Who this covers
- Customers: people who create an Apex account and set up an assistant. We are the data controller for your account data.
- Visitors: people who chat with an assistant on a customer's website. The customer is the data controller; we process visitors' data on their behalf.
What we collect
| Data | Why |
|---|---|
| Name, username, email, company and password (stored only as a secure hash) | To create and secure your account |
| Sign-in records: time, IP address and browser | To protect accounts from abuse and unauthorized access |
| Your assistant's settings and the content it learns from | To answer your visitors |
| Conversations, feedback and contact details visitors choose to share | To show the conversation, pass hand-offs and leads to the customer, and improve answers |
We don't sell personal data and we don't use it for advertising.
AI providers
To generate an answer, the visitor's message and the relevant parts of the customer's content are sent to the AI provider the customer selected (Anthropic, OpenAI or Google). They process it under their API terms to return the answer.
Model training
We only use a customer's assistants and conversations to improve our own models if the customer opted in at sign-up. The choice can be changed at any time by contacting us.
How long we keep data
- Conversations: deleted automatically after the retention period the customer sets (30 days by default).
- Account data: for as long as the account exists, then deleted unless the law requires us to keep it.
- Security logs: kept for a limited time to investigate abuse. Emails, phone and card numbers are masked in them.
Cookies
The dashboard uses one essential cookie to keep you signed in. The chat widget doesn't set cookies; it may keep the current conversation in the visitor's browser storage, depending on the customer's settings.
Your rights
You can ask to access, correct, export or delete your personal data, or object to how we use it. Visitors should contact the website they chatted on first; we'll help that customer respond. Email hello@apexbot.eu and we'll reply within 30 days. You can also complain to your data protection authority (in Turkey, the KVKK Authority).
Security
Data is encrypted in transit, access is restricted per workspace, and passwords are hashed with scrypt. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.