Privacy Policy

Introduction

Apex Operating Systems Inc ("Apex," "we," "us," or "our") operates the Apex mobile application and related services. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our application.

By using Apex, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the application.

Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, professional headshot, and brokerage affiliation
• Profile Data: Nickname, state/location, and professional details you choose to share
• Communications: Messages sent through the Apex chat system and voice interactions with Apex AI
• Content: Videos recorded through the Reels feature, comments, and posts shared within the Apex community

Information Collected Automatically

• Usage Data: Feature interactions, session duration, screens viewed, and actions taken within the app
• Device Information: Device type, operating system, app version, and unique device identifiers
• Performance Data: Crash logs, diagnostics, and performance metrics to improve app stability

Information from Device Permissions

• Camera: Used for recording reels, uploading professional headshots, and video features. Accessed only when you actively use these features.
• Microphone: Used for voice commands with Apex AI and audio recording in reels. Accessed only during active recording or voice interaction.
• Contacts: Used to suggest invites through the Apex referral system. Contact data is processed locally and never uploaded to our servers without your explicit action to send an invite.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Apex platform and its features
• Authenticate your identity and secure your account
• Deliver AI-powered coaching, insights, and personalized recommendations
• Process and display your performance data, leaderboard rankings, and Brand Mission progress
• Facilitate the Ambassador referral and affiliate commission program
• Calculate and display usage-based billing (dedicated line, AI minutes, transcription, storage)
• Send transactional notifications (referral signups, commission earned, rank changes)
• Improve app performance, fix bugs, and develop new features
• Enforce our Terms of Service and community standards

Lawful Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions requiring a lawful basis, we process your data under the following legal grounds:

• Contractual Necessity: Processing required to provide you with the Apex platform and services you signed up for (account management, AI coaching, billing, leaderboard)
• Legitimate Interest: Processing for app improvement, security, fraud prevention, and analytics, where our interests do not override your fundamental rights
• Consent: Processing for optional features such as contact access for referrals, marketing communications, and voice interactions with Apex AI. You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with applicable laws (e.g., financial record-keeping, responding to lawful requests)

We never sell your personal data to third parties, and we never sell or share your mobile phone number or SMS opt-in data with third parties or affiliates for marketing or promotional purposes.

SMS / Text Messaging

By providing your phone number and opting in, you consent to receive appointment, account, and support text messages from Apex. Message and data rates may apply. Message frequency may vary. Reply STOP to opt out at any time, or HELP for help. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are not shared with any third parties under any circumstances.

AI Processing & Voice Data

When you interact with Apex AI (chat or voice), your input is processed to generate responses, coaching insights, and performance analysis. Specifically:

• Voice inputs are transcribed using secure speech-to-text services and are not stored after processing
• Chat conversations are retained to provide context continuity and improve AI quality
• AI-generated insights are personalized to your account and are never shared with other users
• We do not use your conversations to train third-party AI models

Tracking, Cookies & Local Storage

App Tracking Transparency (iOS)

Apex does not track you across other companies' apps or websites. We do not participate in advertising networks or use IDFAs (Identifier for Advertisers) for cross-app tracking. If Apple's App Tracking Transparency prompt appears, you may decline with no impact on app functionality.

Local Storage & On-Device Data

The Apex mobile app uses on-device storage technologies to provide a seamless experience:

• Secure Token Storage: Your authentication token (JWT) is stored in your device's secure keychain/keystore to keep you logged in
• Preferences: App settings and display preferences are stored locally on your device
• Cache: Temporary data (profile images, UI assets) may be cached locally to improve performance

We do not use browser cookies in the mobile app. Our website (apexopsystems.com) uses essential cookies only for session management, no third-party advertising or tracking cookies are used.

Analytics & Opt-Out

We collect anonymized usage analytics to improve app performance and user experience. These analytics do not include personally identifiable information. You may opt out of analytics collection at any time by contacting us at the email below or through the app's settings when available. Opting out will not affect your ability to use any Apex features.

"Do Not Track" Signals

As required by CalOPPA (California Online Privacy Protection Act): Apex honors "Do Not Track" (DNT) browser signals. When we detect a DNT signal, we do not engage in any cross-site tracking. Note that since Apex does not perform cross-app or cross-site tracking in any case, your experience will be identical regardless of your DNT setting.

Data Sharing & Disclosure

We may share your information only in the following circumstances:

• Service Providers: With trusted third-party services that help us operate the platform (cloud hosting, payment processing, analytics) under strict data processing agreements
• Community Features: Your name, headshot, nickname, and performance data (leaderboard rank, closings) are visible to other Apex members through community features you participate in
• Legal Requirements: When required by law, subpoena, or to protect the rights, safety, or property of Apex, its users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Data Storage & Security

Your data is stored on secure cloud infrastructure provided by Cloudflare. We implement industry-standard security measures including:

• Encryption of data in transit (TLS 1.3) and at rest
• Secure authentication using JWT tokens with 24-hour expiration
• Password hashing using PBKDF2-SHA256
• Automatic session invalidation on logout
• Regular security audits and vulnerability assessments

Payment information is processed by our payment partners (NMI) and is never stored on Apex servers.

Data Breach Notification

In the unlikely event of a data breach that compromises your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as required by GDPR and consistent with industry best practices. Notification will be provided via email to the address associated with your account, and where required by law, to the appropriate supervisory authority. The notification will include the nature of the breach, the data affected, and steps we are taking to address it.

International Data Transfers

Apex uses Cloudflare's global edge network, which means your data may be processed at Cloudflare data centers in various countries around the world, including outside your country of residence. Regardless of where your data is processed, we apply the same security protections described in this policy.

For users in the European Economic Area (EEA) or United Kingdom: when your data is transferred outside the EEA/UK, it is protected by:

• Cloudflare's adherence to Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers that require equivalent levels of protection
• Technical safeguards including encryption in transit and at rest

Data Retention

• Active Account Data: Retained for the duration of your active membership
• Post-Termination: Account data retained for 90 days after termination, then permanently deleted
• Billing Records: Financial transaction records retained for 7 years as required by law
• Voice Transcriptions: Deleted immediately after processing, not stored long-term
• Usage Analytics: Aggregated (non-identifiable) analytics may be retained indefinitely

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Delete your personal data (subject to legal retention requirements)
• Export your data in a portable format
• Withdraw Consent for optional data processing at any time
• Opt Out of marketing communications
• Restrict Processing in certain circumstances (e.g., while we verify accuracy of disputed data)
• Object to processing based on legitimate interests

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including:

• The right to know what personal information is collected, used, shared, or sold
• The right to request deletion of personal information
• The right to opt out of the sale or sharing of personal information (Apex does not sell your data)
• The right to correct inaccurate personal information
• The right to non-discrimination, you will not receive different pricing, service quality, or access levels for exercising your privacy rights

To submit a verifiable consumer request, email us at the address below. We will verify your identity before fulfilling any request and respond within 45 days.

EEA/UK Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, you additionally have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed in violation of applicable law.

Children's Privacy

Apex is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will take immediate steps to delete that information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Third-Party Services

Apex integrates with trusted third-party service providers for core functionality, including but not limited to cloud infrastructure and hosting, payment processing, customer relationship management, and communications and messaging. Each provider operates under its own privacy and security commitments and processes data only as needed to deliver our services. We do not sell your personal data, and we do not share your mobile phone number or SMS opt-in data with third parties or affiliates for marketing or promotional purposes.

Dispute Resolution

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy or the processing of your personal data shall be resolved as follows:

• Informal Resolution: We encourage you to contact us first at the email below. We will work in good faith to resolve your concern within 30 days.
• Binding Arbitration: If we cannot resolve the dispute informally, either party may elect to resolve the dispute through binding arbitration administered by JAMS under its Streamlined Arbitration Rules, conducted in the State of California. Each party shall bear its own costs.
• Class Action Waiver: You agree that any dispute resolution proceedings will be conducted on an individual basis and not in a class, consolidated, or representative action.
• Exceptions: Nothing in this section limits your right to file a complaint with a government agency (including data protection authorities) or to seek injunctive relief in court for intellectual property or data security claims.

This section shall be governed by the laws of the State of California, United States, without regard to conflict of laws principles.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or via email. Continued use of Apex after changes are posted constitutes your acceptance of the updated policy.

The "Last Updated" date at the top of this page indicates when the most recent revision was made.