Privacy Policy

This Privacy Policy explains what personal data Apex (apexedu.co.uk, the "Service") collects when you use it, why we collect it, who we share it with, and what rights you have over it. Apex is operated by an individual trading as Apex ("Apex", "we", "us", "our") and is the data controller for the personal data described here. This policy should be read alongside our Terms of Service.

1. Information we collect

We collect the following categories of personal data:

• Account details — your name, email address, password (stored as a one-way hash, never in plain text), school, and target exam year, when you sign up or update your settings;
• Sign-in via Google — if you use "Sign in with Google", we receive your name and email from Google rather than you setting a password with us;
• Payment information — if you subscribe to a paid plan, your card details are collected and processed directly by our payment provider, Stripe. We never see or store your full card number; we hold only a Stripe customer/subscription reference and your plan and billing status;
• Study and progress data — which questions, lessons and papers you've viewed or completed, your Smart Mark results, bookmarks, and similar in-app activity, so we can show your dashboard and progress;
• Written answers submitted to Smart Mark — the free-text answers you submit for AI-assisted marking;
• Technical and activity data — login timestamps and a lightweight "last active" timestamp used only to estimate how many people are using the Service at a given time (shown to us as an aggregate count, not to other users);
• Correspondence — anything you email us, including account deletion requests (see Section 7).

2. How we use your information

We use this data to: provide and maintain your account and subscription; show your personalised dashboard and progress; mark your answers with Smart Mark; process payments and manage billing; send account-related emails (password resets, security alerts, receipts, deletion confirmations); keep the Service secure and prevent abuse; and understand overall usage so we can improve Apex. We do not use your data for advertising, and we do not sell your personal data to anyone.

3. Our lawful basis for processing

Under UK GDPR, we rely on: performance of a contract (to create your account, run your subscription, and provide the Service you've signed up for); legitimate interests (to keep the Service secure, prevent misuse, and understand aggregate usage); and, where applicable, consent (for example, if you choose to sign in with Google). Where we must comply with a legal obligation — for example tax and accounting records for payments — we rely on that legal obligation.

4. Who we share your data with

We share limited data with the following third-party processors, strictly so they can provide their service to us:

• Stripe — payment processing and subscription billing;
• Resend — sending transactional emails (verification codes, password resets, security alerts, receipts);
• Google — authentication, only if you choose to sign in with Google.

Some of these providers may process data on servers outside the UK/EEA (including the United States); where that happens, they do so under their own published data protection safeguards, such as the UK's International Data Transfer Addendum or equivalent standard contractual clauses. We don't share your data with anyone else, and we never sell it.

5. Cookies and local storage

Apex only uses strictly necessary cookies — the kind needed to keep the Service working and you signed in. We don't use any analytics, advertising or tracking cookies. Specifically:

• access_token / refresh_token — keep you logged in between visits;
• admin_token — used only on staff accounts, to access the admin area;
• your chosen light/dark theme is saved in your browser's local storage (not a cookie) so the site remembers your preference on that device.

Because these are all strictly necessary to run the Service, UK rules on cookies (PECR) don't require us to ask for your consent to use them — but we still show a short notice on your first visit linking to this page, and you're always free to clear cookies/local storage in your browser at any time.

6. Data retention

We keep your account data for as long as your account is active. If you ask us to delete your account (see Section 7), we delete your personal data within a reasonable time once the request is processed, except where we're required to keep certain records for longer — for example billing records we must retain for tax purposes.

7. Your rights and how to exercise them

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to erase your data; restrict or object to certain processing; and receive your data in a portable format. To exercise any of these rights, email us at apexedu.london@gmail.com.

To delete your account specifically, use the "Request account deletion" button in your account Settings, or email us directly — either way, a deletion request is sent to us and we'll action it and confirm by email once it's done. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to resolve any concern directly first.

8. Children's privacy

Apex is intended for students aged 13 and over, consistent with our Terms of Service. If you are under 18, we expect a parent or guardian to be aware of your use of the Service, including any paid subscription. If you believe a child has provided us with personal data without appropriate consent, please contact us and we'll address it.

9. Security

We take reasonable technical and organisational measures to protect your data, including password hashing, encrypted connections (HTTPS), and access controls on our systems. No method of transmission or storage is completely secure, so we can't guarantee absolute security, but we work to keep your data safe and to respond quickly if anything goes wrong.

10. Changes to this policy

We may update this Privacy Policy from time to time, for example as Apex's features or data practices change. We'll update the "Last updated" date above whenever we do. Continuing to use Apex after a change means you accept the updated policy.

11. Contact

Questions about this Privacy Policy, or want to exercise any of your rights? Email us at apexedu.london@gmail.com.