Privacy Policy

MYILMEX LTD is a private limited company registered in England and Wales (company number 17540904). Registered office: 14 Derby Road, Stapleford, Nottingham, England, NG9 7AA. For data protection law, MYILMEX LTD is the controller of your personal data: it decides why and how your data is used, and is responsible for it. (Until MYILMEX LTD was incorporated on 24 October 2026, this service, then called ILMEX, was run by its founder personally; nothing about how your data is handled, or any right described here, changed with the move to the company.)

For anything in this policy — a question, a request, or a complaint — write to amaan@myilmex.onmicrosoft.com. There is no separate data protection officer; MYILMEX is not large enough to be required to appoint one, so that address reaches the person responsible directly.

All of it is collected only when you use the product.

• Account details — your email address, a name if you choose to give one, and a password (stored only as a one-way hash we cannot read). If you sign in with Google instead, Google confirms your email, name and profile picture to us; we never see your Google password. If you turn on two-step login, we store the secret your authenticator app uses.
• Your preferences — the answers you give in the onboarding quiz or in Settings: experience level (which only sets how much we explain), which investing framework you want shown first, display currency, and which plan you’re on. You can answer “not sure yet” to the first two. We do not ask about your income, savings or wider financial situation, what you’re investing for, your time horizon or your risk tolerance. Until 25 October 2026 the quiz did ask for the last three; those answers were permanently deleted on 5 November 2026. We also note which guided tours you’ve finished or turned down, so MYILMEX doesn’t keep offering them.
• Shariah preferences — whether you’ve switched on halal mode and which screening standard you chose, plus any purification and zakat records you keep. We treat this as sensitive information; see §3.
• What you enter — portfolio transactions, watchlist tickers, alerts you set, saved screens, and any notes you add to them. (Linking a brokerage account is not currently offered; see §9.)
• The waitlist — if you enter your email address, we first send it one email with a link to confirm. You’re only on the list once you press the button that link opens, so someone else entering your address gets you that one email and nothing more. Once you’ve confirmed, we use your email address to send you a welcome email, regular updates about MYILMEX and the product before it opens, and an email on the day it opens. Basis: your consent, given by ticking the box on the form, which you can withdraw at any time with the unsubscribe link in any of those emails or by emailing us. We keep the date you ticked it and the wording you agreed to.
• Your agreements — when you accepted our Terms and confirmed you’re 18 or over, and when you consented to halal mode. A tick, never your date of birth: we don’t need to know your age.
• Data requests — if you use our data request form: your email address, what you asked for, anything you wrote, and how we dealt with it.
• Feedback you send — if you use “Send feedback”, the message you write, the category you pick, and the page you sent it from, together with your account so we can follow up.
• AI assistant records — the conversations you have with Ask ILM, which are saved so you can return to them; the daily brief written for your dashboard; and a usage record for each AI request (which feature, how much it cost to run, and when), which is how the monthly allowance on your plan is enforced.
• Notification registrations — only if you install MYILMEX to a phone’s home screen and turn on notifications. Your browser generates an address for itself at its own vendor’s notification service, plus a pair of keys that only it holds, and we store those so alerts can be delivered. They identify a browser install, not you, and they are useless to anyone else. Turning notifications off, or uninstalling, removes the record.
• Technical data — your IP address, browser type and timestamps, in our hosting provider’s server logs and in the counters that stop the service being flooded with requests; and the cookies and browser storage listed in §13.

The only thing you must provide to have an account is an email address. Everything else is optional — the product simply adapts less to you without it.

Switching on halal mode, choosing a screening standard, or keeping purification and zakat records can reveal your religious beliefs. UK and EU law calls this special category data and protects it more strictly than ordinary personal data.

We process it only on the basis of your explicit consent, which you give by switching halal mode on after being told what it means. From 5 November 2026 we record when you did; for an account that switched it on before then, we hold no separate date. It is used for one thing: tailoring screening, purification and zakat features to you. It is never used for advertising, never sold, and never shared with anyone except as described here.

One disclosure matters in particular. When halal mode is on and you send a message to the AI assistant, the fact that it is on — and the standard you chose — is included in that request, so the answer respects it. That request goes to our AI provider in the United States (see §5). Your name and email are never part of it.

You can withdraw this consent at any time by switching halal mode off in Settings; the Shariah features stop immediately and the preference is no longer sent anywhere. Purification and zakat records you’ve already saved stay until you delete them or your account.

Data protection law requires a lawful basis for each use. These are ours:

• To provide the service you signed up for — sign-in, your saved preferences, portfolio, watchlist, alerts, research shown starting with the framework you chose, saved AI conversations, and enforcing the limits of your plan. Basis: performance of our contract with you.
• Shariah features — basis: your explicit consent, as set out in §3.
• Things you switch on yourself — receiving alerts by email. Basis: consent, withdrawn by switching it off or using the unsubscribe link in any alert email.
• Waitlist emails — basis: your consent, as set out in §2.
• Not emailing you again once you’ve said stop, and limiting how many data request and waitlist confirmation emails an address can receive — keeping scrambled forms of email addresses, described in §10. Basis: our legitimate interests in respecting that choice and in stopping our forms being used to fill someone’s inbox.
• Answering data requests and keeping records of consent — basis: legal obligation, because the law makes us answer requests and be able to show you agreed.
• Feedback you send — reading it, replying and fixing what it reports. Basis: our legitimate interests in improving the service.
• Keeping the service secure and running — the “are you human?” check on sign-in, sign-up and password reset, limiting request rates by IP address, investigating abuse, diagnosing faults. Basis: our legitimate interests in a secure, reliable service. This is low-impact processing that you would expect; you can object to it (see §11).
• Account administration — the company can see your email, name, plan, sign-up date and last sign-in, in order to manage plans and respond to support requests. Basis: legitimate interests. Your password is never visible to anyone. Running the database necessarily gives the company technical access to what is stored in it; that access is used only to operate, secure and repair the service, never to read your portfolio or conversations out of curiosity.
• Meeting legal obligations — for example responding to a lawful request from a regulator or court. Basis: legal obligation.

We do not use your data for advertising, and we do not sell it.

MYILMEX’s AI features run on models from Anthropic. It matters exactly what is sent and when, so here it is:

• Ask ILM (the assistant) — when you send a message, the request includes your question, the conversation so far, the research MYILMEX already holds on any stock in focus, and context about you so the answer is useful: your strategy, experience level, halal setting, and a summary of your holdings. MYILMEX doesn’t ask for your goals, time horizon or risk tolerance: the assistant gives information, not personal recommendations, so it has no use for them. This happens only when you press send.
• The daily brief — once a day, the first time you open your dashboard, a summary of your portfolio’s value, its biggest movers, your watchlist’s movers and any alerts that fired is sent so a short, factual brief can be written. Nothing from your profile — strategy, experience level, halal setting or anything else about you — is included. This one is automatic. If you hold nothing and watch nothing, no request is made at all.
• 10-K and proxy analysis — these read public company filings. Nothing about you is involved.

Your name and email address are never included in any of these requests, though anything you type into a message goes as you wrote it, so please don’t include them. Anthropic processes these requests on our behalf under its commercial terms, which state that it does not train its models on this data. It may keep them for a limited time for safety and abuse monitoring, as those terms allow.

AI output can be wrong, and none of it is advice — see our Terms of Service.

MYILMEX makes no automated decisions about you that have legal or similarly significant effects. The scorecards, screens, suggestions and AI output all describe companies and securities; none of them assesses, scores or profiles you, and nothing about your account is decided by an algorithm. What you do with the research is your decision alone.

MYILMEX doesn’t sell data. The companies below process it on MYILMEX’s behalf, strictly to run the features you use, and each receives only what its job needs:

• Supabase — our database and sign-in system, hosted in the EU (Ireland). This is where your account and everything you save actually lives.
• Vercel — hosts the application (United States). Its server logs briefly record IP addresses and requests.
• Anthropic — the AI provider (United States), receiving only what §5 describes.
• Upstash — counts requests per IP address or account so the service can’t be flooded. It holds that identifier and a counter, which expire within a day.
• Resend — sends our email (United States): password resets and account messages for everyone, alert emails only if you’ve switched them on, the welcome, product-update and launch emails to people on the waitlist, and messages about data requests. It receives your email address and the content of the message.
• Your browser’s notification service — only if you turn on phone notifications: Apple on an iPhone or iPad, Google on Android, Mozilla on Firefox. They deliver the alert to your device. The alert text is encrypted before it leaves our servers with keys only your device holds, so the notification service passes it on without being able to read it.
• Cloudflare — runs the “are you human?” check (Turnstile) on the sign-in, sign-up and password-reset pages, the data request form, and the waitlist form once you start using it, so automated sign-ups and password guessing are stopped (United States). It receives your IP address and technical details of your browser and connection, used only to tell people from bots — not to identify, profile or advertise to you.
• Microsoft — hosts the company’s email (Microsoft 365). If you write to us, or confirm a data request, your message and email address are held there.
• Halal Terminal — our Shariah screening provider, used only in halal mode. It receives ticker symbols, and when you open the Purification page, the number of shares and market value of each holding so zakat can be estimated. It never receives your name, email, account or IP address, so it can’t tell whose holdings they are.
• SnapTrade (Canada) — only for an account that linked a brokerage before broker linking was switched off; see §9.
• Google — only if you choose “Sign in with Google”.

Market-data providers do not receive your personal data. Financial Modeling Prep, Finnhub, SEC EDGAR, FINRA and FRED are asked about ticker symbols by MYILMEX’s own servers. They see a symbol and MYILMEX’s server — not you, your account, or your IP address.

We may also disclose information where the law requires it, or where it’s necessary to protect MYILMEX’s or someone else’s rights or safety. When paid plans start, a payment provider will handle your card details; we’ll update this policy before that happens.

Your data is stored in the EU, which the UK recognises as providing adequate protection. Some of the providers above are in the United States or Canada, so some personal data leaves the UK and EU when those features run.

Those transfers rely on a recognised legal safeguard in each case: the UK’s adequacy regulations for Canada; and for the United States, the UK–US Data Bridge where the provider is certified to it, or otherwise the provider’s standard contractual clauses together with the UK International Data Transfer Addendum. You can ask us which applies to a particular provider, and for a copy of the relevant safeguard.

MYILMEX does not currently offer linking a brokerage account; it was switched off on 28 October 2026. Your portfolio is whatever you enter yourself, and nothing is collected from a broker.

If you linked a broker before then, the registration made with SnapTrade (our read-only linking provider) is erased at SnapTrade when you delete your MYILMEX account, before your MYILMEX data is removed. You can also ask us to erase it sooner by writing to amaan@myilmex.onmicrosoft.com.

• Your account and everything in it — kept while your account exists. Delete the account and all of it is permanently removed, not hidden: transactions, watchlist, alerts, purification records, AI conversations, broker connections. This is enforced by the database itself, not just the interface. Two records stay with your identity taken out, so nothing links them to you: our AI usage ledger (date, feature, AI model, tokens and cost) and our log of complimentary plans (date, previous plan, new plan). We keep them so our monthly AI spending limit stays accurate and plan changes can be audited. A count of the alert emails we sent you each day is kept for 7 days to limit how many go out, and is removed with your account.
• AI conversations — kept until you delete them individually, or delete your account.
• Feedback you send — kept until your account is deleted, or sooner if we delete it once dealt with.
• Notification registrations — kept until you turn notifications off, uninstall the app, or delete your account. If your browser’s notification service tells us a registration is dead, we delete it straight away rather than keeping it.
• Rate-limiting counters — expire within a day.
• Hosting server logs — kept for the short period our hosting provider retains them, then deleted automatically.
• Waitlist sign-ups — if you joined the waitlist before accounts opened, we hold your email address, the date you joined, which page you joined from, the consent you gave and when you confirmed, until you unsubscribe or ask us to remove it. An address that isn’t confirmed is deleted after 14 days. Unsubscribing deletes the record. So that we don’t email you again, we then keep a scrambled form of your address, which can’t be turned back into it and is only used to spot the same address being entered again. To rejoin, contact us.
• Data requests — kept for 12 months after we finish dealing with one, so we can show we did. A request nobody confirms is deleted about a week after we last emailed the confirmation link. If that email couldn’t be sent, we keep trying for up to 30 days, then delete the request. A scrambled form of the address, used to send at most one of these emails a day to a mailbox, is deleted within two days.

After a deletion, copies may remain in our database provider’s routine encrypted backups for a short time before they are overwritten. They are not used for anything in the meantime.

Under UK and EU data protection law you have the right to:

• Access your data, and take it with you — download everything linked to your account as a single structured file, any time, from Settings → Your data. It leaves out the access credential for a brokerage linked before broker linking was switched off, withheld for your own security, and the record of any complimentary plan we gave you. For those, or a waitlist entry or data request (which we hold by email address rather than by account), ask us using the form below.
• Erasure — permanently delete your account and all associated data from Settings → Danger zone. If you can’t log in, or you’re only on the waitlist, use our data request form.
• Rectification — correct anything inaccurate directly in the app, or by contacting us.
• Restrict or object to processing — including any processing we base on legitimate interests.
• Withdraw consent at any time — switch off halal mode, turn off email alerts, or use the unsubscribe link in any email. Withdrawing doesn’t affect anything done before you withdrew.

Most of these you can do yourself, instantly, in the app. For anything else, use our data request form or email amaan@myilmex.onmicrosoft.com. It’s free, we’ll reply within one month, and we may need to confirm it’s really you first.

Complain to us. If you’re unhappy with how we’ve handled your data, write to amaan@myilmex.onmicrosoft.com. We’ll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to a regulator. In the UK that’s the Information Commissioner’s Office — ico.org.uk/make-a-complaint or 0303 123 1113. In the EU it’s your local data protection authority. We’d appreciate the chance to put things right first, but you don’t have to give us one.

• Every table is protected by row-level security — the database itself enforces that your account can only ever read or write its own data.
• Data is encrypted in transit (HTTPS) and at rest.
• Passwords are stored only as one-way hashes. API keys and other secrets never reach your browser.
• Usage records that set your plan’s limits can’t be edited or deleted from your browser, so they can’t be tampered with.

No system is perfectly secure. If a breach ever puts your rights at risk, we’ll tell the ICO within 72 hours where the law requires it, and tell you directly without undue delay if the risk to you is high.

MYILMEX stores only what’s needed to do what you’ve asked of it. There are no advertising cookies, no analytics trackers and no third-party tracking of any kind. That’s why you’re shown a short notice rather than being asked to accept or reject anything.

Our Cookie Policy lists every cookie and piece of browser storage, what each is for and how long it lasts.

MYILMEX is not directed at, and must not be used by, anyone under 18. Everyone confirms they’re 18 or over when they join the waitlist or create an account. We don’t knowingly collect data from children; if you believe a child has given us their details, tell us and we’ll delete them.

When this policy changes we update the date at the top of the page. If a change is significant — a new kind of data, a new purpose, or a new provider receiving personal data — we’ll tell signed-in users directly, before it takes effect where we can. If a change affects something you consented to, we’ll ask again rather than assume.

Questions, requests, or complaints about your data: amaan@myilmex.onmicrosoft.com, or by post to MYILMEX LTD, 14 Derby Road, Stapleford, Nottingham, England, NG9 7AA.