Apex: Privacy Policy

Last updated: September 26, 2026

This Privacy Policy explains how 1000849838 Ontario Inc. ("Apex", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Apex learning platform (the "Service"), including as part of the Apex by Rayan program. It uses the same defined terms as our Terms of Service.

If you do not agree with this Policy, do not use the Service. For privacy questions or to exercise your rights, contact us at admin@apexecommerce.co.

1. Who We Are (Data Controller)

The data controller responsible for your personal information is 1000849838 Ontario Inc., a corporation established in Ontario, Canada, which operates the Service and sells and provides the Apex by Rayan program. Contact: admin@apexecommerce.co.

Program payments are made through a third-party payment platform (Section 7) and may be received on our behalf by our US affiliate, Apex Ecommerce Group LLC (the "Payment Affiliate"), located at 30 N Gould St Ste R, Sheridan, WY 82801, United States, which handles payments in US dollars. It handles purchase and payment records on our behalf and responds to payment disputes about them, and it also keeps payment records to meet its own tax and accounting obligations. You can reach it at the same email address, admin@apexecommerce.co.

2. Notice at Collection (Summary)

We collect the categories of personal information below to provide the Service, secure your account and protect our content, communicate with you, administer the Apex by Rayan program where you purchased it (including sharing payment records with the Payment Affiliate described in Section 1), respond to payment disputes, and comply with law. We do not sell your personal information and do not "share" it for cross-context behavioral advertising. We retain information as described in Section 10. Details follow.

3. Information We Collect

A. Discord account data (via OAuth login). When you log in with Discord, we request only the access needed to identify you and confirm your membership: we receive your Discord ID, username/handle, display name, avatar, and email address, and we verify that you hold the paid "Member" role in the Apex Discord server. Our Discord bot also refreshes your display name and avatar from the Apex server periodically, so the Service shows the ones you currently use. We do not request access to your Discord messages, friends, or other servers beyond what is needed to confirm your membership and the "Member" role.

B. Identity, contact, and recovery data. At sign-up we collect your first and last name, an email address, which we verify with a one-time code, and a phone number. We collect the phone number for our records and to contact you; we may also verify it with an SMS one-time code. We use this information for account recovery, security, accountability, and, where you purchased the program, program administration.

C. Learning and submission data. Watch/progress data (which lessons you've watched and your completion progress), homework files you upload, product-test journal entries and any files you upload to them, and mentor notes and messages exchanged about your submissions.

D. Security and anti-piracy telemetry. IP address, device and browser information, and session information. Your IP address can indicate an approximate, city or country level location; we do not collect precise GPS location and do not track your physical movements. These are personal data. We use them to secure your account, detect account sharing and other abuse (for example, by reviewing login and video-play activity by IP address and device), maintain a security and activity log of events such as logins and content access, and power the per-user content watermark.

E. Watermark/identity shown on content. To protect content and make it traceable, while you watch a video our player displays a visible watermark over it showing your name and Discord handle and, when the player is wide enough to fit them (for example, on most computer screens), your IP address and the current date and time, and if we offer downloadable resources or images, identifying information may be stamped onto them. The watermark is displayed by our own player; your identity is not sent to our video host for this purpose. You acknowledge this when you sign up (see Terms, Section 6). The legal basis for this is in Section 4.

F. Communications. Messages you send us (for example, support requests) and the verification and account emails we send you.

G. Purchase and program records. If you purchased the Apex by Rayan program, we and the Payment Affiliate keep records of your purchase, such as the offer you bought, your purchase date, the fee, your payment plan and payment status, and any Performance Guarantee claim, and may keep records of your attendance and participation in calls and the Discord community. Card and bank details are handled by the payment provider you paid through; the Service never collects or stores them.

H. Rank and revenue data (optional). If you verify a figure for a rank (Section 23 of the Terms), we collect the evidence you choose to give us:

• Screen recordings. The revenue screen recording you upload (and any screenshot you sent before recordings were required), your note, the rank you asked for, and the figure and decision a staff member records after reviewing it. A recording shows whatever was on your screen, so record only your Shopify dashboard.
• A connected Shopify store. The access key Shopify issues when you approve the Apex app (a short-lived key and the key that renews it, both stored encrypted), the store address, the permissions you approved, and the store's contact email address as set in Shopify (used only to flag when a connected store appears to belong to someone else). With these we read your store's order payment totals, order dates, currency, and whether orders are test, cancelled, unpaid, or manually marked as paid, so that we can calculate a lifetime figure. We keep only the aggregate (total per currency, number of orders, the date of the oldest order, and, for other currencies, the exchange rate we used to convert to US dollars) and the date of each read. We never store individual orders, and we do not read your customers' names, contact details, or addresses.
• Your rank. Your verified lifetime figure, your rank, and the dates you reached them.

Your rank, and the leaderboard details described in Section 23.3 of the Terms, are visible to other members.

We do not knowingly collect special-category/sensitive personal data, and you should not submit it in homework or journal entries. Certain data we collect (account log-in credentials) may be treated as "sensitive personal information" under some U.S. state laws; we use it only to provide and secure the Service, not to infer characteristics about you (see Section 9).

4. How and Why We Use Your Information (and Legal Bases)

We use your information for the purposes below. Where the GDPR or UK GDPR applies, the legal basis is shown.

Where we rely on legitimate interests, we have carried out a balancing test: our interest is protecting high-value intellectual property, our members, and our business from content theft and account sharing; we considered your reasonable expectations (you are told before sign-up that your identity is shown on screen during playback) and your privacy, and we use the minimum data needed (your name and Discord handle and, where shown, your IP address and a timestamp for the watermark, and IP, device, and session data for security). We concluded these interests are not overridden by your rights, given the targeted, security-only use and the prominent up-front disclosure. The per-user watermark and the display of your identity are a condition of access, not optional consent: they cannot be switched off while you use the Service, because they are how the content is protected. You may object to legitimate-interests processing (Section 9), but where processing is strictly necessary for security, anti-piracy, or providing access, an objection may mean we can no longer provide the Service to you. You can request a summary of our balancing assessment at admin@apexecommerce.co. Where we rely on consent (for example, where SMS verification requires it), you may withdraw it as described in Section 9.

5. Automated Decision-Making

Our anti-piracy and abuse controls (watermark traceability, our account-sharing rules, and security and activity logs) help us detect possible violations and can lead to account suspension or termination. We do not make decisions producing legal or similarly significant effects about you solely by automated means: a human reviews and decides any enforcement action that has a significant effect on you, so the safeguards in Article 22(3) of the GDPR apply. You have the right to obtain human intervention, to express your point of view, and to contest the decision, and you may request human review as described in the Terms (Section 13). Account access may be revoked automatically when your Discord "Member" role is removed (a human action in Discord); any account termination or suspension decision is made or reviewed by a person.

Separately, if you connect a store for rank verification, your rank may be awarded automatically when the figure we read reaches a threshold. This is a cosmetic status inside the Program: it produces no legal or similarly significant effect, and it can never lower your rank or your access. You can ask a person to review your figure or rank at any time at admin@apexecommerce.co.

6. We Do Not Sell Your Personal Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are used under U.S. state privacy laws. The Service has no advertising network and no member-to-member marketplace features. The only information other members can see about you is what the rank leaderboard shows (Section 3.H of this Policy and Section 23.3 of the Terms), and we do not disclose it to anyone outside the Program. Because we do not sell or share, there is no sale/share to opt out of; we have no obligation to act on opt-out preference signals (such as Global Privacy Control) for that purpose, though we honor applicable rights as described in Section 9.

7. How We Share Information (Service Providers / Sub-Processors)

We share personal information only as needed to run the Service and the program, with the following recipients:

Shopify appears above as the source of connected-store data rather than as our processor; your use of Shopify is governed by Shopify's own terms and privacy policy. To convert store totals in other currencies to US dollars, we request public reference exchange rates from an exchange-rate service; those requests contain only currency codes, never information about you. The other service providers above, including the Payment Affiliate for the payments it handles on our behalf but not the payment platform (which is responsible for the card and payment data it collects under its own privacy policy), act as our processors and process data only on our documented instructions under data-processing agreements (DPAs) that include the confidentiality, security, sub-processing, and (for international transfers) Standard Contractual Clauses terms required by Article 28 of the GDPR. We have executed, or will execute before relying on them, a DPA with each of those processors. The Payment Affiliate also keeps payment records to meet its own tax and accounting obligations (Section 1). We may also disclose information (a) to comply with law, legal process, or government requests; (b) to enforce our Terms and protect our rights, content, members, and safety (including investigating and acting on content theft or account sharing, and supporting takedown notices using the watermark identifier); (c) in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; and (d) to the payment platform you paid through (for example, Whop), payment processors, and card issuers when responding to a payment dispute or chargeback, limited to records of your purchase, your acceptance of our Terms, and your access to and use of the Service.

We maintain the list of providers above and will update this Policy and provide reasonable notice before adding a new processor or materially changing how an existing one handles your data.

8. International Data Transfers

We are established in Canada. We, our Payment Affiliate, and our providers (including Supabase, Discord, Bunny, Vercel, Sentry, Twilio, SendGrid, and, if you connect a store, Shopify) may process and store your information in countries other than where you live, including the United States. These countries may have data-protection laws different from yours. For transfers out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum or Swiss equivalent where applicable) and supplementary measures. Contact us for a copy of the relevant safeguards.

9. Your Privacy Rights

Depending on where you live, you may have rights to:

• access the personal information we hold about you, and request a copy (the Service supports data export);
• correct inaccurate information;
• delete your information (the Service supports deletion and anonymization; some data may be retained as described in Section 10);
• object to or restrict certain processing, and withdraw consent where we rely on it;
• data portability; and
• lodge a complaint with your local data-protection authority.

For California residents (CCPA/CPRA) and residents of other U.S. states with similar laws: you have rights to know, access, correct, and delete your personal information, to limit the use of sensitive personal information, and to not receive discriminatory treatment for exercising these rights. For transparency:

• Categories of personal information we collect: identifiers (e.g., name, Discord ID, username, email, phone); internet/network and device activity (IP, device/browser, session); account log-in credentials; user-generated content (homework, journal entries, files, messages); and commercial information (purchase and payment-plan records, where you bought the program, and the aggregate store revenue figures you choose to verify for a rank). We do not collect biometric data and do not knowingly use audio/visual data beyond the content you submit.
• Sources: you, Discord, Shopify (only if you connect a store), the Payment Affiliate and the payment provider or sales channel you purchased through, and your device/usage of the Service.
• Third parties to whom we disclose for a business purpose: the service providers listed in Section 7, including, where you purchased the program, the Payment Affiliate (for payments and payment disputes).
• Sensitive personal information: any sensitive PI (account log-in credentials) is used only to provide and secure the Service, not to infer characteristics, so the right to limit its use is generally not triggered; you may still contact us to exercise it where it applies.
• Retention: see Section 10.

As noted in Section 6, we do not sell or "share" personal information for cross-context behavioral advertising.

For residents of Canada: where Canadian privacy law (such as PIPEDA or a provincial equivalent) applies, you may request access to and correction of your personal information and withdraw consent where we rely on it (subject to legal and contractual restrictions). We respond to access requests within 30 days of receiving them. Where the law allows us more time, we will tell you before the 30 days end why we need it and when to expect our response. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

To exercise any right, contact us at admin@apexecommerce.co (you may also reach us through the designated Discord support channel). We will verify your request (typically using your Discord identity, your verified email address, and/or the phone number on your account). Where the GDPR or UK GDPR applies, we respond within one month of receiving a verifiable request (extendable by up to two further months for complex requests, with notice). Where U.S. state privacy laws apply, we confirm receipt within 10 business days and respond within 45 days (extendable once by a further 45 days with notice). We do not charge a fee for exercising your rights except where a request is manifestly unfounded, excessive, or repetitive, as permitted by law. You may use an authorized agent where the law allows. If we decline a request, we will tell you why and how to appeal or complain.

10. Data Retention

We keep personal information for as long as your account is active and as needed to provide the Service, and afterward as needed to comply with legal, tax, and accounting obligations, enforce our Terms and resolve disputes, and maintain security records and investigate content theft or abuse. We use the following categories and criteria:

The Service supports data export and deletion: when an account is deleted or deactivated, we first place certain records in a hidden/locked state (for example, to preserve homework and journal history, prevent account "resurrection," and meet legal and security needs), and we then anonymize or permanently delete your personal information within the maximums above (no longer than 90 days for soft-deleted records) by an automated process. The only exceptions, kept after that window and to the extent permitted by law, are your consent and acceptance records, records of your program purchase, payment plan, and payments (kept for as long as tax and accounting law requires and until any amount owed is resolved), and our security and anti-piracy activity logs (for example, login and content-access events with IP address and device), which we retain only for as long as reasonably needed to establish, exercise, or defend legal claims, prevent fraud, and protect our content. You can ask us to erase your data sooner by contacting admin@apexecommerce.co, subject to those same legal-claims and security exceptions.

11. Security

We use technical and organizational measures designed to protect your information, including private (non-public) file storage with short-lived signed access links, access controls, DRM and per-user watermarking for video content, security and activity logging (for example, logins and content access), and server-side permission checks. The access key for any store you connect is encrypted with AES-256-GCM before it is stored, using a key kept outside our database; the key Shopify issues expires after an hour and is renewed automatically, so a copy of an old one stops working. Staff with access to member data use additional protections such as two-factor authentication. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law (for example, where the GDPR applies, notifying the supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay).

12. Cookies and Essential Storage

The Service uses only essential cookies and similar local/session storage that are strictly necessary to run it, including:

• a secure session/authentication cookie or token (via Supabase Auth) to keep you logged in; and
• security tokens (for example, to protect against cross-site request forgery).

These are set when you log in and expire on logout or after 7 days. We use no advertising or cross-site tracking cookies. Our error-monitoring provider (Sentry) is configured not to capture your IP address or other personal data and is used for diagnostics, not advertising. If we use hosting-level performance measurement from Vercel, it is configured to be privacy-friendly and cookieless and is not used to build a profile of you or for advertising. You can control cookies through your browser settings, but disabling essential storage may prevent the Service from working.

13. Children's Privacy

The Service is not directed to children under 13, and Discord itself requires users to be at least 13. If you are under 18 (or the age of majority where you live), you may use the Service only with a parent or legal guardian's consent, as described in our Terms. We do not knowingly collect personal information from children under 13. If we learn we have collected data from a child under 13 (or under any minimum age required by law), we will hard-delete it (not place it in soft-deletion/retention) and terminate the account. If you believe a child has provided us information, contact us at admin@apexecommerce.co.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and ask you to review and accept the updated Policy before you continue using the Service. For other changes, your continued use of the Service after they take effect means you accept the updated Policy.

15. EU/UK Representative and Data Protection Contact

We are established in Canada (our Payment Affiliate described in Section 1 is established in the United States), and neither has an establishment in the EU or UK. To the extent Article 27 of the GDPR or UK GDPR requires a controller outside the EEA or UK that offers services to people in the EEA or UK to appoint an in-territory representative, we will appoint one and update this Policy with their name and contact details (or state the applicable exemption under Article 27(2)). We have not appointed a Data Protection Officer because we are not required to under Article 37; our privacy contact for all questions and requests is admin@apexecommerce.co. You also have the right to lodge a complaint with your local data-protection or privacy authority (for EEA residents, your national supervisory authority; for UK residents, the Information Commissioner's Office; for California residents, the California Privacy Protection Agency or the Attorney General).

16. Contact Us

1000849838 Ontario Inc., Ontario, Canada. Email: admin@apexecommerce.co. You can also reach us through the designated Discord support channel.

Our Payment Affiliate, Apex Ecommerce Group LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States, can be reached at the same email address.