Legal
Privacy Policy
Last updated: [OWNER: date of publication]
Draft for legal review. This text is not yet in force.
This policy explains how Pyke Horse Training LLC ("Apex", "we") handles personal information on the Apex website, in the course and in the Apex Platform app.
1. Two roles
- Controller. We decide how your information is used when you visit the website, register for the course, buy from us, or hold an account with us as a customer contact.
- Processor. When a company uses the app, the information inside it belongs to that company. This includes its people, deals, buyers' details, documents and bids. We process it only on the company's instructions, under our Data Processing Addendum. Questions about that information go to the company first.
2. What we collect
| What | Where it comes from | Why |
|---|---|---|
| Name, email, company, role | You, when you register, buy or are invited | Provide the course and the app, contact you about them |
| Sign-in details: sign-in method, single sign-on identifiers and groups, passkeys, session records | You, your company's identity provider | Sign you in securely, give you the right role |
| Course progress, check answers, certification attempts and reviews | Your use of the course | Track progress, certify, review appeals |
| Billing details: billing contact, address, tax ID, payment status | You, our payment provider | Charge you, keep tax records. We do not store full card numbers. |
| Usage and security logs: IDs, times, actions, IP address, device and browser | Your use of the Service | Security, fraud prevention, fixing problems, audit trail. Logs hold no deal or document content. |
| Messages and support requests | You | Answer you |
| Website analytics | Your browser, only if you consent | Understand which pages help |
3. Legal bases (EU and UK)
- Contract: to provide what you signed up for.
- Legitimate interests: security, fraud prevention, improving the Service, and business-to-business marketing to customer contacts. You can object at any time.
- Consent: website analytics and course marketing emails. You can withdraw it at any time.
- Legal obligation: tax, accounting and responses to lawful requests.
4. AI and your information
We do not use personal information or customer content to train AI models, and our AI providers may not either. When AI features run, only the passages a task needs are sent to the model the company chose. Logs record that a call happened, not what it contained.
5. Who we share it with
We do not sell or share personal information for cross-context behavioural advertising. We use these service providers (subprocessors), each bound by contract:
| Provider | What it does | Location |
|---|---|---|
| Vercel Inc. | Hosting, file storage | US, EU |
| Neon (Databricks, Inc.) | Database | US or EU, as the company chooses |
| Anthropic PBC | Managed AI model, when a company uses it | US |
| Resend | Sign-in and service emails | US |
| Stripe, Inc. | Payments, tax, invoices | US |
| [OWNER: malware scanning provider, when chosen] | Scanning uploaded files | [OWNER] |
Companies may connect their own sources, such as Google Drive or Microsoft SharePoint, and their own AI providers. That data flows under the company's own agreements with those providers. We also disclose information when the law requires it, to protect rights and safety, or in a merger or sale of the business, subject to this policy.
6. International transfers
We are based in the US. When information from the EU, EEA, UK or Switzerland is transferred to the US, we rely on the EU Standard Contractual Clauses and the UK Addendum, or another valid mechanism. Companies on the EU region keep their app data stored in the EU.
7. How long we keep it
- Account and course records: while your account is active, then deleted within 90 days of closing, unless you ask sooner.
- Customer data in the app: as set out in the Terms and the Data Processing Addendum. It is deleted after a subscription ends.
- Billing and tax records: 7 years, as tax law requires.
- Security and audit logs: 13 months.
- Rate-limit records: 1 day.
8. Your rights
Depending on where you live, you can ask to access, correct, delete, or receive a copy of your information. You can also restrict or object to how we use it, and withdraw consent. Write to [OWNER: privacy contact email]. We answer within 30 days. Where we act as a processor, we pass your request to the company that controls the data.
EU and UK residents may complain to their local data protection authority.
9. California residents
Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect and to correct or delete it. You have the right not to be discriminated against for exercising these rights. The categories we collect are in section 2: identifiers, commercial information, internet activity and professional information. We use them for the purposes listed there. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. You or an authorized agent can make a request at [OWNER: privacy contact email]. We will verify your identity first.
10. Security
We encrypt data in transit and at rest. Each company's data is isolated with database row-level security. Secrets are sealed and never logged. Staff access to a company's data needs that company's approval and is logged.
11. Children
The Service is not for anyone under 18, and we do not knowingly collect their information.
12. Changes
We will post changes here, update the date above, and tell account holders about material changes by email or in the app.
13. Contact
Pyke Horse Training LLC, [OWNER: postal address]. Privacy questions: [OWNER: privacy contact email].