Privacy policy

1. Who is responsible

For the data of business owners and their team (account, billing, support), Apego is the controller.

For the data of each business's customers (name, email, phone, birth date, points and history), the business is the controller and Apego processes it on its behalf as processor.

2. What data we process

Business owners and their team: name, email, phone, country, business details, billing data (processed by Stripe; we don't store card numbers) and support messages.

Customers of a business: email, name, phone, birth date if provided, language, points, activity history and their choice about receiving emails.

Technical data: session cookies needed to keep you signed in, time zone and language preferences, and security logs.

3. Why we process it

To provide the service (legal basis: contract), to send the emails each customer agreed to receive (consent, which can be withdrawn at any time from the card or from any email), to bill subscriptions and meet tax obligations (legal obligation), and to keep the service secure (legitimate interest).

4. Data processing for businesses

When we process the data of a business's customers, we act only on the business's instructions, which are using the service as designed. We keep the data confidential, apply the security measures described below, help the business answer its customers' requests, only use the providers listed in section 5, and delete or return the data when the business closes its account.

5. Who we share it with

Only with providers we need to run the service, bound by data processing agreements: Railway (servers and database, located in the European Union), Cloudflare (website and DNS), Resend (email delivery), Stripe (payments and invoices) and Google (sign-in with Google, only if you use it). Some may process data outside the EEA under the European Commission's standard contractual clauses.

6. How long we keep it

While the account or the customer's card exists. Customers can delete their card from their account at any time. Billing records are kept for the period required by tax law (usually between 4 and 6 years).

7. Your rights

You can access, correct, delete, restrict or object to the processing of your data, ask for portability and withdraw consent by writing to hola@apegoapp.com. If you are a customer of a business, we'll pass your request to that business. You can also complain to your data protection authority (in Spain, the Agencia Española de Protección de Datos, aepd.es).

8. Cookies

We only use cookies that are strictly necessary: to keep your session, remember your language and time zone, and remember which program you are using. We don't use advertising or tracking cookies.

9. Security

Data travels encrypted, sign-in codes are stored hashed, and every operation checks that you have access to the business you are working on.