Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Apex AdTech Solutions LLC ("Apex AdTech", "we", "us" or "our") collects, uses, discloses, transfers and protects information when you visit our website at https://awfu925.com (the "Website"), communicate with our sales or support teams, or use our advertising automation, AI creative and analytics platform (collectively with the Website, the "Services").

The Services are intended exclusively for businesses and professional users. We do not knowingly offer the Services to consumers acting in a personal capacity, and we do not direct the Services to children. Where we process personal data on behalf of a business customer (for example, campaign performance data relating to that customer's advertising accounts), we act as a data processor and the customer acts as the data controller. Our processing in that capacity is governed by our Data Processing Agreement, which prevails over this Policy in the event of a conflict.

2. Who We Are

The data controller for the Website and for our own business contacts is:

• Legal entity: Apex AdTech Solutions LLC
• Registered office: 1000 N West Street, Suite 1200, Wilmington, DE 19801, United States
• Contact email: support@awfu925.com
• Website: https://awfu925.com

For any question about this Policy, or to exercise a privacy right, contact us at support@awfu925.com with the subject line "Privacy Request". We respond to verified requests within the time limits required by applicable law.

3. Information We Collect

3.1 Information you provide to us

• Account and contact data: name, work email address, company name, job title, country, telephone number and any message you submit through our demo request form.
• Commercial data: estimated monthly advertising spend, number of ad accounts, target markets and other qualification information you choose to share.
• Support communications: the content of emails, tickets and call notes exchanged with our team.
• Billing data: company billing details and tax identifiers. Card payments are processed by our PCI-DSS-compliant payment provider; we do not store full card numbers.

3.2 Advertising platform data (processed on behalf of customers)

When a customer authorizes our platform through an advertising platform's official authorization flow, we receive access tokens and the data those tokens permit us to read or write, which may include:

• campaign, ad group and advertisement configuration and status;
• impressions, clicks, spend, conversions, video view metrics and attributed revenue;
• creative assets and video materials uploaded to the customer's ad account;
• audience and targeting metadata necessary to display and edit campaigns;
• account identifiers and basic business profile information (such as advertiser account name and currency).

We access only the scopes that are strictly necessary to deliver the features a customer has enabled. We do not request, collect or store advertising platform account passwords at any time.

3.3 Information collected automatically

• Technical data: IP address, browser type and version, operating system, device type, referring URL and language preference.
• Usage data: pages viewed, features used, session duration and aggregated interaction events used to improve the Services.
• Security logs: authentication events, API request metadata and administrative actions recorded for audit and abuse-prevention purposes.

4. How We Use Information

We process information for the following purposes and, where the GDPR applies, on the following legal bases:

• Providing the Services — executing campaign automation, generating creative assets, calculating attribution and rendering dashboards (performance of a contract).
• Account administration and support — onboarding, authentication, role management and responding to requests (performance of a contract; legitimate interests).
• Billing and compliance — invoicing, tax reporting, record-keeping and enforcement of our Terms of Service (legal obligation; legitimate interests).
• Product improvement — aggregated, de-identified analytics used to improve reliability and usability (legitimate interests). We do not use customer advertising data to train third-party generative models for the benefit of other customers.
• Security — detecting fraud, abuse, unauthorized access and API misuse (legitimate interests; legal obligation).
• Marketing communications — sending relevant product updates to business contacts, subject to opt-out at any time (consent where required, otherwise legitimate interests).

We do not use automated decision-making that produces legal effects concerning individuals, and we do not engage in "profiling" of consumers for advertising purposes on the Website.

5. Third-Party Advertising Platform Integrations (API and OAuth 2.0)

Our Services integrate with third-party advertising platforms, including TikTok for Business, through their official developer APIs. This section describes the safeguards that apply to those integrations.

5.1 Authorization mechanism

• Connections are established exclusively through the platform's OAuth 2.0 authorization code flow. The account owner reviews the requested scopes on the platform's own consent screen and approves or denies access.
• We never ask for, collect or store platform account credentials (username, password or one-time codes).
• Access tokens and refresh tokens are encrypted with AES-256 and stored in a dedicated, access-controlled secrets vault that is logically separated from application data stores.
• Token refresh is automated; if a token is revoked or expires, the affected integration stops immediately and the customer is notified in-product.
• Customers may revoke our access at any time from the third-party platform's own permissions settings, or from the "Connected Accounts" page in our platform. Revocation invalidates our tokens within the platform-defined propagation window, after which we can no longer read or write to that account.

5.2 Purpose limitation and data minimization

Data obtained through platform APIs is used solely to provide the features enabled by the authorizing customer: campaign management, creative synchronization and performance reporting. We do not use platform API data for advertising our own products to the customer's audiences, for building cross-customer benchmarks that identify any individual advertiser, or for any purpose incompatible with the scope approved by the account owner.

5.3 No sale, resale or cross-account sharing

5.4 Developer terms and platform compliance

• We comply with the applicable platform developer terms, advertising policies, brand guidelines and technical documentation, including rate limits and data-retention requirements.
• We do not scrape, reverse-engineer or access platform data through any channel other than the documented APIs.
• We do not circumvent platform review processes, and we do not create or operate accounts on behalf of customers in violation of platform policy.
• Where a platform requires deletion or return of data upon termination of an integration, we action that requirement within the timeframe specified by the platform.

6. Multi-Tenant Data Isolation

The Services are architected as a multi-tenant system with strict logical separation between customer workspaces:

• each workspace is assigned a unique tenant identifier, and every data access path is scoped to that identifier at the query layer;
• encryption keys are derived per tenant, so ciphertext from one workspace cannot be decrypted with another workspace's keys;
• role-based access control restricts data visibility by role, workspace and, where configured, by individual ad account;
• all read and write operations performed through our application are written to an immutable audit log retained for at least twelve months;
• production access by our own personnel is restricted to named engineers, requires multi-factor authentication and just-in-time approval, and is logged.

7. Disclosure of Information

We share information only as follows:

• Service providers (subprocessors): hosting, cloud infrastructure, email delivery, error monitoring, payment processing and customer support tooling, each bound by written confidentiality and data-protection obligations and permitted to process data only on our instructions.
• Professional advisers: auditors, accountants and lawyers where necessary and subject to confidentiality.
• Legal requirements: where we are required to do so by valid legal process, or where disclosure is necessary to protect rights, safety or the integrity of the Services. We challenge overbroad requests where legally permitted and, unless prohibited, notify the affected customer.
• Corporate transactions: in connection with a merger, acquisition, financing or sale of assets, subject to the successor entity honoring this Policy.

We do not disclose customer advertising data to any third party for that third party's own marketing purposes.

8. Cookies and Similar Technologies

The Website uses strictly necessary cookies for session integrity, security and load balancing. With your consent where required, we may use limited analytics cookies to understand aggregate website usage. We do not use advertising or cross-site tracking cookies on the Website, and we do not sell cookie data.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Website or the application from functioning correctly.

9. Data Retention

• Account data: retained for the duration of the customer relationship and for as long as needed to provide the Services.
• Advertising performance data: retained according to the customer's configured retention window, by default twenty-four (24) months from collection, and deleted or anonymized thereafter.
• Platform API tokens: deleted immediately upon revocation, disconnection or account closure.
• Upon termination: customer data is deleted from active systems within thirty (30) days and from encrypted backups within ninety (90) days, except where a longer period is required by law or by an applicable platform developer term.
• Billing and audit records: retained for the period required by tax and corporate law.

10. Data Security

We maintain administrative, technical and physical safeguards designed to protect information against unauthorized access, alteration, disclosure or destruction, including:

• TLS 1.2+ (TLS 1.3 preferred) encryption for all data in transit, with HSTS enabled on production endpoints;
• AES-256 encryption for data at rest, including database volumes and object storage;
• segregation of duties, least-privilege access, mandatory multi-factor authentication for all personnel, and quarterly access reviews;
• continuous vulnerability scanning, dependency monitoring and periodic penetration testing by independent assessors;
• documented incident response procedures with notification to affected customers without undue delay and, where required, to supervisory authorities within 72 hours of becoming aware of a personal data breach.

11. International Data Transfers

We are established in the United States and may process information in the United States and in other countries where we or our subprocessors operate. Where personal data protected by the GDPR is transferred outside the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), supplemented by transfer risk assessments and, where appropriate, additional technical safeguards such as encryption and pseudonymization.

12. Your Rights under the GDPR and UK GDPR

Where the GDPR or UK GDPR applies, you have the right to:

• access the personal data we hold about you and receive a copy;
• request rectification of inaccurate or incomplete data;
• request erasure of your data, subject to legal retention obligations;
• request restriction of, or object to, certain processing, including processing based on legitimate interests and direct marketing;
• receive your data in a structured, commonly used, machine-readable format (data portability);
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
• lodge a complaint with your local supervisory authority.

To exercise these rights, email support@awfu925.com. We verify requests and respond within one month, extendable by a further two months for complex requests, in which case we will inform you of the extension.

13. Your Rights under the CCPA / CPRA

If you are a California resident, you have the right to know what categories of personal information we collect and how it is used and disclosed; to request access to and deletion of your personal information; to correct inaccurate personal information; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights.

14. Data Deletion and Disconnection

14.1 How to request deletion

You can request deletion of your account data at any time using either method below. Requests are acknowledged within five (5) business days and completed within thirty (30) days.

• In-product: Workspace Settings → Data & Privacy → "Delete workspace data". This initiates immediate deletion of active data for the workspace, including stored platform tokens.
• By email: send a request from your registered email address to support@awfu925.com with the subject "Data Deletion Request", including your workspace name and, if applicable, the advertiser account identifier.

14.2 Revoking platform access

To disconnect an advertising platform integration, remove Apex AdTech from the permissions or "connected apps" page of the relevant platform account, or use "Disconnect" on our Connected Accounts page. Revocation is propagated to our systems within one hour; cached reporting data derived from that account is purged within seven (7) days.

15. Children's Privacy

The Services are business tools and are not directed to children under 16 (or under 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

16. Subprocessors

We maintain a current list of subprocessors, categorized by function (cloud hosting, database services, email delivery, payment processing, monitoring and support). A copy is available on request from support@awfu925.com. We provide advance notice of new subprocessors that process customer personal data and offer a documented objection right to enterprise customers under their Data Processing Agreement.

17. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology or legal requirements. The "Last updated" date at the top of this page indicates when the current version took effect. Material changes affecting how we use personal data will be communicated by email to account administrators or by an in-product notice at least thirty (30) days before taking effect, where practicable.

18. Contact Us

Questions, requests or complaints regarding this Policy may be directed to:

• Apex AdTech Solutions LLC — Privacy Team
• Address: 1000 N West Street, Suite 1200, Wilmington, DE 19801, United States
• Email: support@awfu925.com
• Response time: within five (5) business days