Apex: Privacy Policy

Last updated: June 17, 2026

This Privacy Policy explains how Apex Ecommerce Group LLC ("Apex", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Apex learning platform and mentorship program (the "Service"). It uses the same defined terms as our Terms of Service.

If you do not agree with this Policy, do not use the Service. For privacy questions or to exercise your rights, contact us at admin@apexecommerce.co.

1. Who We Are (Data Controller)

The data controller responsible for your personal information is Apex Ecommerce Group LLC, located at United States. Contact: admin@apexecommerce.co. [IF REQUIRED FOR EU/UK MEMBERS: EU/UK REPRESENTATIVE (GDPR ART. 27) OR DPO DETAILS, PLACEHOLDER.]

2. Notice at Collection (Summary)

We collect the categories of personal information below to provide the Service, secure your account and protect our content, communicate with you, and comply with law. We do not sell your personal information and do not "share" it for cross-context behavioral advertising. We retain information as described in Section 7. Details follow.

3. Information We Collect

A. Discord account data (via OAuth login). When you log in with Discord, we receive your Discord ID, username/handle, avatar, and email address, and we verify that you hold the paid "Member" role in the Apex Discord server.

B. Identity and recovery data (optional). We may collect and verify an email address and a phone number (via an SMS one-time code) for account recovery, security, and accountability.

C. Learning and submission data. Watch/progress data (which lessons you've watched and your completion progress), homework files you upload, product-test journal entries and any files you upload to them, and mentor notes and messages exchanged about your submissions.

D. Security and anti-piracy telemetry. IP address, device and browser information, session information, and approximate location. These are personal data. We use them to secure your account, enforce the one-active-session rule, detect abuse, and power the per-user content watermark.

E. Watermark/identity embedded in content. To protect content and make it traceable, your Discord handle/identifier and a timestamp are embedded as a visible watermark into videos while you watch, and identifying information may be stamped onto downloadable resources/images. You acknowledge this when you sign up (see Terms, Section 6). The legal basis for this is in Section 4.

F. Communications. Messages you send us (for example, support requests) and our transactional emails to you.

We do not knowingly collect special-category/sensitive personal data, and you should not submit it in homework or journal entries. Certain data we collect (account log-in credentials and approximate geolocation) may be treated as "sensitive personal information" under some U.S. state laws; we use it only to provide and secure the Service, not to infer characteristics about you (see Section 9).

4. How and Why We Use Your Information (and Legal Bases)

We use your information for the purposes below. Where the GDPR or UK GDPR applies, the legal basis is shown.

Where we rely on legitimate interests, we have weighed those interests against your privacy and minimized the data used to what is needed for security, anti-piracy, and providing the Service. You may object to legitimate-interests processing (Section 9), but objecting to processing that is essential to security or access may mean we can no longer safely provide the Service. Where we rely on consent (for example, where SMS verification requires it), you may withdraw it as described in Section 9.

5. Automated Decision-Making

Our anti-piracy and abuse controls (watermark traceability, the one-active-session rule, and security telemetry) help us detect possible violations and can lead to account suspension or termination. A human reviews enforcement decisions that have a significant effect on you, and you may contest a decision and request human review as described in the Terms (Section 13). [CONFIRM whether any termination/suspension is fully automated; if so, GDPR Art. 22 disclosures and a human-review right must be stated explicitly; see lawyer notes.]

6. We Do Not Sell Your Personal Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are used under U.S. state privacy laws. The Service has no advertising network and no public, social, leaderboard, or member-to-member marketplace features. Because we do not sell or share, there is no sale/share to opt out of; we have no obligation to act on opt-out preference signals (such as Global Privacy Control) for that purpose, though we honor applicable rights as described in Section 9.

7. How We Share Information (Service Providers / Sub-Processors)

We share personal information only as needed to run the Service, with the following recipients:

These providers process data on our behalf under agreements that restrict their use of it. We may also disclose information (a) to comply with law, legal process, or government requests; (b) to enforce our Terms and protect our rights, content, members, and safety (including investigating and acting on content theft or account sharing, and supporting takedown notices using the watermark identifier); and (c) in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We maintain the list of providers above and will update this Policy and provide reasonable notice before adding a new processor or materially changing how an existing one handles your data.

8. International Data Transfers

We and our providers (including Supabase, Discord, VdoCipher, Vercel, Resend, and the SMS provider) may process and store your information in countries other than where you live, including the United States. These countries may have data-protection laws different from yours. For transfers out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum or Swiss equivalent where applicable) and supplementary measures. Contact us for a copy of the relevant safeguards.

9. Your Privacy Rights

Depending on where you live, you may have rights to:

• access the personal information we hold about you, and request a copy (the Service supports data export);
• correct inaccurate information;
• delete your information (the Service supports soft-deletion; some data may be retained as described in Section 10);
• object to or restrict certain processing, and withdraw consent where we rely on it;
• data portability; and
• lodge a complaint with your local data-protection authority.

For California residents (CCPA/CPRA) and residents of other U.S. states with similar laws: you have rights to know, access, correct, and delete your personal information, to limit the use of sensitive personal information, and to not receive discriminatory treatment for exercising these rights. For transparency:

• Categories of personal information we collect: identifiers (e.g., Discord ID, username, email, phone); internet/network and device activity (IP, device/browser, session); approximate geolocation; account log-in credentials; and user-generated content (homework, journal entries, files, messages). We do not collect biometric data and do not knowingly use audio/visual data beyond the content you submit.
• Sources: you, Discord, and your device/usage of the Service.
• Third parties to whom we disclose for a business purpose: the service providers listed in Section 7.
• Sensitive personal information: any sensitive PI (account log-in credentials, approximate geolocation) is used only to provide and secure the Service, not to infer characteristics, so the right to limit its use is generally not triggered; you may still contact us to exercise it where it applies.
• Retention: see Section 10.

As noted in Section 6, we do not sell or "share" personal information for cross-context behavioral advertising.

To exercise any right, contact us at admin@apexecommerce.co. We will verify your request (typically using your Discord identity and/or verified email/phone) and respond within the time required by law. You may use an authorized agent where the law allows.

10. Data Retention

We keep personal information for as long as your account is active and as needed to provide the Service, and afterward as needed to comply with legal, tax, and accounting obligations, enforce our Terms and resolve disputes, and maintain security records and investigate content theft or abuse. We use the following categories and criteria:

The Service supports data export and soft-deletion: when an account is deleted or deactivated, we retain certain records in a hidden/locked state (for example, to preserve homework and journal history, prevent account "resurrection," and meet legal and security needs) rather than always hard-deleting immediately, subject to the maximums above. We delete or anonymize personal information when it is no longer needed for these purposes. [CONFIRM SPECIFIC RETENTION PERIODS; see decisions list.]

11. Security

We use technical and organizational measures designed to protect your information, including private (non-public) file storage with short-lived signed access links, access controls, DRM and per-user watermarking for video content, the one-active-session rule, and server-side permission checks. Staff with access to member data use additional protections such as two-factor authentication. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law (for example, where the GDPR applies, notifying the supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay).

12. Cookies and Essential Storage

The Service uses only essential cookies and similar local/session storage that are strictly necessary to run it, including:

• a secure session/authentication cookie or token (via Supabase Auth) to keep you logged in;
• a session identifier used to enforce the one-active-session rule; and
• security tokens (for example, to protect against cross-site request forgery).

These are set when you log in and expire on logout or after [SESSION LIFETIME, PLACEHOLDER]. We use no advertising, analytics, or third-party tracking cookies. You can control cookies through your browser settings, but disabling essential storage may prevent the Service from working. [IF ANY NON-ESSENTIAL/ANALYTICS COOKIES ARE ADDED LATER, UPDATE THIS SECTION AND ADD A CONSENT BANNER WHERE REQUIRED.]

13. Children's Privacy

The Service is not directed to children under 13, and Discord itself requires users to be at least 13. If you are under 18 (or the age of majority where you live), you may use the Service only with a parent or legal guardian's consent, as described in our Terms. We do not knowingly collect personal information from children under 13. If we learn we have collected data from a child under 13 (or under any minimum age required by law), we will hard-delete it (not place it in soft-deletion/retention) and terminate the account. If you believe a child has provided us information, contact us at admin@apexecommerce.co.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and provide reasonable notice through the Service or the Discord server. Your continued use of the Service after changes take effect means you accept the updated Policy.

15. Contact Us

Apex Ecommerce Group LLC United States Email: admin@apexecommerce.co Or reach us through the designated Discord support channel.