Privacy Policy

The data controller for personal data collected through apexresell.com is:

Data you give us

• Email address: for your account, order delivery, and (if you opt in) marketing emails;
• Name and display name: optional; your display name, avatar, country and level can be shown on the community leaderboard;
• Password: stored by our authentication provider (Supabase) in hashed form; we never see it in plain text;
• Billing details: name, billing country and address collected by Stripe at checkout, used for payment and VAT;
• Messages: anything you send us through the contact form or by email.

Data collected automatically

• IP address and approximate location (country), for security, to decide whether to show the cookie banner, and for VAT;
• Browser and device info: user agent, device type, language;
• Site activity: pages viewed, products viewed and purchased, XP earned, referral and UTM parameters;
• Cookies and local storage: see Section 5.

Data from third parties

• Stripe: payment status, order and subscription details, billing country, and limited card information such as brand and last 4 digits. We never receive full card numbers or CVV codes;
• Google: if you sign in with Google, your name, email address and profile photo URL.

• Contract (Art. 6(1)(b) GDPR): creating your account, processing orders and subscriptions, delivering products and course access, sending order and account emails, customer support;
• Legal obligation (Art. 6(1)(c) GDPR): keeping accounting and tax records, VAT and OSS reporting, responding to lawful requests from authorities;
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the Site secure, preventing fraud and abuse, internal order alerts to our team;
• Consent (Art. 6(1)(a) GDPR): analytics (Google Analytics, Microsoft Clarity, our first-party analytics), advertising measurement (Meta Pixel and Conversions API), and marketing emails. You can withdraw consent at any time (see Sections 5 and 8). Withdrawing does not affect processing that already happened.

We do not sell your personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We share personal data with the following service providers, only as far as needed for the purpose listed:

Meta acts as a joint controller with us for the collection and transmission of Pixel data, and as an independent controller for its own further processing. Google, Microsoft and Meta process data under their own privacy policies.

We use essential cookies and local storage to run the Site. We use analytics and marketing cookies, including third-party advertising cookies from Meta, only with your consent. Visitors from the EU, EEA, UK and Switzerland see a cookie banner where they can accept or decline. Until you accept, analytics and marketing cookies are not set.

To change your choice, clear this site's cookies and local storage in your browser and the banner will appear again, or email privacy@apexresell.com. You can also block cookies in your browser settings, though some features (like staying logged in) need essential cookies.

• Account data: while your account is active. After you close your account we delete or anonymize it, except data we must keep by law;
• Order, invoice and VAT records: for the periods required by Bulgarian accounting and tax law (generally up to 10 years);
• Marketing email list: until you unsubscribe (every marketing email has an unsubscribe link);
• Analytics and advertising data: for the retention periods set in each tool, or until you withdraw consent;
• Support messages: as long as needed to handle your request and any follow-up.

Some providers above (for example Stripe, Vercel, Resend, Google, Microsoft, Meta and Telegram) may process data outside the European Economic Area, including in the USA. Where they do, the transfer relies on an adequacy decision such as the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses. You can ask us for more information about the safeguards for a specific provider.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, subject to legal retention obligations;
• restrict processing in certain cases;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time;
• lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at cpdp.bg/en or with the data protection authority in your country.

To exercise any of these rights, email privacy@apexresell.com. We respond within one month, as required by the GDPR.

We use reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption for all traffic to the Site;
• Payments handled entirely by Stripe, so card details never pass through our servers;
• Database access rules (row-level security) so users can only access their own records;
• Limiting access to personal data to people who need it.

No system is perfectly secure. If a personal data breach is likely to put you at risk, we will notify the supervisory authority and, where required, you, as set out in the GDPR.

ApexResell is intended for users 18 years and older. We do not knowingly collect personal data from children. If we learn that a child has provided us with personal data, we will delete it and close the account.

We may update this Privacy Policy. For material changes we will notify registered users by email before the new version takes effect. The date at the top of this page shows the latest revision.

For privacy questions or data subject requests, contact: