Privacy policy

1. Who we are

Apoji is run by [Company legal name], a company registered in England and Wales (company number [Company number]) with its registered address at [Registered address]. In this policy, "we" and "us" mean [Company legal name].

We are the data controller for the personal information described here. We handle it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. When an agency uses Apoji to look after information about its own clients and prospects, that agency decides what to enter and why, and we handle it on the agency's behalf to provide the service.

2. What we collect

Waitlist details. When you join the waitlist: your name, work email address, agency name, the number of clients you manage (as a range), the advertising platforms you use, and anything you choose to tell us about what you would like Apoji to fix. If you use the box on the home page, we collect only your email address.

Account details. Your name, email address and a hashed password. We never store your password itself.

Advertising platform data. When you connect an advertising account (Google Ads, Meta Ads, LinkedIn Ads, Microsoft Advertising or ChatGPT Ads), you give us permission, through the platform's own sign-in (OAuth), to read information from it: account names, campaigns, spend and performance figures. If you connect Google Calendar, we read your calendar events (read-only access) so that your calls can appear alongside your tasks. We also hold the tokens the platforms give us so that we can keep reading on your behalf; the long-lived refresh tokens are stored encrypted.

Information you enter. Clients, projects, budgets and targets, tasks, call notes, optimisation logs, reports and anything else you type into Apoji. This may include names and work details of your own colleagues and clients.

Technical information. A session cookie that keeps you logged in, and your IP address, which we use to keep the service secure and to limit repeated requests (for example repeated login attempts).

3. How we use it, and why we are allowed to

• To run the waitlist and contact you about early access. Lawful basis: your consent, which you give by joining. You can withdraw it at any time.
• To create and run your account and provide Apoji, including syncing your spend, showing pacing and health scores, sending budget alerts and sharing trackers you choose to share. Lawful basis: performing our contract with you.
• To keep Apoji secure, prevent abuse and limit repeated requests. Lawful basis: our legitimate interests in protecting the service and its users.
• To improve and support the service, and to answer your questions. Lawful basis: our legitimate interests in running a reliable, useful product, and performing our contract with you.
• To meet legal obligations, such as keeping accounting records. Lawful basis: legal obligation.

We do not sell personal information, and we do not use it for advertising.

4. Advertising platform data

Information we receive from your advertising and calendar accounts is used only to provide Apoji's features to you. We never sell it, never use it for advertising (ours or anyone else's), and do not share it beyond the service providers listed in section 6, who help us run Apoji.

Apoji's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Apoji's access at any time from the security or connected apps settings of your Google, Meta, LinkedIn or Microsoft account, or by disconnecting the account inside Apoji. Once access is revoked we stop reading from that account.

5. AI features

Some features use an AI model to help you. To generate insights and suggest follow-up tasks, we send relevant content, such as call notes, optimisation log entries and spend figures, to Anthropic's Claude API. Anthropic processes it to return a result to us. It is not used to train Anthropic's models. Nothing is created or changed in your workspace from a suggestion until you approve it.

6. Who we share it with

We use a small number of service providers, who process information only on our instructions:

• Vercel, which hosts the Apoji website and web app.
• Railway, which hosts the Apoji server.
• Neon, which hosts our database.
• Google Workspace, or the email service we use to send mail, which delivers the emails we send (for example budget alerts and invitations) and receives our messages.
• Anthropic, for the AI features described above.
• Slack, only if your organisation chooses to connect it for notifications.
• Fontshare and Google Fonts, which serve the typefaces used on this website. Your browser asks them for the font files, so they see your IP address.

We may also share information if the law requires it, or to protect our rights or the safety of others. If our business is ever sold or reorganised, information may pass to the new owner, who must honour this policy.

International transfers. Some of these providers are based in, or process information in, the United States and other countries outside the UK. Where that happens we rely on appropriate safeguards, such as the UK's adequacy arrangements, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Cookies and similar technologies

Apoji sets one cookie: a session cookie that keeps you logged in. It is strictly necessary for the service to work, so it does not need your consent. It is marked as secure and inaccessible to scripts, and it expires after 24 hours without activity.

The web app also uses your browser's local storage to remember interface choices, such as your colour scheme, filters and table sorting. This stays on your device and is not sent to us.

We do not use advertising cookies, analytics cookies or tracking pixels.

8. How long we keep it

• Waitlist details: until early access opens to you and for a reasonable time afterwards, or until you ask us to delete them.
• Account and workspace information: while your account is open. When it is closed we delete or anonymise it within a reasonable period, and it drops out of our backups as they are replaced.
• Advertising platform data: while the account is connected. Disconnecting stops us reading new data, and the figures already stored are deleted with your workspace or when you ask us to remove them.
• Sessions: a session ends after 24 hours without activity.
• Security and request records: only as long as needed to keep the service secure.

We may keep some information for longer where the law requires it, or where we need it to deal with a dispute.

9. Security

We protect information with measures that include encrypted connections, hashed passwords, encrypted storage of platform refresh tokens, access limited to your organisation's workspace, and restricted access to our systems. No online service is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been misused.

10. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your information;
• object to us using your information based on our legitimate interests, and ask us to restrict how we use it;
• receive the information you gave us in a portable format;
• withdraw your consent at any time, where we rely on it (this does not affect what we did before).

To use any of these rights, contact us using the details below. We will reply within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, although we would appreciate the chance to put things right first.

11. Contact us

For anything about this policy or your information, email [Contact email], or write to [Company legal name], [Registered address].

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell you, for example by email or inside Apoji.