Privacy Policy

1. Our role

• Customer Data. When our business customers ("Customers") use the Service, they decide what data about their employees, suppliers and other trading partners is processed. For that data, the Customer is the controller and APIXX is the processor (or service provider) acting on the Customer's instructions.
• Our own data. For website visitors, people who contact us, Customer account administrators, and billing information, APIXX is the controller.

If you are a supplier or trading partner invited by a Customer, please direct requests about your data to that Customer. We will help them respond.

2. Data we collect

• Account data: name, work email, company, role and sign-in records for Customer users and invited partner users.
• Business and transaction data: purchase orders, acknowledgments, change requests, shipment notices, receipts, invoices, payment status and related messages, including data retrieved from the Customer's connected business systems.
• Supplier onboarding data: company details, contacts, addresses, tax classification, banking details, and documents such as W-9 forms and insurance certificates. Documents are stored encrypted. Full tax identification numbers and full bank account numbers are not stored as structured fields in our application database; we keep masked values for display.
• Communications: emails and replies sent to or through the Service, and messages sent to us through our contact form.
• Billing data: billing contact and subscription details. Payment card details are collected and held by our payment processor, not by APIXX.
• Technical data: IP address, browser and device information, and logs of actions taken in the Service, used for security, troubleshooting and audit.

3. How we use data

We use personal data to provide and support the Service, operate the connections a Customer enables, send transactional and workflow notifications, secure the Service and prevent abuse, maintain audit records, bill for the Service, respond to inquiries, and meet legal obligations. Where AI-assisted features are used (for example, to interpret a supplier's emailed reply), data is processed only to provide that feature to the Customer. We do not use Customer Data to train general-purpose AI models.

We do not sell personal data, and we do not use Customer Data for advertising.

4. Legal bases

Where data protection laws such as the GDPR or UK GDPR apply to data we control, we rely on performance of a contract, our legitimate interests in operating and securing the Service and our business, compliance with legal obligations, and, where required, consent.

5. How we share data

We share personal data only:

• with the Customer that owns the workspace, and with the users and partners that Customer authorizes;
• with service providers (subprocessors) that host, secure or support the Service, such as cloud hosting and database providers, email delivery, payment processing (Stripe), integration connectivity (Nango), and AI processing providers, each bound by contractual confidentiality and data protection obligations;
• with the third-party business systems a Customer chooses to connect;
• when required by law or to protect rights, safety and the security of the Service; and
• in connection with a merger, acquisition or sale of assets, subject to this Policy.

A current list of subprocessors is available on request at support@apixx.io.

6. International transfers

APIXX is based in the United States, and data may be processed in the United States and other countries where our service providers operate. Where required, we use appropriate safeguards such as standard contractual clauses for transfers.

7. Retention

We keep Customer Data for the life of the Customer's subscription. After termination, Customers may export their data for 30 days, and we delete Customer Data from active systems within 90 days of termination, and from backups on their normal rotation, unless the law requires us to keep it longer. We keep billing and account records, and security and audit logs, for as long as needed to meet legal, tax and accounting obligations.

8. Security

We use encryption in transit and at rest, tenant- and supplier-scoped access controls, single-use sign-in links for partner users, encrypted storage for sensitive documents, and an append-only audit log. More detail is on our Security page. No system is perfectly secure; we will notify affected Customers of a security incident involving their data without undue delay, as required by law and our agreements.

9. Cookies and similar technologies

We use cookies and browser storage that are necessary to sign you in, keep your session secure and remember preferences. If we use analytics on our website, we use it to understand aggregate site usage, and you can control cookies through your browser settings.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to receive a copy of it, and to withdraw consent. California residents may also have rights under the CCPA/CPRA; we do not sell or share personal data for cross-context behavioral advertising. To make a request about data APIXX controls, email support@apixx.io. For data processed on behalf of a Customer, contact that Customer. We will not discriminate against you for exercising your rights, and you may complain to your local data protection authority.

11. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal data.

12. Changes

We will notify Customers of material changes to this Policy by email or in the Service and will update the date above.

13. Contact

APIWORX LLC dba APIXX · support@apixx.io