Privacy Policy

Last updated: 2026-06-12

This Privacy Policy describes how APEXIUM MARKETING LLC, a New Mexico limited liability company ("Apexium", "we", or "us"), located at 8206 Louisiana Blvd NE, Ste A #7450, Albuquerque, NM 87113, collects, uses, and shares information when you use our service at apexium.team.

Information we collect

• Account information: name, email address, company name, billing address, and payment method (held by Stripe; we do not store card numbers).
• Customer data you upload: contacts, conversations, deals, and any other records you create or import. We process this data on your behalf as a data processor.
• Usage data: API request volume, feature usage, error logs, IP addresses, and browser/device metadata used for analytics, billing, and abuse prevention.
• Communications: support tickets, in-app messages, and emails you send us.
• Connected-account data: when you connect a third-party account (e.g., Google, Stripe, Twilio), we access only the data needed to provide the feature you enable, at your direction (see "Google user data" below).

How we use information

• To provide, operate, and maintain the Apexium service
• To process payments and prevent fraud
• To improve and develop new features
• To communicate with you about your account, support, and product updates
• To comply with legal obligations

Sub-processors (GDPR Article 30)

We share information only with sub-processors strictly necessary to operate the service:

| Sub-processor | Purpose | Jurisdiction | |---|---|---| | Supabase | Database hosting + auth + storage | US | | Vercel | Web application hosting | US | | Railway | Worker process hosting | US | | Stripe | Payment processing | US (PCI-compliant) | | Resend | Transactional email delivery | US | | AWS SES | Broadcast email delivery | US | | Twilio | SMS + voice messaging | US | | Google | OAuth + Gmail / Calendar / Business Profile APIs (accessed only at your direction) | US | | Anthropic | AI features (Claude API) | US | | Sentry | Error monitoring | US | | Inngest | Async job orchestration | US | | LiveKit | Voice agent infrastructure | US | | Upstash | Rate limiting | US (Cloudflare edge) |

We do not sell your data. The list updates as we add or replace sub-processors; customers are notified via email 30 days before any material sub-processor change.

Google user data

When you connect a Google account, Apexium requests only the scopes needed for the feature you enable — sending email on your behalf (Gmail), creating and managing calendar events (Google Calendar), and reading and responding to reviews on your Google Business Profile. Apexium accesses, uses, stores, and shares Google user data only to provide and improve these user-facing features at your direction.

Apexium's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not use Google user data for advertising; we do not sell it; we do not transfer it to others except as necessary to provide the feature you requested, to comply with applicable law, or as part of a merger or acquisition; and we do not use it to develop, improve, or train generalized AI or machine- learning models. Humans do not read your Google user data except with your explicit consent, for security or abuse investigations, to comply with applicable law, or where the data has been aggregated and anonymized.

You can revoke Apexium's access to your Google account at any time from your Google Account permissions page or from within Apexium's integration settings.

Customer data ownership

You retain ownership of all customer data you upload. We process it solely to provide the service and per your instructions. On account termination we delete your data within 30 days (or earlier on request — see Right to Erasure below).

Security

All data is encrypted at rest and in transit. Tenant isolation is enforced at the database level via Postgres Row Level Security + a per-tenant JWT claim that drives every policy. Independent backup channels protect against data loss. Incident response: see Terms of Service.

Your rights

You can access, export, correct, or delete your data at any time:

• Right to access (GDPR Article 15): workspace settings → Members + Account view
• Right to data portability (GDPR Article 20): admin can request a complete data export (JSON bundle, 7-day signed-URL delivery) via support
• Right to rectification (GDPR Article 16): edit your account info in workspace settings; contact support for corrections beyond self-service
• Right to erasure (GDPR Article 17): email privacy@apexium.team for immediate hard-delete; otherwise 30-day grace period applies via standard termination
• California Consumer Privacy Act (CCPA): California residents may exercise equivalent rights via the same channels; "Do Not Sell My Personal Information" link in footer (we don't sell data; the link is for compliance)

For any GDPR/CCPA/other regulatory request, email privacy@apexium.team. We respond within statutory time limits (typically 30 days for GDPR).

Cookies

Apexium uses cookies in three categories:

• Strictly necessary (always on): authentication session tokens, security enforcement (CSRF protection), referral attribution (apexium_ref cookie set when visitors arrive via affiliate links), error tracking (Sentry; no PII transmitted by design — sanitized at the SDK layer).
• Analytics (opt-in via banner): anonymized usage metrics. NOT active at v1; reserved for future analytics integration with consent gating in place.
• Marketing (opt-in via banner): personalized content + ad targeting. NOT active at v1; reserved for future marketing integration with consent gating.

You can manage your cookie preferences via the footer "Manage cookie preferences" link (available on all marketing/public pages).

Data retention

• Active accounts: data retained for the duration of your subscription.
• Soft-deleted workspaces: 30-day grace period for restoration; admin-initiated via support.
• Hard-deleted workspaces: data permanently removed after grace period; audit log entries persist (with NULL tenant reference) for forensic compliance.
• Account-level deletion request: immediate hard-delete on customer request (waives 30-day grace).
• Backup retention: 30 days encrypted backup; rotated.

Changes

We'll notify customers via email at least 30 days before any material change to this policy. Continued use of the service after the effective date constitutes acceptance.

Contact

APEXIUM MARKETING LLC 8206 Louisiana Blvd NE, Ste A #7450, Albuquerque, NM 87113 Questions: privacy@apexium.team

Note: This is a starting-point policy. Before public launch we'll have this document reviewed by counsel for compliance with applicable laws (GDPR, CCPA, etc.) and updated if needed. Tracked as D-C8 in the launch checklist.