Skip to main content
ApexSiteApexSite
Privacy

Privacy Policy

Updated 12 October 2026. This policy explains how we process your personal data under the EU General Data Protection Regulation (GDPR).

1. Data controller

ApexSite (sole trader / toiminimi)
Business ID: 3657019-5
Registered in: Oulu, Finland
Email: info@apexsite.fi
Phone: +358 44 2455490

2. Purposes of processing

We process your personal data to:

  • Respond to contact and quote requests
  • Provide your customer account and portal (projects, quotes, invoices, files)
  • Enter into and perform contracts, including invoicing and payments
  • Provide the website's AI chatbot and live support
  • Keep the service and accounts secure (sign-in verification, abuse prevention)
  • Meet legal obligations such as bookkeeping

3. Personal data we process

We only process data you give us or that arises from using the service:

  • Contact form: name, email, phone (optional), company (optional), message and the service you chose
  • Customer account: name, email, phone, address, password hash; with Google sign-in, the name and email Google provides
  • Sign-in and security data: IP address, browser and device, sign-in history and one-time verification codes
  • AI chatbot: the messages you type (we don't store them in our own systems)
  • Live support (only with your consent): Crisp conversations and Crisp's cookie identifier
  • Customer relationship: project, quote, invoice and payment data and our correspondence
  • Site performance measurement: anonymous load-time data, without cookies

4. Legal basis

Contract or pre-contractual steps (quote requests, customer account, projects, invoicing); legitimate interest (answering enquiries, managing the customer relationship, security and abuse prevention, the chatbot service); consent (Crisp live-support cookies — you can withdraw it at any time via Cookie settings at the bottom of the page); legal obligation (bookkeeping).

5. Retention

We keep data only as long as needed. One-time verification codes expire after 10 minutes and abuse-prevention request records are deleted when their limit window ends. Contact and customer data is kept for the duration of the customer relationship and afterwards as long as necessary to handle possible claims. Accounting records are kept as required by the Finnish Accounting Act (vouchers 6 years, financial statements 10 years). You can ask us to delete your account and data at any time.

6. Data processors

We do not sell personal data. The following service providers process data on our behalf:

  • Vercel Inc. (USA) — website hosting and content delivery: IP address and technical logs; Speed Insights performance measurement without cookies
  • Supabase Inc. (USA) — database and authentication: customer account, enquiry and customer-relationship data and sign-in data
  • Resend (Plus Five Five, Inc., USA) — email delivery: name, email address and message content (verification codes, enquiry confirmations)
  • OpenAI, L.L.C. (USA) — AI chatbot: the messages you type; OpenAI does not use API data to train its models and keeps it for at most 30 days for abuse monitoring
  • Crisp IM SAS (France, EU) — live support, only with your consent: conversations, any name and email you provide, and a cookie identifier
  • Stripe Payments Europe Ltd. (Ireland) — card payments in the customer portal: payment data (we never see or store card numbers)
  • Twilio Inc. (USA) — text messages (verification codes and account security alerts): phone number
  • Google Ireland Ltd. — only if you sign in with Google: Google shares your name and email with us
  • Sanity AS (Norway, EEA) — blog and content management: administrators' sign-in data only (no visitor data is shared)

Processors handle data only on our behalf and under their data processing terms (DPA). Data may be disclosed to authorities only where the law requires it.

7. Transfers outside the EU

Some processors (Vercel, Supabase, Resend, OpenAI, Twilio) are US companies, so data may be processed outside the EU/EEA. Transfers rely on the EU–US Data Privacy Framework for providers certified under it, and on the European Commission's Standard Contractual Clauses.

8. Your rights

You have the right to:

  • Know how your data is processed and access it
  • Have inaccurate data corrected
  • Have your data erased ("right to be forgotten")
  • Restrict or object to processing
  • Receive your data and transfer it to another controller
  • Withdraw your consent at any time (Cookie settings at the bottom of the page)

To exercise your rights, contact info@apexsite.fi. We reply within one month.

9. Cookies

We only use strictly necessary cookies (sign-in, sign-in verification and your cookie choice). We use no analytics or advertising cookies. Crisp live-support cookies are only set with your consent. See the cookie policy for details.

10. Security

All data is transferred over encrypted HTTPS. Passwords are never stored in plain text, sign-in is confirmed with a code sent by email, and database access is restricted row by row so each customer sees only their own data.

11. Right to lodge a complaint

You may lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman, tietosuoja.fi) if you believe your personal data is processed in breach of data protection law.

12. Changes to this policy

We update this policy when our practices or the services we use change. The date at the top shows the latest update.