Privacy Policy

What the service collects, why, who it reaches, and what you can ask us to do about it.

Last updated 2 August 2026

1. Scope

This policy covers the ApexCorp service and this website. Where the Service is deployed inside your own environment under a separate agreement, you are the controller of the data it processes, and this policy then applies only to the website and to support data you send us.

2. Who is responsible

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], is the controller of personal data processed through the hosted Service. Contact: [CONTACT EMAIL].

3. What we collect

You give us

• Account details — email address, and a password stored only as a hash.
• Company content — the briefs, tasks, notes and memory your company produces.
• Model provider credentials — encrypted at rest and used only to make calls on your behalf.
• Billing details — handled by our payment processor. We never see or store full card numbers.

Collected automatically

• Operational logs — IP address, browser type, timestamps, and the requests you make, kept to run and secure the service.
• Usage metering — task counts and token spend, used for limits and billing.

We do not collect

• Advertising identifiers, cross-site tracking, or data brokered from third parties.
• Special category data. Please do not put it into task briefs.

4. Why we process it, and on what basis

• To provide the Service — performance of our contract with you.
• To bill you — performance of a contract, and legal obligation for tax records.
• To keep the Service secure and abuse-free — our legitimate interests.
• To contact you about service changes — legitimate interests, or consent for anything promotional.

5. Where your content goes

The important one: task briefs and the context agents assemble are sent to the model provider you configure, under your own account with that provider. Their handling of that data is governed by their terms and privacy policy, not ours. We do not use your content to train any model, and we do not sell it.

6. Who else sees it

We share personal data only with processors who help us run the Service:

• Cloud hosting and database providers.
• The payment processor, for subscription billing.
• Error monitoring and operational logging.

Each is bound by a data processing agreement. We disclose data to authorities only where legally required, and will tell you unless prohibited.

7. International transfers

Where data leaves [JURISDICTION], we rely on an adequacy decision or on standard contractual clauses with appropriate supplementary measures.

8. How long we keep it

• Account data — while your account is open, then up to 30 days.
• Company content — until you delete it, or 30 days after termination.
• Billing records — as long as tax law requires, typically six to seven years.
• Operational logs — up to 90 days, except where retained for a specific security investigation.

9. Your rights

Subject to local law, you may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Write to [CONTACT EMAIL]; we respond within one month. You may also complain to your local data protection authority.

10. Cookies

The marketing site sets no analytics or advertising cookies. The application uses a session cookie strictly necessary to keep you signed in. If that ever changes, a consent banner will appear before any non-essential cookie is set.

11. Security

Encryption in transit, encryption at rest for credentials, least-privilege access, and logging of administrative actions. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required. See our security page for what is enforced today.

12. Children

The Service is not directed at children under 16, and we do not knowingly collect their data. Tell us if you believe we have.

13. Changes

We will post updates here and, for material changes, give notice by email at least 30 days in advance.