Privacy Notice

Apex Insights is a trading name of Craig Moore, a sole trader registered in Scotland with HMRC for Self Assessment.

For our postal address, please contact us at [email protected].

Email: [email protected]

ICO registration number: ZC222916

We are the data controller for the personal data described in this notice. We are not required to appoint a Data Protection Officer but the named contact for privacy queries is the proprietor at the email address above.

We do not knowingly collect data from children under 18. The service is intended for use by businesses and their staff.

Automated decision-making. We use AI tools to help draft and structure your report. A human (the proprietor) reviews, edits, and signs off every report before delivery. No decision producing legal or similarly significant effects is made solely by automated means.

We share your data with the processors below only to the extent necessary to deliver the service. Each processor is engaged under a written data processing agreement — typically the processor's published Data Processing Addendum, accepted at sign-up — and processes data only on our documented instructions.

Our AI provider (Anthropic) processes the content we send it solely to generate your report. Anthropic deletes these inputs and outputs within 30 days and does not use them to train its models. Our hosting and deployment tooling runs on our own servers at the hosting provider named above; it is not a separate recipient of your data.

We do not sell your data, do not share it with advertising networks, and do not allow our processors to use your data for their own purposes.

Some of our processors are located outside the United Kingdom. Where personal data is transferred outside the UK, we rely on one of the following safeguards required by UK GDPR Chapter V:

On request, we will share details of the safeguards in place for any specific transfer.

Under UK GDPR (Data Protection Act 2018), you have the right to:

• Access your personal data (Subject Access Request)
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”), where no legal obligation requires retention
• Restrict processing in certain circumstances
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, where processing is based on consent
• Object to direct marketing at any time
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not make such decisions)

To exercise any of these rights, email [email protected]. We will respond within one month, as required by UK GDPR Article 12. Where a request is particularly complex or numerous, we may extend this period by up to a further two months and will explain the reason for the extension. We may need to verify your identity before responding.

You can close your account at any time from your account settings. When you do, we immediately anonymise the personal identifiers on your account. Records connected to a completed engagement, such as your report, questionnaire responses, and any consultation transcript, are then kept only for as long as we need them to provide and support the service, as described in section 4, and securely deleted when no longer needed or when you ask us to erase them.

You can also ask us to erase your data sooner by emailing [email protected]. We will honour the request except where the law requires us to keep specific records (for example, invoice records for HMRC), and we will tell you what we cannot delete and why.

We protect your data using technical and organisational measures including:

• HTTPS (TLS 1.2+) encryption for all data in transit
• Data hosted in an ISO 27001-certified EU datacentre (Germany) with restricted physical and network access
• HTTP-only, secure, SameSite cookies for authentication
• Magic-link sign-in (no passwords stored)
• Multi-factor authentication on administrative accounts
• Rate limiting and intrusion detection
• Restricted administrative access via Cloudflare Zero Trust
• Regular dependency and security reviews
• Automated daily server backups, retained for a rolling window in the same EU region

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, in line with UK GDPR Article 33. Where the breach is likely to result in a high risk to you, we will notify you without undue delay (Article 34).

We only use strictly necessary cookies for authentication and security. We do not use analytics or tracking cookies. For full details see our Cookie Policy.

If you are unhappy with how we handle your data, please contact us first at [email protected]. We aim to acknowledge complaints within 3 business days and resolve them within 14 business days where reasonably possible.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority.

We may update this privacy notice from time to time. Where a change is material, we will notify you by email at least 30 days before the change takes effect. The current version is always available at this URL, with an updated “Last updated” date.