Effective Date: Upon First API Use
Version: 1.4
Last Updated: April 2026
This Data Processing Agreement (“DPA”) establishes the terms under which Advisory API Systems LLC (“Processor,” “Company,” “we,” “us,” or “our”) processes personal data on behalf of User (“Controller,” “you,” or “your”) in connection with the Portfolio Optimization API services.
This DPA is incorporated by reference into the User Agreement (“Agreement”). By using the API, User agrees to the terms of this DPA.
This DPA applies to all processing of Personal Data by Processor on behalf of Controller in connection with the API services.
“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data, including:
“Controller” means User, as the entity that determines the purposes and means of processing Personal Data.
“Data Subject” means an identified or identifiable natural person whose Personal Data is processed.
“Personal Data” means any information relating to an identified or identifiable natural person that is submitted to the API by Controller.
“Processing” means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
“Processor” means Advisory API Systems LLC, as the entity that processes Personal Data on behalf of Controller.
“Security Incident” means any confirmed unauthorized access to, or acquisition of, Personal Data that compromises the security, confidentiality, or integrity of such data.
“Sub-processor” means any third party engaged by Processor to process Personal Data on behalf of Controller.
(a) Controller Status: User is the Controller of all Personal Data submitted to the API. User determines what data is submitted and for what purposes.
(b) Processor Status: Advisory API Systems acts as a Processor, processing Personal Data solely for the purpose of providing the API services, which include generating investment advice for User.
(c) Controller Obligations: User is responsible for:
(a) Processor shall process Personal Data only:
(b) If Processor believes an instruction violates Applicable Data Protection Laws, Processor will promptly notify Controller.
Personal Data will be processed solely for the following purposes:
The API may process the following categories of Personal Data as submitted by Controller:
| Category | Examples | Purpose |
|---|---|---|
| Identification Data | Names, dates of birth, ages | Household composition, life expectancy calculations |
| Financial Data | Income, assets, account balances, Social Security benefits | Portfolio optimization calculations |
| Employment Data | Occupation, employment status, salary history | Human capital valuation |
| Demographic Data | State of residence, marital status | Tax calculations, regulatory compliance |
| Benefit Data | Pension amounts, insurance coverage, Medicare eligibility | Background asset valuation |
| Risk Profile Data | Risk tolerance scores, willingness-to-pay responses | CRRA parameter determination |
The API is not designed to process special categories of data (sensitive personal information) such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, or religious beliefs. Controller should not submit such data unless essential to the service and permitted by applicable law.
Data Subjects may include:
Processor implements and maintains appropriate technical and organizational measures to protect Personal Data, including:
Technical Measures:
Organizational Measures:
Processor will update security measures as necessary to maintain appropriate protection in light of evolving threats and industry standards.
Controller authorizes Processor to engage the following categories of Sub-processors:
| Category | Purpose |
|---|---|
| Cloud Infrastructure Providers | Hosting and data storage |
| Payment Processors | Billing and payment processing |
| Security and Monitoring Services | Infrastructure protection |
A current list of Sub-processors is available upon written request to [email protected].
Processor will:
Processor will notify Controller at least thirty (30) days before engaging a new Sub-processor or making material changes to existing Sub-processor arrangements. If Controller has legitimate grounds to object, Controller may terminate the Agreement by providing written notice within the notification period.
The API processes Personal Data to generate responses. Personal Data included in API requests is processed in real-time and is retained by Processor after the response is delivered, in addition to:
(a) API Logs: Request metadata (timestamps, API Key identifiers, HTTP status codes) may be retained for operational purposes.
(b) Billing Records: Usage counts necessary for billing are retained in accordance with accounting requirements (typically seven years).
(a) Controller may request deletion of Personal Data at any time by submitting a written request via email to [email protected]. Processor will delete the specified Personal Data within thirty (30) days, subject to regulatory retention requirements applicable to investment advisers.
(b) Upon termination of the Agreement, Processor will:
Processor may retain Personal Data as required by applicable law, subject to appropriate confidentiality and security measures.
Controller is responsible for responding to Data Subject requests to exercise their rights under Applicable Data Protection Laws (access, correction, deletion, portability, etc.).
Processor will:
Processor will respond to Controller’s requests for assistance within ten (10) business days.
Processor will notify Controller without undue delay (and in any event within 72 hours) after becoming aware of a Security Incident affecting Controller’s Personal Data.
Security Incident notifications will include, to the extent known:
Processor will:
Notification of a Security Incident does not constitute acknowledgment of fault or liability.
Personal Data is processed on servers located in Germany (European Union), which are subject to the EU General Data Protection Regulation (GDPR) and its strict data protection requirements. Data may also transit through infrastructure located in the United States in the course of providing the services. Processor does not transfer Personal Data to jurisdictions outside the European Union and the United States unless:
Because Personal Data is processed within the European Union (Germany), the processing benefits from the protections of the GDPR. For any transfers of Personal Data between the European Union and the United States that occur in the course of providing the services, Processor relies on appropriate transfer mechanisms, which may include:
Where required, Processor will implement supplementary technical and organizational measures to ensure adequate protection of transferred data.
For purposes of the CCPA/CPRA, Processor acts as a “Service Provider” as defined in Cal. Civ. Code § 1798.140(ag).
Processor certifies that it:
Processor will notify Controller if it determines it can no longer meet its obligations under this Section 11.
Processor maintains a Privacy Policy describing its collection, use, disclosure, and retention of personal information, including disclosures required by the CCPA/CPRA and the GLBA. The Privacy Policy is incorporated by reference into the User Agreement and is available at https://ria.us/agreement/Privacy_Policy.html.
To the extent Personal Data includes “nonpublic personal information” as defined under GLBA, Processor maintains an information security program that:
Processor acknowledges that Controller may be subject to regulatory examination and will cooperate with Controller’s compliance requirements.
In the event of a conflict between this DPA and the Agreement, the terms most protective of Personal Data shall prevail.
This DPA may be amended by Processor to reflect changes in Applicable Data Protection Laws. Material changes will be communicated with at least thirty (30) days’ notice.
This DPA shall survive termination of the Agreement with respect to all Personal Data processed during the term.
Liability under this DPA is subject to the limitations set forth in the Agreement.
Advisory API Systems LLC
Email: [email protected]
Phone: (310) 839-0358
This Data Processing Agreement is incorporated by reference into the User Agreement. By using the API, you acknowledge and agree to the terms of this DPA.