Service is for people aged 18 or over. We do not knowingly collect data from children.

We will tell you of material changes to this Notice by email before they take effect.