Monflex Privacy Policy

Effective Date: 10 November 2026

This Privacy Policy explains what personal data Monflex™ (“Monflex,” “we,” “us,” or “our”) collects, how we collect and use that information, and to whom we disclose it. This Privacy Policy applies to information we collect from visitors to our website monflex.io and any related webpages or websites (the “Site”), and users of our mobile application and any other platforms, technologies, products, web applications, and on- and off-line services we offer (collectively with the Site, the “Services”). Your use of the Services is subject to our Terms of Use.

Who we are. The Services are operated by Monflex Operations Ltd., a company incorporated in Cyprus (registration number HE 499014) (“Monflex Operations”), which is the controller of personal data processed through the Services. Investment advisory services are provided by Monflex Technology Corp., an investment adviser registered with the U.S. Securities and Exchange Commission (“Monflex Advisers”). Monflex Advisers is a separate controller of records relating to its advisory services and related payments, as described in its GLBA Privacy Notice, and Monflex Operations processes those records on behalf of Monflex Advisers. Fees for advisory services may be charged by Monflex Advisers or collected on its behalf by Monflex Operations, including through the Apple App Store and Google Play; the entity charging you is shown at checkout. References to “Monflex,” “we,” “us,” or “our” mean Monflex Operations and Monflex Advisers, as applicable.

This Privacy Policy does not apply to third-party websites, applications, products, services, or other properties, even if our Services link to them or vice versa. We recommend that you review the privacy practices of those third parties before sharing personal data with them. This Privacy Policy also does not apply to personal data that is already subject to certain state and federal privacy laws, including the Gramm-Leach-Bliley Act (GLBA). For information about our data practices under the GLBA, please refer to our GLBA Privacy Notice. Any overlapping coverage of information in this Privacy Policy is incidental and provided to enhance your understanding of our data collection and use practices, and should not be construed as an acknowledgment of the applicability or inapplicability of certain privacy laws.

Please note that we are providing the following disclosures and rights in this Privacy Policy in the interest of transparency and in furtherance of our privacy commitment to you. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

Table of Contents

* * *

1. Sources of Personal Data

As used in this Privacy Policy, “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual and includes “personal information” and “personally identifiable information” as those terms are defined in privacy laws. Personal data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified or anonymized; or aggregate information.

Please note that we may create aggregated, de-identified, or anonymized information from data by removing certain data components that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, aggregated, de-identified, or anonymized information is not personal data, and our use and disclosure of such information is not subject to this Privacy Policy.

We may collect personal data about you from the following sources:

• Directly from you. We may collect personal data you provide to us directly, such as when you register for our Services, use our Services, contact us, or otherwise interact with us.
• Data collected automatically and through tracking technologies. Our Services may use cookies and similar technologies such as web beacons, embedded scripts, and tags (collectively, “Cookies”), including session replay tools that record your interactions with our website.
• Third-Party Advertising Platforms and Analytics Providers. We may collect information from third-party platform providers, including advertising, social media, and analytics companies, who assist us in serving advertising regarding the Services to others who may be interested. For example, if you visit the Services while logged into social media or other third-party platform accounts, the platforms may collect information about your interactions with the Services, such as browser/device data and usage data, including through Cookies on our Services. We may also partner with third parties who use Cookies to serve interest-based advertising and content on their respective third-party platforms that may be based on your preferences, location, and/or interests. In this Privacy Policy, we refer to these third parties as “Third-Party Advertising Platforms and Analytics Providers.”
• Service providers. We collect personal data from our service providers, including those providing hosting, payment, analytics, advertising, customer and technical support, email services, and other services.
• Through AI features we offer. We may also collect personal data through your use of artificial intelligence features we offer (“AI Features”), which explain trade setups generated by our automated bots, summarize news, and power AI Mentor. For example, our AI Features may use information from your investment profile, such as your trading experience, to tailor explanations of trade setups, and when you chat with an AI Mentor, we collect and store the messages you send and the responses you receive. We may use third-party providers in connection with the AI Features that we offer, as discussed in more detail in Section 4 (“Disclosure of Personal Data”).
• Your brokerage. When you connect your brokerage account, we receive information from your broker-dealer, such as your account balance, buying power, positions, and order status.

We may combine the personal data we receive from third parties with personal data we otherwise collect about you through your use of our Services.

2. Personal Data We Collect

We may collect the following types of personal data:

• Identifiers, such as your name, email address, phone number, and account log-in information.
• Age information, such as your age, which we collect to confirm that you are at least 18 years old.
• Financial data, such as income, savings, investments, investment plans, account balance and buying power, revenue, earnings, portfolio information and related profits and losses, and details of a specific order needed to manage its protective stop.
• Commercial information, such as your billing address; products or services purchased, obtained, or considered; subscription and transaction history; and limited payment card details (card type, BIN, last four digits, and expiration date) and payment tokens. Full payment card numbers and security codes are collected directly by our PCI-compliant payment processors and never reach our systems.
• Brokerage connection data, such as the access token issued by your brokerage, your brokerage account identifier, the connection status, and technical identifiers. We never request or receive your brokerage login password, and we cannot withdraw or transfer funds from your brokerage account.
• Browser and device data, such as IP address; approximate location (such as country, region, and city) derived from your IP address; device identifier; device type; Internet browser type; screen resolution; operating system name and version; device manufacturer and model; plug-ins; add-ons; and the language version of our Services.
• Usage data, such as time spent on our Services; pages visited; searches conducted; links clicked; patterns of use; the pages that led or referred you to our Services; and diagnostic data. We may also collect information about your online activities on websites and connected devices over time and across third-party websites, devices, apps, and other online features and services.
• Electronic and visual information, such as recordings of how you interact with our website and registration pages (for example, clicks, scrolls, and pages visited) captured through session replay tools. Text you type into form fields is masked.
• Records about you, such as the content, timing, and method of communications you have with us, such as via email; and information you share with or upload to our Services.
• Other information you choose to provide to us, such as information in response to surveys, forms, questionnaires, email, features on our website and software applications, engaging with customer service, or while using the Services.
• Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences or behavior, including to assess the level of interest in our Services.

Note that we collect personal data contained in any inputs you provide when using our AI Features. It is ultimately your choice what personal data you choose to share through such features.

3. Use of Personal Data

We may use the personal data we collect for the following purposes:

• To provide, operate, maintain, improve, personalize, and expand our Services.
• To communicate with you, including to provide customer service and provide you with updates about our Services.
• To perform internal analytics, research, and development, including to analyze usage patterns, test new features, conduct research, and develop new products and services.
• For marketing and promotional purposes.
• For internal business purposes, including general business administration.
• For systems and data security, including to detect, investigate, and prevent fraudulent, unauthorized, improper, or illegal activities on our Services.
• To protect the rights and safety of Monflex, our users, and the public.
• To comply with our legal obligations, including responding to subpoenas, court orders, or legal process; to enforce the legal or contractual terms that govern our Services; and to otherwise establish or exercise our legal rights or defenses against legal claims.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal data held by us about the users of our Services is among the assets transferred.
• For purposes disclosed at the time you provide your information, with your consent, as otherwise set forth in this Privacy Policy, or for any other legal purpose not inconsistent with this Privacy Policy.

We may use products, features, or tools that utilize artificial intelligence, machine learning, or similar technologies for any of the above purposes. We may use aggregated or de-identified information derived from your use of the Services, including your interactions with AI Features, to maintain and improve our Services and models.

4. Disclosure of Personal Data

We may disclose personal data to the following categories of third parties:

• Service providers. We may disclose personal data to our service providers to provide services on our behalf, such as order fulfillment, payment processing, analytics, advertising, hosting, marketing, customer and technical support, and other services. For example, our AI Features are powered by third-party AI model providers, such as OpenAI and Anthropic, which process the information you provide through AI Features on our behalf.
• Our affiliates. We disclose personal data between Monflex Operations and Monflex Advisers as needed to provide the Services, including investment advisory services, and for the other purposes described in this Privacy Policy.
• Brokers and financial partners. When you connect a brokerage account or fund it, we disclose personal data to the relevant broker-dealer (currently Alpaca Securities LLC) and, where applicable, to Plaid Inc., which act under their own terms and privacy policies.
• Third-Party Advertising Platforms and Analytics Providers. We may disclose information to Third-Party Advertising Platforms and Analytics Providers, such as hashed contact information (for example, your email address), browser and device data, and information about actions you take on our Services, such as registering or purchasing a subscription, including as part of our business development, advertising, and marketing initiatives, including targeted/behavioral advertising.
• Business transferees. If we or our affiliates are involved in a merger, acquisition, asset sale, or other corporate combination, your personal data may be transferred to the acquiring or surviving entity.
• Professional advisors. We may disclose personal data to our professional advisors, including attorneys, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
• Authorities for compliance and harm prevention. Under certain circumstances, we may be required to disclose your personal data if required to do so by law, in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.
• Other parties with your consent. We may disclose personal data to other parties with your consent.

5. Cookies

We use Cookies that collect information to improve and analyze our Services and provide targeted advertising. Some Cookies are offered by third parties who collect your personal data so they can provide services to us and information about your online activity to others. You can modify your browser settings to decline or accept certain Cookies. However, if you decline certain Cookies, some of our Services’ features may not function as designed. Cookies on the Services generally fall into the following categories:

• Strictly Necessary. We may use Cookies that we consider to be strictly necessary to allow you to use and access our Services, including Cookies required to prevent fraudulent activity and improve security.
• Functionality. We may use Cookies that are required to offer you enhanced functionality when accessing our Services, including identifying you when you use our Services or keeping track of your specified preferences, including in terms of the presentation of content on our Services.
• Performance/Analytics. We may use Cookies to assess the performance of our Services, including as part of our analytics practices. For example, we may use Google Analytics or other service providers for analytics services. These analytics services may use Cookies to help us analyze how users use the Services. Information generated by these services (e.g., your browser, device, and usage data) may be transmitted to and stored by Google Analytics and other service providers on servers in the U.S. (or elsewhere) and these service providers may use this information for purposes such as evaluating your use of our Services, compiling statistical reports on our Services’ activity, and providing other services relating to Services activity and other Internet usage. You may exercise choices regarding the use of Cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout or by downloading the Google Analytics Opt-out Browser Add-on.
• Targeting/Advertising. We may use Cookies that are placed by third-party advertising platforms or networks to deliver ads and track ad performance, enabling advertising networks to deliver ads that may be relevant to you based upon your activities (sometimes called “targeted advertising”) on the Services.

Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services (e.g., browser “Do Not Track” signals). Currently, we do not monitor or take any action with respect to these signals or other mechanisms, unless otherwise required by applicable law.

6. Legal Bases for Processing

We rely on one or more legal bases to process your personal data under applicable law. We may process personal data: (i) as necessary to perform our contractual obligations to you, including, but not limited to, those obligations in our Terms of Use; (ii) as necessary to pursue our legitimate business interests as further detailed below; (iii) as necessary for our compliance with our legal obligations such as a request or order from courts, law enforcement, or other government authorities, and record-keeping obligations under U.S. securities laws; and/or (iv) with your consent.

We may collect, process, and maintain personal data to pursue the legitimate business interests outlined below. To determine these legitimate interests, we balance our legitimate interests against the legitimate interests and rights of you and others and only process personal data in accordance with those interests where they are not overridden by your data-protection interests or fundamental rights and freedoms. Our legitimate interests generally include:

• Providing, improving, and developing our Services, including to deliver your requested services, send you messages and provide user support, customize the Services to better fit your needs as a user, develop new products and services, and perform internal analytics and research and development. This also includes sharing personal data with our trusted service providers that provide services on our behalf.
• Protecting you and others and creating and maintaining a trusted environment, such as to comply with our legal obligations, to ensure compliance with our agreements with you and other third parties, to ensure safe, secure, and reliable Services, and to detect and prevent wrongdoing and crime, assure compliance with our policies, and protect and defend our rights, interests, and property. In connection with the activities above, we may conduct internal research based on your interactions on various Services, content you submit to the Services, and information obtained from third parties.
• Providing, personalizing, measuring, and improving our marketing, including to send you promotional messages and other information that may be of interest to you. We may also use personal data to understand our user base and the effectiveness of our marketing. This processing is done pursuant to our legitimate interest in undertaking marketing activities to offer products or services that may be of interest to you.

Where required by law, we send marketing communications and use non-essential Cookies only with your consent, which you may withdraw at any time.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you. Trade setups generated by our automated bots are executed only after you approve them.

7. Children’s Privacy

Our Services are not directed to or intended for children, and we do not knowingly collect any personal data from anyone under the age of 18. If you think that your child provided information via our Services, please email privacy@monflex.io, and we will do our best to promptly delete such information.

8. Data Security and Retention

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. We maintain appropriate technical, administrative, and physical safeguards to help protect the security of your personal data against unauthorized access, destruction, loss, alteration, disclosure, or misuse, but we cannot guarantee its absolute security.

We will retain personal data for as long as necessary for the purposes outlined in this Privacy Policy, including complying with any legal obligations or policies, resolving disputes, enforcing legal agreements, and for internal analytics purposes. Our determination of precise retention periods will be based on (a) the length of time we have an ongoing relationship with you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position, including with regard to applicable statutes of limitations, litigation, or regulatory investigations.

Records relating to our investment advisory services, including related communications, are retained for the periods required by the Investment Advisers Act of 1940, generally at least five years, even if you request deletion. Payment and billing records are retained as required by tax, accounting, and payment network rules.

Brokerage connection data is retained only while your brokerage connection remains active; upon disconnection or revocation of access, we delete or render unusable the associated access token, except where limited retention is required to comply with our legal obligations.

9. International Transfers

We transfer personal data to countries outside the European Economic Area, including the United States and other countries where our personnel and service providers are located. Where these countries do not provide an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission.

10. Opting Out of Promotional Communications

We may use your personal data to send you email updates regarding our Services, other announcements, and inquiries. If you no longer wish to receive promotional email communications from us, you may opt out via the unsubscribe link included in such emails or by emailing us at privacy@monflex.io. We will comply with your request as soon as reasonably practicable. Please note that if you opt out of receiving promotional emails from us, we may still send you important administrative messages that are required to provide you with the Services or for other reasons disclosed in this Privacy Policy.

11. Supplemental U.S. Notices

A. Notice to California Residents

California residents have the right to request information regarding third parties to whom we have disclosed certain categories of personal data during the preceding year for the third parties’ direct marketing purposes under California’s “Shine the Light” law (Cal. Civ. Code §1798.83). If you wish to request information regarding such practices under California’s “Shine the Light” law, please email privacy@monflex.io. You must include your full name, email address, and postal address in your email request so that we can verify your California residence and respond.

B. Notice to Nevada Residents

We may “sell” personal data as that term is defined under Nevada law. Nevada residents have the right to opt out of any future sale of their personal data under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at privacy@monflex.io. You must include your full name, email address, and postal address in your email request so that we can verify your Nevada residence and respond.

C. Notice to Connecticut Residents

This notice contains additional information for residents of Connecticut about our data practices and your rights with respect to personal data under applicable laws and regulations. The provisions contained within this notice, in addition to the disclosures throughout the rest of this Privacy Policy, are intended to provide disclosures in compliance with the Connecticut Data Privacy Act. Please note that this notice does not apply to certain personal data that is collected from an individual in a business-to-business or employment context.

Information about what kinds of personal data we may collect or have collected, how we collect it, why we collect it, and to whom we may disclose it is found in Sections 1-4 of this Privacy Policy. We may “sell” personal data to Third-Party Advertising Platforms and Analytics Providers for purposes of providing targeted behavioral advertising on those platforms. We may also “sell” personal data for marketing and promotional purposes.

Connecticut residents may have the following privacy rights, subject to certain exceptions:

• Right to know and access. You have the right to know what personal data we collect, use, disclose, and sell. You may ask us to provide you a portable copy of this information once in a rolling twelve-month period.
• Right to delete and erase. You have the right to request under certain circumstances that we delete the personal data that we collect about you.
• Right to correct inaccurate personal data. You have the right to request the correction of inaccurate personal data.
• Right to opt out. You have the right to opt out of the processing of personal data for the purposes of targeted advertising, the sale of your personal data, and profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you.
• Rights concerning sensitive personal data. We cannot process sensitive personal data or use your personal data for certain purposes without your affirmative consent.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

To exercise your privacy rights described above, please email privacy@monflex.io.

You may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of your authorization of the agent and/or verification of the agent’s identity. Please note that any request submitted to us is subject to an identification and residency verification process, to the extent permitted by applicable law.

We will respond to and process requests consistent with applicable law. We will respond to your request within forty-five (45) calendar days after receipt, and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary, provided that we notify you of the extension within the first forty-five (45) days.

If you want to appeal our decision regarding a request that you have made, please email privacy@monflex.io. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.

12. Additional Information under the GDPR

This section applies to personal data processed by Monflex Operations, which is the controller of that personal data (see “Who we are” above). Our contact information is found in Section 14 (“Contact Us”).

We provide this section, in addition to the disclosures throughout the rest of this Privacy Policy, to comply with the General Data Protection Regulation (“GDPR”).

In certain circumstances, you have the following privacy rights, subject to certain exceptions:

• Right to access. You have the right to request confirmation of whether we process personal data relating to you, and if so, to request a copy of that personal data.
• Right to erasure. You have the right to request that we erase your personal data in certain circumstances provided by law.
• Right to rectification. You have the right to request to have your personal data corrected or updated if that information is inaccurate, outdated, or incomplete.
• Right to object. You have the right to object to our processing of your personal data. You may object at any time to the processing of your personal data for direct marketing.
• Right to restrict. You have the right to request that we restrict the processing of your personal data.
• Right to data portability. You have the right to request that we provide you with a copy of your personal data in a structured, machine-readable, and commonly used format.
• Right to withdraw consent. You have the right to withdraw your consent at any time where we rely on your consent to process your personal data.
• Right to lodge a complaint. You have the right to complain to a data protection authority about our collection and use of your personal data, including the Commissioner for Personal Data Protection of the Republic of Cyprus. For more information, please contact your local data protection authority. A list of EEA supervisory authorities is available here.

To exercise your privacy rights described above, please email privacy@monflex.io. Any request you submit to us is subject to an identification and residency verification process as permitted under applicable law. Additionally, all requests are subject to certain exceptions under applicable law, which may vary.

13. Updates to this Privacy Policy

We may change this Privacy Policy from time to time to reflect changes in our data practices or applicable law. We will notify you of any changes consistent with applicable law, including by posting the new Privacy Policy on this page and updating the “Effective Date” at the top of this Privacy Policy. We recommend periodically reviewing this page for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

14. Contact Us

If you have questions or concerns regarding this Privacy Policy, please contact us at:

Monflex Operations Ltd.

Kallipoleos 15, AMARAL 30, 2nd floor, Office 202

1055 Nicosia, Cyprus

Monflex Technology Corp.

1201 Orange Street, Suite 600

Wilmington, Delaware 19801

privacy@monflex.io