Privacy Policy

This policy covers two different things, and the difference matters:

• Information about you, when you are our customer or visiting our website. Here we decide what is collected and why. In legal terms we are the controller.
• Information about your customers, when you are our client. Here you decide what is collected and why, and we handle it on your instructions. In legal terms you are the controller and we are the processor. Section 4 covers this.

1. What we collect

Information you give us: when you request a free scan, from the scan form or the cost calculator, or book a walkthrough, we collect your name, email, phone number, business name, and website URL. Those five fields are everything this website asks for. On a paid seat you also enter details about the business being measured: its name, website, location, and the questions you want tracked. Apex does not ask for logins to your Google Business Profile, your review platforms, or your website, because it publishes nothing for you: it drafts corrections, and you decide what to publish.

Information collected automatically: standard website logs and the cookie-free, aggregated analytics described in section 6: pages visited, device and browser type, and approximate location from IP address.

Measurement data: our checks put questions about a business and its market to AI assistants, and record how they answer. The questions come from the tracked question list for that business. They contain no information about any individual.

Your customers' information, when you are our client: see section 4. This is information we hold for you, not information we collect for ourselves.

2. How we use it

To run your scan and deliver results; to provide, bill, and support the services; to send the reports you signed up for; to respond to enquiries; to improve our website and benchmarks, in aggregated and anonymised form; and, if you requested a scan or walkthrough, to follow up about our services. We keep contact information in our customer relationship management system for these purposes.

3. What we don't do

We do not sell your personal information. We do not share it with third parties for their own advertising. We do not use your private business data to benefit another client. We do not use the information we hold for you about your customers for any purpose of our own, including training or improving any AI model.

4. Information we handle for our clients

This section is about the people who contact your business.

When you use Apex to capture leads, or when we host your website, information those visitors submit reaches our systems: their name, phone number, email address, and whatever they write in a message box, along with the page they were on and how they arrived. If you use our text-message assistant, the text of their messages reaches us too.

You decide, and we act on your instructions. You choose whether to switch capture on and which website addresses it accepts submissions from. You are responsible for telling your visitors that their information is collected, why, that Apex Discover LLC receives it as a service provider for your business, and that it is not sold. We give you wording to use for exactly that. We do not decide what is collected or why, and we do not use it for our own purposes.

We do not delete your records on a timer. They are yours, and how long they are kept is your call, not ours. Ask us and we will delete any of them at any time.

Who we pass it to. Only the providers we need to operate the service, listed in full at our sub-processor page, and only to do the job you asked for. One of them, our email provider, receives a visitor's name and the message they wrote, because that is what a new lead notification contains. Our error-monitoring provider may incidentally receive information contained in a technical error report; we strip email addresses, phone numbers and access tokens from those reports before they leave our systems.

We do not put your customers' details or their words to any AI assistant. The assistants we measure receive questions about your business, drawn from your own tracked question list. The one exception is our text-message assistant, which drafts a reply and therefore has to read the message being replied to. That feature is separate, it is switched on per client, and it is described where you switch it on.

How long we keep it.Retained for the life of the client relationship; deleted or returned on termination. We do not delete your customers' records on a timer, because they are your records and that is your decision.

When you leave. At the end of our agreement you choose: we return a complete copy of your customer records, or we delete them, or both in that order. This is your right and it is written into our Data Processing Agreement.

If one of your customers asks about their information. Come to us and we will help you answer, including producing a copy of everything we hold about that person or removing them completely. Section 8 covers timing.

5. Who we share with

Service providers who help us operate, covering hosting, storage, analytics, email, error monitoring, and payment processing, under contracts limiting their use of your data. We publish the full list, what each one does, and what information each can receive, at our sub-processor page, and we give notice before adding a new one.

AI assistants, because measuring how they answer means putting questions about your business to them. Those questions describe a business, not a person.

Authorities, where the law genuinely requires it. If Apex is ever acquired, your information transfers with the same protections.

6. Cookies and analytics

This website sets exactly one cookie, and only if you submit the cost calculator's form. It is called apx_lead, it holds the word ok, and it expires 60 seconds after it is set. Nothing else is in it: no name, no email, no identifier, nothing we could use to recognise you again. Its only job is to tell the page you land on that your submission went through, so the cost calculator can open the full breakdown you just asked for even if your browser sent the form before our code finished loading. The page deletes it as soon as it reads it.

Nothing else on this website sets a cookie. Our analytics are cookie-free: they count visits and pages in anonymised, aggregated form, without identifying you or following you to other websites. That is why you do not see a cookie banner here: there is nothing to opt out of.

Websites we host for clients may use a small measurement script that records which page was viewed and which assistant or search engine referred the visit. It stores no name, no address and no identifier for a person.

Those sites also keep a first-party record on your own device for up to 90 days, so the business can tell how people found it. It holds the tracking tags on the link you arrived by and the name of the site you came from. It holds no name, and it is not used to follow you to other websites.

7. Retention and security

For information about you as our customer, we keep it as long as needed for the purposes above or as the law requires, then delete or anonymise it. For information we hold for a client about their customers, section 4 applies: retained for the life of the client relationship; deleted or returned on termination.

We protect information with encryption in transit, database-level access rules that separate every client's data from every other client's, and a recorded audit trail of who opened, exported or deleted an individual record.

Two things we would rather say plainly than let you assume. That audit trail covers opening one person's record, not every screen a list appears on. And a small number of our own staff can reach client data in order to operate and support the platform; the separation rules above hold between clients, not against us.

No system is perfectly secure and we will not claim otherwise. Section 12 tells you how to reach us if you believe something has gone wrong.

8. Your rights

Depending on where you live, including under the California Consumer Privacy Act as amended by the CPRA, the General Data Protection Regulation in the United Kingdom and the European Economic Area, and similar state and national laws, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to opt out of marketing at any time. Every marketing email includes an unsubscribe link. We do not discriminate against you for asking.

If you are our customer, email privacy@apexdiscover.ai. We respond within the timelines the law requires, which is 45 days under the CPRA and one month under the GDPR, and we will tell you if we need longer.

If you are a customer of one of our clients, the business you contacted decides what happens to your information, so please ask them first. If you contact us instead, we will pass your request to that business and support them in answering it. We are not permitted to delete or hand over their records on our own initiative, and you would not want a supplier who was.

If you are in the UK or the EEA, you also have the right to complain to your national supervisory authority.

9. International transfers

We store and process information in the United States, in Amazon Web Services' Oregon region, through our database provider. We do not currently offer storage inside the European Union or the United Kingdom.

If you are in the UK or the EEA, or if you are a client whose website receives visitors from there, transfers rely on the Standard Contractual Clauses approved by the European Commission, and the UK Addendum where the UK GDPR applies. Our Data Processing Agreement incorporates them, and it is published rather than available on request.

10. Data processing agreement

Our standard Data Processing Agreement is published and does not have to be requested. It covers the terms in section 4, the sub-processor list, the end-of-agreement return or deletion of your records, and the Standard Contractual Clauses. If your organisation needs it signed, email legal@apexdiscover.ai.

11. Children

Our services are for businesses. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email privacy@apexdiscover.ai and we will delete it.

12. Changes and contact

We will post any changes here with a new effective date and flag material changes to active clients. Questions: privacy@apexdiscover.ai. Our Terms of Service govern the rest of the relationship. Notices by post:

Apex Discover LLC, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, US.