Privacy Notice
Effective: 3 October 2026
Last reviewed: 3 October 2026
This notice covers every ApexIQ Companion service. The Apex Edge Sales Engineering website and the ApexIQ WinCommand application have their own notices.
Where a period or a practice differs by Topic, this notice says so and the Service Description for that Topic governs.
On this page
1. Who is responsible
Apex Edge Sales Engineering Limited, company number 15821626, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Registered with the Information Commissioner's Office, registration ZB796431.
Contact: privacy@apexedgesalesengineering.com.
We act as a controller for Companion services. We decide how the work is done, we apply our own professional judgement, and what we return is our work. That is a different role from the one we take in ApexIQ WinCommand, where the subscriber is the controller and we process on their instructions.
2. The website sets no cookies, and measures its use without them
companion.apexedgesalesengineering.com sets no cookies of any kind, so no cookie banner is needed. There is no tag manager, no pixel, no session recording, and no advertising or marketing technology on any page.
We measure how the site is used and how quickly it loads, through our hosting supplier, Netlify, in 2 ways:
- Web analytics, counted by Netlify from the request logs described in section 3: which pages are visited, how often, and from which referring site. It adds nothing to the page and sets no cookie.
- Performance monitoring, from a small script Netlify adds to each page. It records how quickly the page loads and responds, with the browser type and the screen size, and sends that to Netlify. It sets no cookie, stores nothing in your browser, and reads nothing you type.
We use both in aggregate alone, to see which pages are read and to keep the site fast. We do not use them to identify you, and we do not combine them with anything else. The site works without the script, so blocking scripts for this site stops the performance monitoring and costs you nothing.
The intake form pages are excluded. Their security policy blocks the performance script, so it never runs on a page where a brief is typed.
Fonts, images, and stylesheets are served from this domain alone. Apart from the performance measurements sent to Netlify, and what an intake form's payment button passes to Stripe, described below, no page loads anything from, or sends anything to, any other website.
Where a Topic provides a tool which runs in your browser, its Service Description states what that tool holds and where. An intake form keeps your draft, the request reference it makes, and Stripe's identifier for your payment in your own browser's local storage, which the form needs in order to work, and none of it leaves your device unless you send it. Nothing a browser tool holds reaches us unless you send it.
An intake form's payment buttons take you to Stripe's checkout page. That page is Stripe's website and not ours, and what it sets and records is governed by Stripe's own privacy notice.
3. What we receive, and from where
We receive personal data in 4 ways.
From you, when you make a request. Your name, work email address, organisation, and role, plus whatever you write in the brief.
Inside the material you send. Material of the kinds Companion works on usually names people: authors, approvers, named contacts, the customer's staff, and sometimes individuals at a third organisation. Some Topics ask for named people because the work needs them, such as who makes a decision or who owns a responsibility, and that Topic's Service Description says so. Otherwise we do not ask for personal data, and it comes with the material.
Through correspondence and payment. Emails, acknowledgements, and the details needed to take a payment and record it. You pay on Stripe's checkout page, where Stripe collects your payment details, your name, your email address, and your billing address. Stripe passes us the payment record, which includes the request reference the intake form made, and never your full card number.
From visiting the website. Our hosting supplier records a short-lived request log for every page served, which includes the visitor's IP address, the page requested, the time, and the browser's user agent. That is a technical record needed to serve the site, keep it available, and defend it against abuse. We do not use it to identify a visitor, and we do not combine it with anything else. Section 2 describes the web analytics Netlify counts from it.
We do not buy personal data, and we do not collect it from public sources for this service.
4. Why we use it, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Your contact and organisation details | To accept a request, acknowledge it, ask questions, and return the deliverable | Performance of a contract, or steps taken at your request before entering one |
| The brief | To understand what you need the work to address | Performance of a contract |
| Named people a Topic asks for | The work needs them, such as who makes a decision or owns a responsibility. We use them only to perform the service | Our legitimate interests, and yours, in performing a professional service you have requested |
| Other personal data inside your material | It is present in what we were asked to work on. We do not use it for anything beyond performing the service | Our legitimate interests, and yours, in performing a professional service you have requested |
| Correspondence | To run the engagement and keep a record of what was agreed | Legitimate interests in managing our business |
| Payment and billing details | To take payment for a request, issue receipts and invoices, refund a declined request, and keep accounting records | Performance of a contract, and legal obligation |
| The deliverable and the engagement record | To evidence what we advised, and to defend a claim | Legitimate interests in establishing and defending legal claims |
| Website analytics and performance measurements | To see which pages are read, and to keep the site fast and available | Legitimate interests in running and improving our website |
Where we rely on legitimate interests we have considered the effect on the people concerned. The processing is limited, expected in a professional services context, short-lived for the content of your material, and does not involve profiling or automated decision-making.
We do not make decisions about individuals by automated means, and we do not profile individuals. Our assessments are about the material, not about the people named in it.
5. Special category data
We do not want it and no Companion service needs it.
The Acceptable Use document asks you not to send special category data, criminal offence data, payment card data, credentials, or health information. Where we find such data we will tell you, and we may delete the material immediately without completing the work.
6. How long we keep it
| What | How long |
|---|---|
| The material you send us | Until the point the Service Description for that Topic states. Every Service Description states that point, and none keeps your material after its deliverable is sent. It is removed from routine backups in the ordinary course |
| The work we produced | 7 years from delivery |
| The engagement record: who asked, what for, when, what was agreed | 7 years from delivery |
| Correspondence, which does not include the material you submit or the attachments which carried it | 7 years from the end of the engagement |
| Accounting records | 7 years, as required by tax law |
| Website request logs | Held by our hosting supplier for a short period for availability and abuse prevention, and not copied into our own systems |
| Website analytics and performance measurements | Held by our hosting supplier under its own retention, in aggregate, and not copied into our own systems |
Where a Topic deletes your material on delivery, that is a designed property of the service rather than a concession. It means we hold your commercial documents for days rather than years, and it means most requests to erase their content are already satisfied before they are made. What we produce is kept, for the periods above.
The 7 year periods reflect the time within which a claim relating to the work could still be brought, plus the statutory retention required for accounting records.
7. Who else sees it
We do not sell personal data, and we do not share it for anyone else's marketing.
| Recipient | Purpose | Where |
|---|---|---|
| Netlify, Inc. | Hosting for companion.apexedgesalesengineering.com. It serves every page, keeps the request logs described in section 3, and provides the web analytics and performance monitoring described in section 2. It receives no material, no brief, and no deliverable | United States |
| Google Ireland Limited | Business email and associated storage, through which requests arrive and deliverables are returned | Ireland, with support access from outside the UK and EEA |
| Anthropic PBC | The Claude API, which drafts a Topic's deliverable from your material before a reviewer checks and finalises it. Each Topic's Service Description says what it sends. Inputs and outputs are not used to train models, and are deleted within 30 days unless the supplier's own terms require it to keep one longer, such as an input flagged under its usage policy | United States |
| Stripe Payments UK, Ltd. | Takes payment for a request on its own checkout page, and issues the receipt. It receives the request reference and the email address the intake form passes it, and what you enter at checkout. It receives no brief, no material, and no deliverable. For fraud prevention and its own legal obligations it acts as a separate controller, under its own privacy notice | United Kingdom, with processing in the United States |
| Our accountants and professional advisers | Billing, audit, and legal advice, under a duty of confidence | United Kingdom |
| A regulator, court, or law enforcement body | Where we are legally required to disclose | As required |
The people who read your material are our own reviewers, working, where a Topic drafts with AI assistance, from that draft. Section 5 of the Confidentiality and Materials document (Who reads it, and how the work is produced) explains that process, and no deliverable is sent without a reviewer checking it. Your material is not sent to any other subscriber, published, or used as an example, a case study, or marketing material.
We do not use your material, your brief, or your deliverable to train any model, and neither does our AI supplier under its commercial terms.
Where this changes, this notice changes with it, and we will say so before the change takes effect.
8. Transfers outside the United Kingdom
Our email provider may process data outside the UK, including in the United States, for support and resilience. Our AI supplier processes in the United States, our payment provider processes there as well as in the UK, and our hosting supplier is established in the United States and serves the site from a global network. Where that happens we rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or another lawful transfer mechanism, together with the supplier's technical safeguards.
You can ask us for details of the mechanism which applies.
9. How we protect it
Access is limited to the people who need it to perform the work. Accounts carry multi-factor authentication. Material is not copied onto removable media and is not stored outside our managed systems.
The Confidentiality and Materials document sets out how your material is handled in practice, whatever channel it arrives by.
Report a security concern to security@apexedgesalesengineering.com.
10. Automated decision-making and profiling
We make no decision about you by automated means alone, and we carry out no profiling.
A Topic may use AI to produce a draft of what it returns. That draft concerns the material, not a person, and it is never what we send you. A reviewer checks it, corrects what is wrong, removes what does not hold, and takes responsibility for the deliverable. No deliverable reaches a subscriber without that review, which the Service Description for each Topic records.
Nothing we do therefore produces a legal effect, or a similarly significant effect, on an individual by automated processing alone, and Article 22 of the UK GDPR is not engaged.
11. Children
Companion is a service for businesses. It is not directed at children, and we do not knowingly seek or hold personal data about anyone under 18. Where we find we hold such data without a proper basis, we delete it.
12. Your rights
Where we hold personal data about you, you have the right to:
- ask for a copy of it;
- ask us to correct it if it is wrong;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it where we rely on legitimate interests;
- ask us to transfer it, where the right to portability applies; and
- complain to a supervisory authority.
To exercise any of these, write to privacy@apexedgesalesengineering.com. We respond within 1 month. We may ask you to confirm your identity first.
Two practical notes. Where a Topic deletes your material on delivery, a request about its content made after delivery will usually find that only what our deliverable quotes or records remains, held for the periods in section 6. And where an individual named inside material sent to us asks about their data, we may need to approach the organisation which sent it, because they are better placed to identify the person and the context.
13. Complaints
If you are unhappy with how we have handled your personal data, tell us first at privacy@apexedgesalesengineering.com and we will try to put it right.
You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113.
14. Changes
We may change this notice. The date at the top is the date it last changed. Where a change is significant we will tell subscribers with an open engagement before it takes effect.