Who this covers
- Customers: people who create an Apex account and set up an assistant, and people on our waitlist. We are the data controller for your account data.
- Visitors: people who chat with an assistant on a customer's website. The customer is the data controller; we process visitors' data on their behalf and only on their instructions.
This policy describes how Apex Bot works today. How we protect the data is explained in more detail on the Security page.
What we collect
From customers
| Data | Why |
|---|---|
| Name, username, email, account type, company name and size (business accounts) | To create and run your account and workspace |
| Password, stored only as a salted scrypt hash. Accounts that use Google or GitHub have no password unless you set one | To sign you in |
| If you sign in with Google or GitHub: the provider's account ID and your verified email and name. We never see your Google or GitHub password and never post anything to your account | To sign you in and link the provider to your account |
| When you accepted the Terms, which version, and your choice about model training | To keep a record of your consent |
| Security log: sign-ins, failed sign-ins, verification and password-reset requests, password changes, signing out of other devices, and account deletion, each with time, IP address and browser | To protect accounts, limit guessing and abuse, and investigate incidents |
| Active sessions: IP address, browser, and when each was last used | To keep you signed in and let you sign out other devices |
| Your assistant's settings, the websites you allow it on, the pages Apex reads from your website and any text you add | To answer your visitors |
| The hand-off email address you set, and the confirmation code we send to it | To confirm the address is yours before we email it |
| Daily count of AI tokens each assistant uses | To enforce the daily budget you set and keep costs predictable |
| Email address (and the language of the page) if you join the waitlist | To tell you once, when sign-ups open. We don't use it for anything else |
From visitors of a customer's website
| Data | Why |
|---|---|
| Messages the visitor writes and the assistant's replies, with the source pages shown under each answer | To hold the conversation and show it to the customer |
| Thumbs up or down on an answer | To show the customer which answers need work |
| The website address the chat took place on | To enforce the allowed-websites list and group conversations |
| Name, email and phone, only if the visitor chooses to type them (hand-off request or the customer's lead form) | To pass the request or lead to the customer by email and show it in their dashboard |
| The visitor's IP address, held briefly in memory | To rate-limit messages per visitor. It is not saved with the conversation |
We don't sell personal data, we don't use it for advertising, and we don't build advertising profiles. Visitors are not asked to create an account, and the widget tells them they are talking to an AI. Visitors should not be asked for sensitive information (health, payment cards, ID numbers) through the chat; if one types it anyway, it is handled like any other message, and the card, phone, email and IBAN patterns are masked from our logs.
How we use data
- To provide the service: sign you in, answer visitors, deliver hand-offs and leads, show conversations.
- To keep the service safe: rate limits, bot checks, abuse detection and incident investigation.
- To email you: verification and password-reset codes, hand-off and lead notifications, and security notices.
- To improve our own models, only if you opted in (see below).
- To meet legal obligations.
Legal bases (GDPR) and conditions (KVKK): performing our contract with you; our legitimate interest in security and preventing abuse; your consent where we ask for it (model training, waitlist); and legal obligations. For visitors' data, the customer decides the purpose and legal basis.
Who else handles data
We use a small number of service providers (sub-processors), each only for the job listed. We don't give them more than that job needs.
| Provider | What for | Data involved |
|---|---|---|
| Anthropic, OpenAI or Google (the one the customer selected for that assistant) | Generating answers | The visitor's message, recent messages of the conversation and the relevant parts of the customer's content |
| Supabase (managed PostgreSQL) | Database | Everything we store: accounts, settings, knowledge, conversations |
| Vercel | Hosting the website and dashboard | Requests to the website, including IP addresses |
| Render (Frankfurt, Germany) | Hosting the chat API that the widget talks to | Chat requests and the conversation in progress |
| Resend | Sending email | Recipient address and the content of the message (codes, hand-offs, leads) |
| Cloudflare Turnstile | Telling humans from bots on sign-up, log-in, password reset and the waitlist | A challenge token, your IP address and browser signals needed to run the check |
| Google and GitHub | "Sign in with" buttons, only if you use them | What the provider sends back (see above) |
AI providers process the data under their API terms to return the answer. Some providers are based outside Turkey and the EU/EEA, so data may be transferred abroad; where required we rely on the safeguards the law provides, such as standard contractual clauses, and on the provider's own commitments. We may also disclose data when a court or authority legally requires it.
Model training
We only use a customer's assistants and conversations to improve our own models if the customer opted in at sign-up. The default is no. You can change this at any time in the dashboard under Settings, or by contacting us; it affects data going forward.
How long we keep data
| Data | How long |
|---|---|
| Conversations and the contact details inside them | Deleted automatically once idle for the retention period the customer sets, from 1 to 365 days (30 by default). The customer can delete any conversation sooner from the dashboard, and a visitor can ask the customer to erase their chat |
| Sessions | 24 hours for a browser session, 30 days with "keep me signed in". Signing out, changing your password or resetting it ends them early |
| Verification and reset codes | Valid for 15 minutes; stored only as a hash |
| Account data, settings and knowledge | As long as the account exists. When you delete the account they are deleted too, unless the law requires us to keep something |
| Security log | Kept so we can investigate abuse and incidents. When you delete your account the entries are unlinked from it, and you can ask us to erase the ones that carry your email address or IP address (we may keep what the law requires) |
| Waitlist email | Until sign-ups open and we've told you, or until you ask us to remove it |
| Daily token counts | With the assistant they belong to |
| Application logs | A limited time, with emails, phone numbers, card numbers and IBANs masked before they're written |
Data held by our providers can remain in their backups for a short extra period after we delete it, and is removed when those backups rotate.
Cookies and browser storage
| Name | What it does | Lifetime |
|---|---|---|
| apex_session | Keeps you signed in. Strictly necessary; HttpOnly, so page scripts can't read it | Browser session, or 30 days if you chose "keep me signed in" |
| apex_signed_in | A harmless flag that lets our public pages show "Dashboard" instead of "Log in". Contains no personal data | Same as the session |
| Language cookie | Remembers the language you picked | 1 year |
| apex_oauth | Protects a Google or GitHub sign-in in progress. Single use | 10 minutes |
We use no advertising or analytics cookies. The chat widget sets no cookies; depending on the customer's settings it keeps only the current conversation's ID in the visitor's browser (for the tab, for the browser, or not at all). When Cloudflare Turnstile runs, it may use its own storage to do its job.
Your rights
You can ask to know whether we process your data, access it, correct it, export it, delete it, restrict or object to how we use it, or withdraw consent (KVKK article 11 and GDPR).
- Delete your account yourself in the dashboard under Settings. It removes your account, and any workspace you were the only member of, with its assistants, knowledge and conversations.
- Control your sessions: change your password and sign out every other device from Settings.
- Visitors should contact the website they chatted on to see or erase their conversation; we help that customer respond.
- For anything else, including a copy of your data, email hello@apexbot.eu. We reply within 30 days. We may need to verify it's you before acting.
You can also complain to your data protection authority (in Turkey, the Personal Data Protection Authority, KVKK; in the EU, the authority in your country).
If you are a customer: your duties
You are the controller of your visitors' data. That means you decide what the assistant collects, you need a lawful basis for it, and you must give your visitors the notices KVKK, GDPR or similar laws require (the widget can show a disclaimer line with links to your own policy). Pick a retention period that matches what you tell them. If we are asked about a visitor's data, we'll refer them to you and help you respond. Our Terms of Service cover this too.
Security
Data is encrypted in transit, access is restricted per workspace, passwords are hashed with scrypt and the assistant only answers on the websites you allow. The Security page explains this in detail. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.
Children
Apex is for businesses and adults. We don't knowingly collect data from children under 16 to run an account. If you think a child has given us data, contact us and we'll delete it.
Changes and contact
We'll update this page as the product changes and notify account holders of material changes before they take effect. The date of the latest change is at the top. Questions or requests: hello@apexbot.eu.