Privacy Policy

1. Who We Are and Scope

Aptic Consulting is responsible for the personal information described in this Privacy Policy, except where we process it on behalf of a business customer (see Section 15). You can contact us at [email protected] or at [Insert mailing address].

This Privacy Policy applies to information we collect through:

• Our website, waitlist, and inquiry forms.
• Job applications.
• Aptic accounts and workspaces.
• Aptic software, applications, reports, dashboards, workflows, and automations.
• AI-assisted tools and outputs.
• Consulting, managed services, implementation, analytics, strategy, marketing, operations, finance-related analysis, and automation support.
• Sales, support, onboarding, and customer communications.
• Connected third-party services and integrations.

This Privacy Policy does not apply to third-party websites, platforms, tools, or services that we do not control.

2. Information We Collect

We collect information in several ways.

2.1 Information You Provide

We may collect information you provide directly, including:

• Name, email address, phone number, company name, job title, and contact details.
• Information about your business you share in waitlist, inquiry, and pro bono forms.
• Account login information and workspace information.
• Billing, subscription, and transaction-related information. Card payments are handled by our payment processors; we do not store full payment card numbers.
• Messages, support requests, sales inquiries, feedback, forms, survey responses, and communications.
• Business goals, assumptions, strategy documents, operating plans, launch plans, projections, tasks, decisions, approvals, and workspace preferences.
• Documents, spreadsheets, reports, website content, marketing materials, business plans, financial materials, operational information, customer information, and other content you upload or provide.

2.2 Job Applicants

If you apply for a job, we collect the information in your application, such as your contact details, résumé, work history, education, skills, links you share, and our interview notes. We use it to evaluate your application, communicate with you, and comply with law, and we keep it for a reasonable period afterward in case of future openings unless you ask us to delete it.

2.3 Information from Connected Services

If you connect third-party services, we may collect information from those services based on the permissions you grant.

Connected services may include advertising platforms, analytics tools, search tools, websites, financial systems, operational systems, customer systems, project management tools, cloud services, email tools, and automation platforms.

Depending on your configuration, this information may include:

• Advertising campaign data.
• Website and analytics data.
• Conversion, traffic, attribution, and event data.
• Search performance data.
• Website crawl data.
• Financial metrics, expenses, revenue, margin, unit economics, cash-flow, or budget information.
• Operational metrics, inventory, fulfillment, refund, support, vendor, or process data.
• Tasks, approvals, decisions, projects, messages, and workflow information.
• Account metadata, permissions, logs, and connection status.

2.4 Information Collected Automatically

When you visit our website or use our services, we may automatically collect:

• IP address, device identifiers, browser type, operating system, device type, and approximate location.
• Pages viewed, links clicked, referring URLs, session activity, timestamps, and usage events.
• Log data, diagnostics, error reports, performance data, uptime data, and security events.
• Cookie, pixel, local storage, and similar tracking information.

2.5 AI, Automation, and Consulting Data

Aptic may collect and process information related to AI-assisted services, automation, consulting, managed services, and business actions, including:

• Prompts, instructions, questions, and user requests.
• Business context used to generate outputs.
• AI-generated reports, recommendations, summaries, projections, tasks, and analyses.
• Deterministic check results, signals, issues, opportunities, data gaps, and measurements.
• Human consultant notes, reviews, edits, recommendations, and service-delivery records.
• Approval decisions, denial reasons, delegated authority settings, action logs, and execution records.
• Quality evaluations, confidence scores, feedback, and calibration records.
• Audit logs, workflow logs, integration logs, and security logs.

2.6 Calls and Meetings

We may record or transcribe calls and video meetings, or use AI note-taking tools, to provide the services and keep accurate records. We will tell participants before recording, and where the law requires consent from everyone on the call, we will record only with that consent.

3. Customer Data

“Customer Data” means business information, documents, account data, connected service data, personal information, confidential information, and other content provided to Aptic by or on behalf of a customer.

You retain ownership of Customer Data. We process Customer Data to provide, secure, support, maintain, and improve the services, and to perform the services you request.

If you provide Customer Data that includes personal information about your customers, employees, contractors, users, vendors, or other individuals, you are responsible for providing required notices, obtaining required consents, and ensuring you have a valid legal basis to provide that information to Aptic.

4. How We Use Information

We may use information to:

• Provide, operate, maintain, secure, and improve the services.
• Respond to inquiries, manage our waitlist, and evaluate whether we can serve your business.
• Create and manage accounts, workspaces, reports, dashboards, recommendations, tasks, decisions, approvals, workflows, and automations.
• Deliver consulting, managed services, implementation, strategy, marketing, operations, finance-related analysis, and automation support.
• Analyze business data and generate insights, reports, recommendations, projections, tasks, action plans, and measurements.
• Prepare, route, approve, execute, monitor, and audit authorized actions.
• Provide human review, quality review, troubleshooting, and customer support.
• Verify permissions, enforce approval settings, maintain audit trails, and prevent unauthorized activity.
• Monitor security, detect abuse, debug errors, and maintain service reliability.
• Process payments, manage billing, and administer subscriptions.
• Evaluate job applications.
• Send administrative messages, account notices, security notices, product updates, service communications, and marketing communications.
• Evaluate and improve product quality, workflows, templates, prompts, and service delivery.
• Measure usage, adoption, customer outcomes, service quality, and business impact.
• Comply with legal obligations, enforce agreements, and protect rights, safety, property, and security.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects about individuals.

5. Human Review and Service Delivery

Aptic services may involve review by authorized Aptic employees, contractors, consultants, analysts, operators, support personnel, and service providers.

These individuals may access Customer Data, workspace information, connected account data, AI outputs, reports, recommendations, approvals, tasks, action logs, communications, and related information as needed for legitimate business purposes, including:

• Providing consulting and managed services.
• Reviewing and improving recommendations.
• Preparing or performing authorized actions.
• Supporting customers.
• Troubleshooting issues.
• Conducting quality review.
• Maintaining security and compliance.
• Auditing service performance.
• Improving Aptic’s services.

We use access controls, confidentiality obligations, and internal policies designed to limit access to people who need it for authorized purposes.

6. AI Model Practices

Aptic may use internal AI systems, third-party AI model providers, deterministic workflows, analytics tools, and automation systems to provide the services.

Unless we separately disclose otherwise or obtain your consent:

• We do not sell Customer Data.
• We may use Customer Data to generate outputs, provide services, troubleshoot, secure the platform, monitor quality, and improve your workspace experience.
• We may use aggregated, de-identified, or anonymized information to improve Aptic’s services, provided it does not identify you, your business, or any individual. We will not attempt to re-identify de-identified information.

AI model providers may temporarily retain inputs and outputs for limited purposes such as abuse monitoring, as permitted by their terms.

You should not submit highly sensitive information unless the service expressly supports it and you have the required authority and legal basis.

7. Google User Data

If you connect a Google account or service (for example, Google Ads, Google Analytics, Google Search Console, or Google Workspace), we access Google user data only with your permission and only as needed to provide the features you request.

Aptic’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models, do not sell it, and do not use it for advertising unrelated to the features you requested. People at Aptic read Google user data only with your permission, for security purposes, to comply with law, or as part of the services you requested.

You can revoke Aptic’s access at any time in your Google account’s security settings.

8. Sensitive Information

Aptic is designed primarily for business use. Unless expressly supported by the service or agreed in writing, you should not provide:

• Social Security numbers, government identification numbers, or passport numbers.
• Payment card numbers or bank login credentials.
• Protected health information.
• Children’s personal information.
• Biometric identifiers.
• Precise geolocation, or information about racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or union membership.
• Highly sensitive employment, legal, medical, or financial information.
• Passwords, secrets, private keys, or credentials that are not requested through a secure credential flow.

We do not use sensitive personal information to infer characteristics about individuals. If you provide sensitive information, you represent that you have the required rights, consents, notices, and legal basis to do so.

9. How We Share Information

We may share information as described below.

9.1 Service Providers

We may share information with vendors and service providers that help us operate the services, including hosting providers, cloud infrastructure providers, database providers, AI model providers, analytics providers, form and survey providers, security providers, payment processors, email providers, customer support tools, logging providers, and other operational vendors.

These providers may process information on our behalf subject to contractual, technical, or operational restrictions.

9.2 Aptic Personnel

We may share information with Aptic employees, contractors, consultants, analysts, operators, and other authorized personnel as needed to provide, support, secure, audit, and improve the services.

9.3 Connected Services

When you connect third-party services, we may send information to or receive information from those services based on your configuration, permissions, instructions, approvals, and requested actions.

9.4 Workspace Users

Information in a workspace may be visible to the workspace owner, administrators, authorized users, and other users invited to the workspace.

Workspace owners and administrators may be able to access user activity, connected data, reports, recommendations, tasks, approvals, decisions, action logs, and other workspace information.

9.5 Partners You Ask Us to Introduce

If you ask us to introduce you to a partner, such as a designer, agency, or accountant, we share the information needed for the introduction with your permission.

9.6 Professional Advisers

We may share information with our lawyers, accountants, auditors, insurers, and other professional advisers under confidentiality obligations.

9.7 Legal, Safety, and Compliance

We may disclose information if we believe it is necessary to comply with law, legal process, government requests, regulatory requests, security obligations, fraud prevention, enforcement of agreements, or protection of rights, safety, property, or security.

9.8 Business Transfers

If Aptic is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction, subject to this Privacy Policy or a policy at least as protective.

9.9 With Your Consent or Direction

We may share information with your consent or at your direction.

10. Cookies and Similar Technologies

We use cookies, pixels, tags, local storage, and similar technologies, including tools managed through Google Tag Manager and analytics services such as Google Analytics, to:

• Operate the website and services.
• Remember preferences.
• Secure sessions.
• Analyze usage.
• Improve performance.
• Support marketing.
• Measure campaigns.
• Understand website activity.

You can control cookies through your browser settings. Some features may not work properly if cookies are disabled. You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, and opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout.

If we use analytics, advertising, retargeting, or similar technologies that require notice, consent, or an opt-out under applicable law, we will provide appropriate notices and choices.

11. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, support backups, preserve audit logs, prevent fraud, and operate our business.

Retention periods depend on:

• The type of information.
• Customer settings.
• Service Order requirements.
• Legal, tax, and compliance obligations.
• Security and audit needs.
• Backup and disaster recovery practices.
• Whether the information is part of business records, action logs, approvals, or evidence records.

As a general guide, we keep account and workspace information for the life of the account and a reasonable period after, billing and tax records for as long as tax law requires, waitlist and inquiry information until it is no longer useful or you ask us to delete it, and job application information for up to two years. Information in backups is deleted on the normal backup cycle.

You may request deletion of certain information, subject to legal, security, contractual, operational, and backup limitations.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These may include access controls, encryption, credential protection, logging, monitoring, security reviews, and vendor controls.

No method of transmission or storage is completely secure. You are responsible for maintaining the security of your accounts, devices, passwords, API keys, connected services, user permissions, and workspace access.

If we learn of a security incident that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

13. International Data Transfers

Aptic is based in the United States and has team members in other countries, including Mexico. We and our service providers may process and store information in the United States and other countries. These countries may have privacy laws different from those in your jurisdiction.

Where required, we use appropriate safeguards for international transfers, such as standard contractual clauses, and we obtain consent where the law requires it.

14. Your Choices and Rights

Depending on where you live, you may have rights regarding your personal information, such as the right to:

• Confirm whether we process your personal information and access it.
• Correct inaccurate personal information.
• Delete personal information.
• Obtain a copy of personal information in a portable format.
• Opt out of targeted advertising, the sale or sharing of personal information, and profiling in furtherance of decisions with legal or similarly significant effects.
• Limit certain uses of sensitive personal information.
• Withdraw consent where processing is based on consent.
• Object to or restrict certain processing.
• Appeal our decision about your request.

To exercise your rights, email [email protected]. We will verify your identity before fulfilling most requests, which may require you to confirm information we already have. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity directly.

We respond within the time required by applicable law (for example, within 45 days under most U.S. state laws, extendable where the law allows). If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject “Privacy appeal.” If your appeal is denied, you may contact your state attorney general.

We will not discriminate against you for exercising your privacy rights. These rights may be limited by applicable law, security needs, legal obligations, contractual obligations, business records, and the nature of the information.

15. Business Customer Data and Processor/Service Provider Role

Aptic primarily provides services to businesses and organizations.

When Aptic processes personal information on behalf of a business customer, Aptic acts as a service provider, processor, or similar role under applicable privacy laws, and processes that information according to the customer’s instructions and our agreement with them. The business customer is responsible for determining the purposes and means of processing, providing required notices, obtaining required consents, and responding to individual privacy requests unless otherwise agreed in writing. A data processing agreement is available to business customers on request.

If you are an individual associated with one of our customers and have questions about information processed in that customer’s workspace, please contact that customer directly. If you contact us, we will refer your request to the customer where appropriate.

16. U.S. State Privacy Notice

This section applies to residents of U.S. states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, to the extent those laws apply to Aptic.

Categories of Personal Information We Collect

• Identifiers, such as name, email address, IP address, account identifiers, and contact information.
• Commercial information, such as subscription, billing, service history, and transaction-related information.
• Internet or electronic network activity, such as website usage, log data, device data, session activity, and interaction data.
• Professional or employment-related information, such as company name, role, title, business contact details, and job application information.
• Geolocation information, such as approximate location inferred from IP address.
• Audio, electronic, or similar information, such as call or meeting recordings made with notice.
• Inferences, such as preferences, product usage patterns, business interests, recommendations, or service needs.
• Sensitive personal information, such as account login credentials, only as needed to provide the services or if you provide it.

We collect these categories from the sources described in Section 2, use them for the purposes described in Section 4, disclose them to the recipients described in Section 9, and keep them as described in Section 11.

Sale, Sharing, and Targeted Advertising

We do not sell personal information for money, and we do not knowingly sell or share the personal information of consumers under 16. Some website analytics or advertising technologies may be considered a “sale,” “sharing,” or “targeted advertising” under some state laws. You can opt out by emailing us or by enabling a recognized opt-out preference signal such as Global Privacy Control, which we honor for the browser that sends it.

California

California residents have the right to know, access, correct, and delete personal information, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We use sensitive personal information only for purposes permitted under California law. Under California’s “Shine the Light” law, California residents may ask whether we disclosed personal information to third parties for their direct marketing purposes; we do not.

17. Nevada Privacy Notice

We do not sell covered information as defined by Nevada law (NRS 603A). Nevada residents may still submit a verified request directing us not to sell covered information by emailing [email protected]. We will respond within 60 days. We do not knowingly allow third parties to collect covered information about your online activities over time and across different websites through our website, except as described in Section 10.

18. International Privacy Rights

If the laws of your country apply to our processing of your personal information, you may have additional rights.

European Economic Area, United Kingdom, and Switzerland

We process personal information on these legal bases: to perform a contract with you or take steps before entering one; for our legitimate interests in operating, securing, marketing, and improving our business, where those interests are not overridden by your rights; to comply with legal obligations; and with your consent, which you may withdraw at any time. You may access, correct, delete, restrict, or port your information, object to processing, and complain to your local data protection authority.

Brazil

Under the LGPD, you may confirm processing, access, correct, anonymize, block, delete, or port your information, obtain information about sharing, withdraw consent, and petition the national data protection authority (ANPD).

Mexico

Under the Federal Law on the Protection of Personal Data Held by Private Parties, you may exercise your rights of access, rectification, cancellation, and opposition (ARCO rights) and revoke consent by emailing [email protected] with your name, a way to contact you, proof of identity, and a clear description of your request. We will respond within 20 business days. By providing your information, you consent to its transfer to the United States and to our service providers for the purposes in this Privacy Policy.

Japan and South Korea

Where Japan’s Act on the Protection of Personal Information or South Korea’s Personal Information Protection Act applies, you may request access to, correction of, suspension of use of, or deletion of your personal information, and information about third parties and overseas transfers, as provided by those laws.

To exercise any of these rights, email [email protected].

19. Children’s Privacy

Our website and services are intended for business users who are at least 18 and are not directed to children. We do not knowingly collect personal information from children under 16.

If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

20. Email and Communications

We may send you service-related messages, security notices, account notices, billing notices, product updates, and marketing communications.

You may opt out of marketing emails by using the unsubscribe link or contacting us. You may still receive transactional, security, legal, billing, or service-related communications.

21. Do Not Track and Global Privacy Signals

Some browsers offer “Do Not Track” signals. Because there is no common industry standard for these signals, we do not currently respond to them.

We honor recognized opt-out preference signals, such as Global Privacy Control, as an opt-out of sale, sharing, and targeted advertising where required by law.

22. Third-Party Links and Services

Our website and services may link to third-party websites, platforms, tools, or services, including forms hosted by third parties. We are not responsible for the privacy practices, policies, content, or security of third parties.

Your use of third-party services is governed by their privacy policies and terms.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted with a new “Last Updated” date.

If changes are material, we will provide additional notice, such as by email or a notice in the services, and obtain consent where required by law. Your continued use of the website or services after the updated Privacy Policy becomes effective means you acknowledge the updated policy.

24. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact Aptic Consulting at [email protected] or [Insert mailing address].