Privacy
Last updated 19 September 2026
Who is responsible
The data controller is Octopod Holding AS, Strandgaten 205, 5004 Bergen, Norway, reachable at invest@apexgdi.com. We are a Norwegian company and follow the GDPR as implemented in the Norwegian Personal Data Act.
Why we process your data (legal basis)
| Purpose | Basis |
|---|---|
| Running your account and membership | Performance of a contract (GDPR art. 6(1)(b)) |
| Security: login attempts, rate limiting, access logs | Legitimate interest in keeping the service secure (art. 6(1)(f)) |
| Account emails (invitations, approvals, resets, expiry notices) | Performance of a contract |
| Payment records (when enabled) | Contract, and legal obligations under Norwegian bookkeeping law |
What we store, and for how long
| Data | Retention |
|---|---|
| Email, password hash (salted, PBKDF2), plan, last login, plan-change history | Until you delete the account |
| Login events with IP address | IP address anonymised after 14 days; the event kept without it |
| Web-server access logs (IP, page, time, browser) | Rotated daily, deleted after 14 days |
| Email delivery log (address, subject, delivered or not) | Address anonymised after 90 days |
| Visitor counts | Aggregated per day; addresses hashed in memory and never stored with the counts |
| Payment references (when enabled) | 5 years, as Norwegian bookkeeping law requires; never card numbers, which we do not see |
Who processes data on our behalf
| Processor | What for · where |
|---|---|
| DigitalOcean, LLC | Hosting of the application and its data · New York, USA |
| Resend, Inc. | Delivery of account emails · USA / EU |
| Porkbun, LLC | Domain registration and forwarding of invest@apexgdi.com · USA |
| Revolut Bank UAB (when card payments are enabled) | Card payments and subscriptions · Lithuania / EU |
Transfers outside the EEA
Hosting and email delivery take place in the United States. These transfers rest on the European Commission’s standard contractual clauses in our processors’ data-processing agreements and, where the processor is certified, on the EU–US Data Privacy Framework. We do not transfer data to any other country.
What we do not do
No advertising trackers, no third-party analytics scripts, no selling or sharing of data, no marketing email unless you ask for it, no profiling. One cookie, set when you log in, identifies your session; nothing else is set.
Your rights
You can ask to see, correct, export or delete what we hold about you, or object to processing based on legitimate interest, by writing to invest@apexgdi.com from your account address. We answer within 30 days. Deleting the account removes the record; logs expire on the schedule above. If you believe we handle your data wrongly you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).
Changes
We update this page when the processing changes and note the date at the top. Material changes are announced by email to account holders.