In short. We never sell the data you put into Project Atlas, and we never use it to train AI models. We use it to deliver the service you bought and to run our business as described below. Our marketing website runs advertising and analytics tags like most business websites — Section 4 explains that and how to opt out.
1. Who we are
Apex Brand Acceleration Inc. ("Apex," "we," "us") is an Arizona corporation at 8029 N 74th Place, Scottsdale, Arizona 85258, United States. We build Project Atlas, a platform that measures how brands are represented across AI answers, search results, and review platforms.
This policy covers the Atlas platform and apexbrand.ai. It does not cover third-party sites, review platforms, search engines, or AI services that Atlas measures — those have their own policies.
Two roles. For your account, billing, support, and website data we are the controller. For the data Atlas processes to deliver the service — your business configuration, questions, competitors, scan results, and any review content collected on your behalf — we are a processor (a service provider under California law), acting only on your instructions. Where a Data Processing Addendum applies, it controls.
2. What we collect, why, and how long we keep it
| Category | Examples | Source | Why | Retention |
|---|---|---|---|---|
| Identifiers | Name, business email, job title, phone, account identifier | You | Creating and administering your account, support, security | Life of the account |
| Sensitive information | Account credentials; a tax identifier, which for a sole proprietor may be an SSN | You | Authentication, billing, and tax compliance only. Never used to infer anything about you | Life of the account; tax records 7 years |
| Commercial and billing | Subscription, transactions, billing contact. We never store full card numbers — our payment processor handles those | You | Billing and financial records | 7 years, for tax and accounting |
| Your business configuration | Brand names, aliases, locations, competitors, the questions you want measured | You | Telling Atlas what to measure | Life of the account |
| Scan evidence | AI assistant answers and citations, search rankings, review content and ratings, evidence read from public web pages | Public sources; commercial data vendors; platforms you connect | Producing your measurements, reports, and prioritized recommendations | 24 months by default, or the period you set. Deleting a business removes its scan history at once |
| Internet and device activity | IP address, browser and device type, pages viewed, features used, timestamps, cookies | Automatically | Security, diagnostics, aggregate product analytics, and — on our marketing site only — advertising | Operational logs 90 days; security events 12 months |
| Support correspondence | Tickets, emails, attachments you send us | You | Answering you | 24 months after your enquiry is resolved |
Review content contains other people's data. Reviews written about your business may name or describe your customers. We process that only as your processor, to produce the analysis you asked for. You are the controller of it.
What we do not collect. Government identification numbers beyond the billing tax identifier above, payment card numbers, health information, biometric or genetic data, precise geolocation, or — knowingly — data about children under 16. We do not seek out racial or ethnic origin, political or religious beliefs, health, sex life, or sexual orientation — where such details appear in review content people wrote publicly, we process them only on our client's instruction.
We do not train AI models on your data. Nothing you put into Atlas is used to train, fine-tune, or develop any machine learning model, ours or anyone else's. We contractually prohibit our AI providers from doing so. Measuring what third-party models say about you is the service — that is not the same as using your data to build one.
3. Who we share it with
We use a small set of service providers, each bound by a written agreement no less protective than this policy. We remain responsible for what they do with your data.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, database, identity, logging | All service data | United States (Oregon) |
| OpenAI | Generating and analysing assistant answers | Business name, website, description, market, and your configured questions | United States |
| Serper.dev | Search ranking data | Search query strings containing business and competitor names | Global — Serper does not name a single processing region |
| Business listing and review data; website analytics | Business identifiers and location; website usage | Global | |
| Payment processor | Subscription billing | Billing contact and a payment token | United States |
| Advertising and ad-measurement networks | Marketing-website advertising only — see Section 4 | Internet and device activity, and online identifiers, of website visitors. No Client Data | Global |
We do not send your account details — your name, email address, or account identifier — to OpenAI, Serper.dev, or Google. What those three receive is business and market data only. Our hosting and payment providers necessarily handle account and billing details in order to run the service and bill you.
We also disclose data where compelled by valid legal process (we will tell you first unless legally barred from doing so), to anyone you direct us to, and to an acquirer in a merger or sale — who must honour this policy.
4. Advertising, "sale," and "sharing"
We have never sold the data you put into Atlas, and we never will. Not to advertisers, not to data brokers, not to anyone, for any consideration.
Our marketing website is a separate matter, and we would rather state it than bury it. apexbrand.ai runs Google Analytics and third-party advertising tags. Under California law those can count as a "sale" or "sharing" of a visitor's personal information even though no money changes hands, so we treat them as such. This applies to website visitors only — never to Client Data, and never inside the Atlas application, which carries no third-party advertising or cross-context tracking tags at all.
To opt out: use Do Not Sell or Share My Personal Information, change your choices in Cookie preferences, or send a Global Privacy Control signal from your browser — we honour GPC automatically, with no further step from you.
Cookies. Inside Atlas we use only what the service needs to run, plus first-party analytics. On the marketing site we use necessary, analytics, and advertising cookies, and we ask for consent before setting non-essential ones where the law requires it. Change your choices any time through Cookie preferences.
Twelve-month disclosure. In the preceding twelve months we collected the categories in Section 2, from the sources and for the purposes stated there, and disclosed them to the providers in Section 3. We sold no Client Data and we shared no Client Data. Personal information of marketing-website visitors — internet and device activity, and online identifiers — was shared for cross-context behavioral advertising with the advertising and ad-measurement networks in Section 3, and under California law that may also constitute a sale.
5. Your rights
Wherever you live, you may ask us to:
- Tell you what personal information we hold about you, where it came from, why we have it, and who we shared it with
- Correct anything inaccurate
- Delete it, subject to what the law requires us to keep
- Send you a copy in a portable, machine-readable format
- Stop targeted advertising, and stop any "sale" or "sharing" (Section 4)
- Stop marketing emails, at any time
For data we hold as a service provider on a client's behalf, we cannot act unilaterally: we pass your request to that client without delay and help them answer it. We will never charge you or degrade your service for exercising a right. California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah and other state laws grant these rights; we honour them for everyone in the United States regardless of where you live, and if we turn a request down you may appeal by replying to our decision or writing to info@apexbrand.ai — we respond to appeals within 45 days, and if we deny one we will tell you how to contact your state attorney general.
How to exercise them. Email info@apexbrand.ai, or use the request form in the app. We acknowledge within 10 business days and respond within 30 days — extendable where a request is complex or repetitive, in which case we will tell you why inside the first period. We will verify who you are before acting, using information we already hold. You may use an authorized agent to make a request on your behalf, provided we can verify their authority.
Closing your account. You can delete any tracked business yourself at any time, which removes it and all its scan history immediately. To close your account entirely, email us — we delete your data and sign-in credentials within 30 days — other than the billing and tax records we are legally required to keep (Section 2) — and will certify it in writing on request. Data in backups disappears as the 35-day restore window rolls past it.
Sensitive information. We use it only for authentication, billing, and tax compliance, so the California right to limit its use does not arise — but ask and we will confirm exactly what we hold.
Automated decisions. Atlas ranks marketing work items. It makes no automated decisions about individuals with legal or similarly significant effects — nothing about employment, credit, housing, education, or healthcare.
If you appear in data we collected about someone else's market — as the author of a public review, or a person named in an AI answer — you have these rights too. Where we hold the data as a processor for a client we will pass your request to them and help them answer it; where we hold it ourselves, we will action it directly.
You can also complain to your state attorney general or, in California, the California Privacy Protection Agency. We would rather you came to us first, but you are never required to.
6. How we protect it
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Separation between customers enforced at the data layer, so one account cannot reach another's data
- Restricted access. Apex staff have no standing access to your data; access is granted for a purpose, time-limited, and logged
- Two-factor authentication available on your account using an authenticator app. Single sign-on (SAML/OIDC) is not currently offered
- Continuous backups with a 35-day restore window, tested quarterly, and an annual independent penetration test
- Passwords are hashed by our identity provider and are never visible to us
Apex does not hold SOC 2, ISO 27001, or equivalent certification. Our infrastructure runs on AWS, which holds those for the underlying platform — that covers their controls, not ours, and we will not imply otherwise. We are happy to complete security questionnaires.
If something goes wrong, we will tell affected customers without undue delay and, where feasible, within 72 hours of becoming aware of a breach involving personal data, with whatever we know at the time — subject to any delay a law-enforcement agency requires of us. Report a security concern to info@apexbrand.ai.
7. Where your data is
All Atlas data we store is held in the United States, in Amazon Web Services' Oregon region. Static parts of the website are delivered through a global content network, and the providers in Section 3 process the limited data they receive in their own locations — Serper.dev and Google do not confine that to one region.
Atlas is offered to customers in the United States only. We do not market it to, or monitor the behaviour of, individuals in the EEA or the UK, and we do not offer EU or UK data residency. We have therefore not appointed a Data Protection Officer or an EU or UK representative. If you are outside the United States and believe we hold information about you, email us and we will deal with your request.
8. Children
Atlas is a business product, not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child's data has reached us, email info@apexbrand.ai and we will delete it.
9. Changes
We will email account holders and post an in-product notice at least 30 days before any change that expands how we use personal information or reduces a right. Other changes take effect when posted, with the date above updated. No change to our no-sale or no-AI-training commitments will ever apply retroactively to data we already hold. Where you have a signed agreement with us, that agreement's amendment terms govern. Ask us for any earlier version.
10. Contact
Scottsdale, Arizona 85258
United States
info@apexbrand.ai — privacy questions, rights requests, security reports, and everything else. One monitored inbox; the address you use never affects your rights or our response times.