Privacy Policy
Kyiv · Version dated
This policy is published in English, Ukrainian, Russian and Spanish, and all versions have the same content. If the versions differ, the Ukrainian version prevails for customers in Ukraine and the English version for all other customers.
This Privacy Policy explains how Individual Entrepreneur Avdieiev Maksym Oleksiyovych (ФОП Авдєєв Максим Олексійович), Tax ID (РНОКПП): 3553509492 ("Apexline", "we", "us") collects, uses, stores and protects personal data when you use Apexline: the website apexline.win, the app at app.apexline.win and related services (the "Service"). We process personal data under the General Data Protection Regulation (GDPR), the Law of Ukraine "On Protection of Personal Data" and other applicable law.
Contents
1. Data controller
- Entity: ФОП Авдєєв Максим Олексійович
- Tax ID (РНОКПП): 3553509492
- Address: Kyiv, Kombinatna 25a, Ukraine
- Email: info@apexline.win
We are the controller of account, billing and website data. Data that a company connects or uploads about its business, employees and clients is controlled by that company; we process it on the company's behalf and only to provide the Service. If you are an employee or a client of a company that uses Apexline, contact that company first; we will help it answer your request.
2. Data we collect
- Account data: name, email address, password (we keep only a hash of it), profile photo, company name and details, and your role in the company. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Company data: what a company connects or uploads, such as CRM records, call recordings and transcripts, bank statements and transactions, meeting recordings and transcripts, and documents. It can include personal data of the company's employees and clients.
- Content created in the Service: chats with AI roles, settings, tasks and decisions, and AI output such as briefs, insights and proposed decisions.
- Phone calls: if a company enables Diego (AI Receptionist), the caller's phone number, the call audio and its transcript.
- Sales calls: if a company uses Nika (AI Head of Sales), the recordings of its sales calls that members upload, the client's name and phone number, who was on the call, the transcript and the call analysis.
- Onboarding brief: if we send you a personal link to the onboarding brief, your answers, the documents you upload, the facts read from your company's public website, and the text of answers you give by voice (we do not keep the recording). The answers prepare the setup of your company in Apexline.
- Payment data: plan, amounts, dates and payment status. Card details are entered on WayForPay's page; we never receive or store card numbers or CVV codes.
- Technical data: IP address, browser and device information, sign-in and security events, and server logs.
- Support messages: what you write to us or to support in the app.
3. Why we use data
| Purpose | Legal basis |
|---|---|
| Providing the Service: accounts, companies, AI roles working on company data, briefs and insights | Contract |
| Payments, invoices and accounting | Contract; legal obligation |
| Service emails: sign-up confirmation, password reset, billing and important changes | Contract |
| Security, bot protection and abuse prevention | Legitimate interests |
| Answering support requests | Contract; legitimate interests |
| Complying with the law and lawful requests from authorities | Legal obligation |
We do not sell personal data, do not use it for advertising, and do not use company data to train AI models. We send marketing emails only if you have agreed to receive them.
4. AI processing and transparency
- AI roles, such as Mara (AI Chief of Staff), process company data with AI models from Anthropic. Each task receives only the data it needs, within the access rights of the member and the role. Under its commercial terms, Anthropic does not train its models on our customers' data.
- Sales calls for Nika (AI Head of Sales) are transcribed and analysed by Closr, our sister product for sales call analysis. Closr keeps the recordings and transcripts; Apexline keeps the list of calls and Closr's analysis of each one. Closr uses Deepgram to transcribe the calls and Google's Gemini models to analyse them.
- All AI output is labelled as AI, in line with the transparency rules of the EU AI Act. AI roles that talk to a company's clients say they are AI at the start of the conversation and whenever asked, and a person can take over.
- We do not make decisions with legal or similarly significant effects about anyone solely by automated means. Employee assessments prepared by Elena (AI People Partner) are suggestions: a manager reviews them, the employee can see the evidence and contest the result, and people make the decisions. Assessments do not use emotion recognition or tone of voice.
- Calls and meetings are recorded only when the company turns recording on. The company is responsible for informing participants and obtaining consent where the law requires it.
5. Service providers
We use these providers (sub-processors) to run the Service. Each receives only the data it needs for its task.
| Provider | What it does | When it receives data |
|---|---|---|
| Supabase | Database, sign-in and file storage, hosted in the EU (Frankfurt, Germany) | Always |
| Vercel | Hosting of the website and the app | Always: IP address and request data |
| Anthropic | AI models behind the AI roles; under its commercial terms, Anthropic does not train its models on our customers' data | When an AI role works on a task |
| ElevenLabs | Voice for phone calls; speech-to-text for answers given by voice in the onboarding brief | Only if the company enables Diego (AI Receptionist), or when you answer the onboarding brief by voice |
| fal.ai | Image generation | Only if the company uses Felix (AI Creative Director) |
| Closr | Our sister product for sales call analysis: stores the recordings and transcripts of sales calls and scores each call | Only if the company uses Nika (AI Head of Sales) |
| Deepgram | Speech-to-text for sales calls, through Closr | Only if the company uses Nika (AI Head of Sales) |
| Google (Gemini) | AI analysis of sales calls, through Closr | Only if the company uses Nika (AI Head of Sales) |
| Resend | Transactional email: sign-up confirmation, password reset, notices | When we send you an email |
| Sign in with Google | Only if you choose to sign in with Google | |
| Cloudflare | Turnstile bot protection on sign-in, sign-up and password reset | When you use these forms |
| WayForPay | Card payments; card details go directly to WayForPay and never reach Apexline | When you pay |
Services that a company connects itself, such as CRM, telephony, bank or calendar services, are chosen by the company. We exchange data with them on the company's instructions, and their own terms and privacy policies apply. We disclose data to authorities only when the law requires it. We will update this list before a new provider starts processing personal data.
6. International transfers
Our database is hosted in the EU (Frankfurt, Germany). Some providers above process data in other countries, including the United States. When personal data from the EEA is transferred outside it, we rely on safeguards recognised under GDPR, such as the European Commission's standard contractual clauses.
7. Security
- Each company's data is isolated in the database with row-level security: one company cannot access another company's data.
- Inside a company, member roles (owner, exec, manager, employee) limit what each person sees; for example, employees do not see company finances or other people's individual assessments.
- Data is encrypted in transit and at rest.
- Apexline staff do not see company data by default. Support access is read-only, time-limited, logged and shown to the owner.
- Actions by people and AI roles are recorded in an audit log that cannot be edited.
- Sign-in, sign-up and password reset are protected from bots by Cloudflare Turnstile.
If a personal data breach affects you, we will inform you and the competent authorities as the law requires.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account data | While the account exists |
| Company data | While the company's subscription is active, then 90 days after it ends or the account is closed, so it can be restored; then deleted permanently |
| Call and meeting recordings and transcripts | As set by the company; 12 months by default |
| Onboarding brief answers and files | Until you ask us to delete them; facts saved from the brief into a company's business memory are kept as company data |
| Raw data received from connected services | 90 days; results calculated from it stay with the company data |
| Connection (sync) logs | 30 days |
| Audit log | While the company account exists |
| Payment records | As long as Ukrainian tax and accounting law requires |
| Copies in backups | Removed as backups rotate, within 30 days of deletion |
The owner can ask us to delete company data before the 90 days end; we then delete it within 30 days.
9. Your rights
Depending on the law that applies to you, you can ask to access your personal data, correct it, delete it, restrict or object to its processing, or receive it in a portable format, and you can withdraw consent at any time.
To use these rights, write to info@apexline.win. We may ask you to confirm your identity and will reply within 30 days. If your data was added by a company that uses Apexline, we will pass your request to that company.
You can also complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your country.
10. Cookies and local storage
We use your browser's local storage to keep you signed in, to remember interface settings and to keep the onboarding brief link and your unsaved answers on your device; this is necessary for the Service to work. We do not use advertising or analytics cookies.
11. Google user data
If you sign in with Google, we use your name, email address and profile picture only to create your account, sign you in and show your profile. Apexline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
12. Age
Apexline accounts are for people aged 18 or older.
13. Changes to this policy
We will tell you about material changes to this policy by email or in the app before they take effect. The current version is always on this page. See also our Terms of Service.