Privacy policy

1. Scope

This policy covers visitors to www.apogee.ad, users of the Apogee service (app.apogee.ad), our prospects and our affiliates. It also describes the data we process on behalf of our customers (see Data processed for our customers).

2. Controller

APOGEE SAS, 32 Rue de Paris, 92100 Boulogne-Billancourt, France. For any question about your personal data: hello@apogee.ad.

3. Data processed

4. Purposes and legal bases

No decision producing legal effects concerning you or similarly significantly affecting you is made solely on the basis of automated processing. Our customer relationship tool calculates a follow-up priority from your use of the Service and your interactions with our emails; it is only used to organise our outreach.

Logging in with a Meta account is required to use the Service; billing data, including a payment method, is required to subscribe to a paid plan and, for accounts created from the activation of the 7-day trial, from sign-up.

5. Recipients and processors

Your data is disclosed to persons authorized by Apogee and, for the part that concerns them, to the following providers. Apogee does not sell your data.

• Meta: the source of your advertising data and the recipient of the content you launch. Meta acts as a separate controller. For the website's Meta Pixel, see Meta Pixel.
• Other ad platforms you connect (TikTok, Snapchat, X, Google Ads, Pinterest, AppLovin): when you connect one of them, it is the source of the advertising data Apogee reads from it and the recipient of the content you launch on it, and it acts as a separate controller (see Ad platforms you connect).
• Services you connect (Google Drive, Dropbox, Adobe/Frame.io, Slack): the exchanges take place at your request and their own policies apply.
• AI assistants you connect (for example Claude, ChatGPT, Grok, Cursor, Muse): their provider receives the answers of the Apogee tools your assistant calls and processes them under its own terms, independently of Apogee; it is not our processor (see "AI assistants connected to Apogee (MCP) and the API").
• WhatsApp (Meta): if you write to us on WhatsApp, or if we write to you at the number you gave us, WhatsApp processes these exchanges under its own terms.
• Partners (offers on the Partners page): we send them no data about you; the links to their websites carry parameters that identify Apogee, never you. On their websites, their own policies apply.
• Authorities: where the law requires it.

6. Ad platforms you connect

You can connect your own ad accounts to Apogee to launch your ads on them: Meta (Facebook, Instagram), TikTok, Snapchat, X, Google Ads (YouTube), Pinterest and AppLovin. Some of these platforms may not be available in your account yet. You connect each one yourself, through the platform's official sign-in or, for AppLovin, with an API key you create in your AppLovin account. When you connect one of these platforms:

• What Apogee sends to the platform, at your request: the creatives (videos, images) and the texts you upload or write, and the campaign, ad set (ad group, ad squad, line item) and ad settings, the targeting and the budget you choose.
• What Apogee reads from the platform: the ad accounts, pages and profiles you can use, what a launch needs (for example your pixels, or your campaigns and ad sets when you add ads to them) and, where Apogee displays them, the delivery statistics of your campaigns, ad sets and ads.
• Tokens and keys: the access tokens the platform gives Apogee when you sign in, or the key you paste, are stored on our servers and never shown to anyone else. They are only used to carry out, on your own ad accounts, what you ask Apogee to do (including when our support team acts on your behalf, with your agreement). They are deleted from our database when you disconnect the platform in Apogee or when your account is deleted.
• Each platform acts as a separate controller for the data it receives, under its own terms and privacy policy (links below). Apogee does not sell the data it receives from these platforms.

Google Ads: Apogee only uses the data it receives from Google to connect your Google Ads accounts, launch the ads you create and show you information about them in Apogee. Apogee does not sell this data, does not use it for ad targeting or personalization (other than the ads you create and launch yourself), and does not use it to develop, improve or train generalized AI models. Apogee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Apogee's access from your Google account (myaccount.google.com/permissions).

7. AI assistants connected to Apogee (MCP) and the API

Depending on your plan, you can connect to Apogee an AI assistant that supports the Model Context Protocol (MCP), including a personal agent that runs recurring tasks, or create an API key for your own programs. These assistants are services of providers independent of Apogee, for example Anthropic (Claude), OpenAI (ChatGPT), xAI (Grok), Anysphere (Cursor), Meta (Muse), Mistral AI or Perplexity. You connect them yourself, from the assistant or from Settings → MCP or Settings → Personal agents in the application, and you create your keys in Settings → API; each time, you choose what they may do: Read, Launch and Actions on your ad accounts.

• What the assistant can read and do: only what your Apogee account allows, within the permissions you chose and your plan: your connected ad accounts and what they contain (campaigns, ads, statistics, comments, Pages and pixels), the files you import, your launches. A launch, a Bridge transfer or a change to your ad accounts is first prepared and shown as a recap, valid for 24 hours, and only runs, once, when the assistant confirms it to Apogee; Apogee's tools ask the assistant to get your explicit approval first. With an API key, your program confirms it.
• What Apogee receives: only what the assistant or your program sends to Apogee's tools, for example an ad account ID, your answers to the launch questions, your ad texts or the address of a page to read. Apogee does not receive your conversation with the assistant.
• Connections and keys: for each connected assistant, its name, the connection date, the permissions granted and when it was last used; for each API key, its name, permissions, end date, when it was last used and a few characters to recognise it. Authorization codes, access and refresh tokens and API keys are only stored as a fingerprint (SHA-256), never in clear: a key is shown only once, when it is created. Creating a key is reported to our team in an internal alert (the account's email address, the key's name, permissions and end date, never the key itself).
• Request log: for each connection of an assistant to the MCP server, each tool it calls and each API request, Apogee records the type of access (assistant connection or API key) and its identifier, the name of the assistant or key, the name and version of the connecting software and its identification (user agent), the tool or operation called, the ad account and the preparation concerned, the outcome (success, or the error message), the duration and the credits used; for the API, also the HTTP method, the route, the response code and the request ID. This log never contains the content of the requests (the tools' arguments, the request bodies) nor your IP address. An error on Apogee's side is also recorded in our internal error tracking.
• Preparations: what you have prepared (launch plans, actions, Bridge transfers, with their ads, texts and chosen files) is kept with your account's launch history, whether it ran or not. For an API write sent with an idempotency key, Apogee's answer is kept so that it can be sent again unchanged if your program repeats the same request within 24 hours.
• Who can see it: you, in Settings → Usage (calls and credits of your keys and assistants); in a workspace, its owner and admins, who see there for each member their name, email address, number of calls and active accesses, credits used and date of last activity, and whose owner can cap a member's credits or cut their access; authorized Apogee staff, for support, security and counting credits. Apogee does not sell this data and does not use it to train AI models.
• How long: an authorization code lasts 10 minutes, an access token 1 hour, a refresh token 60 days, replaced at each use; an API key works until the end date chosen when it is created, one year at most. The rest (connections and keys, including revoked or expired ones, which can no longer be used; the request log; preparations) is kept as long as your account exists and deleted with it (see "Retention periods").
• The assistant's provider: it processes what goes through its assistant, including your conversation and the answers of Apogee's tools (which may contain the data of your ad accounts and launches, as well as your Apogee name and email address), under its own terms and privacy policy, possibly outside the European Union. You choose and use it within your own relationship with it: it is not a processor of Apogee and is not listed in the table of processors. Apogee only sends it its tools' answers to the assistant's requests. Some of these providers (Anthropic, OpenAI) are also, separately, processors of Apogee for its own AI features: that role is distinct from that of the provider of your assistant.
• Removing access: at any time, with "Disconnect" next to the assistant in Settings → MCP or Settings → Personal agents, or "Revoke" next to the key in Settings → API: access stops immediately, and what has already been launched or changed on your ad accounts stays in place. You can also disconnect Apogee from the assistant, as far as it allows.

8. Transfers outside the European Economic Area

Some providers are established outside the European Economic Area, in particular in the United States (for example Vercel Inc. and Railway Corporation) and in Singapore (Supabase Pte. Ltd.), or may process data there.

For providers that are covered by them or offer them, these transfers rely on an adequacy decision of the European Commission, in particular the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses included in the provider's contractual terms. You can obtain a copy of these safeguards by writing to hello@apogee.ad.

For the Meta Pixel data sent to Meta, see Meta Pixel.

For the AppLovin Pixel data sent to AppLovin, in the United States, see AppLovin Pixel.

9. Retention periods

• Account: for as long as your account exists. When you ask for your account to be deleted (see Deleting your data), we handle your request manually and delete the data concerning you, except the data we must keep to comply with a legal obligation or to establish, exercise or defend our rights.
• Sign-up answers and WhatsApp number: for as long as your account exists; you can ask us at any time to delete your number. The record of your agreement to receive our offers on WhatsApp is kept for as long as that agreement stands, then as long as needed to prove it.
• Access requests from our ads (/start page): if you do not create an account, 12 months after your request, then deleted automatically; if you create an account, the request is linked to it and kept as long as your account.
• 7-day trial (dates, status, card fingerprint): as long as your account exists; invoices and accounting records, including the one for the trial fee, follow the retention of billing data.
• Meta access tokens and your Pages data: until you disconnect Facebook in Apogee or your account is deleted.
• Integration access tokens: until you disconnect the integration in Apogee or your account is deleted.
• Access tokens and keys of the other ad platforms you connect: until you disconnect the platform in Apogee or your account is deleted.
• AI assistants and API: an authorization code lasts 10 minutes, an access token 1 hour, a refresh token 60 days (replaced at each use) and an API key until the end date chosen (one year at most); connections and keys (including revoked or expired ones, which can no longer be used), the request log and preparations are kept as long as your account exists, then deleted with it; answers kept for an idempotency key are sent again for 24 hours, then deleted over time, at the latest with your account.
• Imported files: files used in a launch are deleted automatically about 24 hours after the launch; files that are not launched, about 7 days after they are imported; AI-generated images, about 24 to 48 hours after they are created, unless you save them in a template; brand assets and templates, until you delete them or your account is deleted.
• Billing data and accounting records: 10 years (accounting obligation).
• Connection logs and technical logs: for as long as needed for the security of the Service and for diagnosing errors. Apart from our internal administration console (for our team only), they contain no IP address; the request logs of our hosting providers (Vercel, Railway) do, for the period each of them sets.
• Website visit statistics: 13 months, then deleted automatically; the presence signal, 24 hours at most.
• Customer relationship management (usage history, interactions with our emails, notes): for as long as your account exists; for prospects, see below.
• Exchanges with us (emails, messages, feedback form): for as long as they are useful for following up on your request and our relationship; you can ask for them to be deleted. In our follow-up tool, the subjects and excerpts of the emails synced from our mailbox are deleted after 24 months, and the meetings from our calendar 24 months after they took place.
• Workspace invitations: until the workspace is deleted.
• Usage statistics and session recordings (PostHog): according to the retention period of our PostHog account.
• Internal team alerts: in the history of our internal tools, until they are deleted.
• Comments analysed for a customer: until the customer asks for them to be deleted or until the customer's account is deleted.
• Prospects: in our follow-up tool, prospect records with no exchange at all with us are deleted automatically after 3 years without activity; other prospect data is kept for as long as it is useful to our business relationship. You can ask for it to be deleted at any time.
• Affiliates: for the duration of participation in the program, then for the legal retention period for accounting records as regards payment data.
• Unsubscribe list: kept so that your objection continues to be honoured.
• Your tracker choice: 6 months.
• Meta Pixel: _fbp cookie (90 days according to Meta) and _fbc cookie (set by Meta); the data received by Meta, for the period Meta sets (see Meta Pixel).
• Campaign parameters kept for the visit: until the tab is closed.

10. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. You can object at any time to our emails and to prospecting. You can withdraw your consent at any time, and give instructions on what happens to your data after your death.

To exercise your rights, write to hello@apogee.ad. We may ask you to prove your identity.

We reply within one month, which may be extended by two months given the complexity or number of requests; in that case we let you know.

You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

11. Deleting your data, including Meta data

1. In Apogee, you can disconnect your Facebook account (Account menu): the Meta access token is revoked with Meta and your Pages data is deleted from our database.
2. You can also remove Apogee from your Facebook account: Settings & privacy → Settings → Apps and websites.
3. To ask for your account and your data to be deleted, write to hello@apogee.ad from your account's email address, with the subject "Delete my data". We confirm the deletion once it is done, within the time frame set out in Your rights, subject to the data the law requires us to keep.

12. Google user data

• Access: if you connect Google Drive, Apogee accesses the email address of your Google account and, read-only, your Google Drive files. Apogee only imports the files you select.
• Use: to import them into Apogee and create the ads you launch.
• Sharing: imported files are sent to Meta, or to the other ad platform you connect, when you launch ads, and may be analysed by the AI providers listed above when you use an AI feature. Apogee does not sell these files, does not use them for ad targeting or personalization (other than the ads you create and launch yourself), and does not use them to develop, improve or train generalized AI models.
• Storage and protection: the access and refresh tokens are stored in our database, hosted by Supabase (Paris region); the access token is passed to our background task provider (Inngest) to carry out imports; exchanges are encrypted (HTTPS).
• Retention and deletion: imported files are kept as set out in Retention periods. These tokens are deleted from our database when you disconnect Google Drive in Apogee; you can also revoke access from your Google account (myaccount.google.com/permissions).
• Google Ads: if you connect Google Ads to launch ads on YouTube, Apogee accesses your Google Ads accounts and the email address of your Google account; see Ad platforms you connect for how this data is used, stored, shared and deleted.

Apogee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Cookies and trackers

The website and the application use cookies and similar trackers (browser local storage, pixels, measurement scripts). Here they are, by purpose.

Necessary trackers (no consent required)

Audience measurement

Audience measurement exempt from consent

Advertising

Affiliation

Apart from our website visit statistics, which store nothing on your device (see below), audience measurement, advertising and affiliation trackers are only set with your agreement, on the website and in the application. You can accept or refuse, then change your choice at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form). Your choice is kept for 6 months and applies to both the website and the application.

Meta Pixel

On www.apogee.ad and on the application's /start page (app.apogee.ad/start), and only if you accept "Advertising and affiliation" in the cookie banner (outside Europe, on our ads page: see below), we use the Meta Pixel, a tool provided by Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, D04 X2K5, Ireland). On the website, it sends Meta the pages you view (their address), the display of our pricing and your clicks on key actions: booking a call, writing to us on WhatsApp. On the /start page, it sends the page view and, when you give your email address, a "Lead" event. As with any request, Meta also receives your IP address and information about your browser. The Meta Pixel sets the _fbp and _fbc cookies on our domain and, if your browser accepts third-party cookies, Meta may also read or set its own cookies. We have turned off the automatic sending of clicks on other buttons and of page metadata (the Meta Pixel's "automatic configuration").

We use this data to measure the results of our ads on Facebook and Instagram and to show our ads there to people who visited our website or the /start page (retargeting). Meta may also use it for its own purposes, described in its privacy policy. Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form); the Meta Pixel is then no longer loaded and the _fbp and _fbc cookies are deleted.

Our ads page outside Europe. On the /start page (app.apogee.ad/start and /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), when your browser's time zone is that of the United States, Canada (except a browser set to French, as in Quebec), Australia, New Zealand or the United Arab Emirates, the Meta Pixel loads as soon as the page opens, without waiting for your choice: the law of these countries asks for clear information and a simple way to refuse rather than prior consent. The "Cookie settings" link under the form tells you so and stops it at any time (the _fbp and _fbc cookies are then deleted); a browser that sends the Global Privacy Control signal is treated as a refusal. Legal basis on that page: our legitimate interest in measuring our ads, which you can object to in these ways. Everywhere else, including the European Union, the United Kingdom and Switzerland, nothing changes: the Meta Pixel only loads with your consent, which you can give with that same link (on that page the cookie banner does not open by itself).

Apogee and Meta Platforms Ireland Ltd are joint controllers (Article 26 GDPR) for the collection of this data by the Meta Pixel and its transmission to Meta (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). How Meta then uses it is its sole responsibility. Meta's joint controller addendum ("Controller Addendum", facebook.com/legal/controller_addendum) sets out the roles: Apogee provides you with this information; Meta Platforms Ireland Ltd enables the exercise of your rights of access, rectification, erasure, restriction and portability (Articles 15 to 20 GDPR) over the data it keeps after the transmission. You can exercise your rights with either of us: write to hello@apogee.ad or see Meta's privacy policy (facebook.com/privacy/policy), which also describes its legal bases and how to exercise your rights with Meta.

Meta Platforms Ireland Ltd may transfer this data to Meta Platforms, Inc., in the United States. Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework (list kept by the US Department of Commerce, dataprivacyframework.gov); Meta describes in its privacy policy the safeguards it applies to its transfers. How long Meta keeps the data it receives is set by Meta.

X Pixel

On www.apogee.ad and on the application's /start page (app.apogee.ad/start), and only if you accept "Advertising and affiliation" in the cookie banner (outside Europe, on our ads page: see below), we use the X Pixel, a tool provided by Twitter International Unlimited Company (Dublin, Ireland), which provides X's advertising services in the European Union. It sends X the pages you view (their address). As with any request, X also receives your IP address and information about your browser. If you arrive from an X ad, the X Pixel keeps that click's identifier in the _twclid cookie, on our domain; if your browser accepts third-party cookies, X may also read or set its own cookies.

We use this data to measure the results of our ads on X and to show our ads there to people who visited our website or the /start page (retargeting). X may also use it for its own purposes, described in its privacy policy (x.com/privacy). Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form); the X Pixel is then no longer loaded and the _twclid cookie is deleted.

Our ads page outside Europe. On the same terms as the Meta Pixel (see "Meta Pixel"): on the /start page (app.apogee.ad/start and /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), when your browser's time zone is that of the United States, Canada (except a browser set to French, as in Quebec), Australia, New Zealand or the United Arab Emirates, the X Pixel loads as soon as the page opens, without waiting for your choice; the "Cookie settings" link under the form or the Global Privacy Control signal stop it and delete the _twclid cookie. Legal basis on that page: our legitimate interest in measuring our ads. Everywhere else, including the European Union, the United Kingdom and Switzerland, the X Pixel only loads with your consent.

Apogee and Twitter International Unlimited Company are joint controllers (Article 26 GDPR) for the collection of this data by the X Pixel and its transmission to X (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). How X then uses it is its sole responsibility. You can exercise your rights with either of us: write to hello@apogee.ad or see X's privacy policy (x.com/privacy), which also describes how to exercise your rights with X.

Our server also sends X, through its Conversion API, events to measure the results of our ads: your access request from the /start page, the creation of your account, the opening of the payment page, the validation of your payment method, your first payment and each of your payments, with the amount excluding tax of the plan or of the payment. Each event carries the X click identifier of your arrival, if it exists, your email address and phone number, hashed (SHA-256) before sending, and, if it is sent during your own visit, your IP address and information about your browser, which we do not store. These events do not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad.

X may transfer this data outside the European Union, notably to X Corp., in the United States; X describes in its privacy policy the safeguards it applies to these transfers. How long X keeps the data it receives is set by X.

AppLovin Pixel

On www.apogee.ad and on the application's /start page (app.apogee.ad/start), and only if you accept "Advertising and affiliation" in the cookie banner (outside Europe, on our ads page: see below), we use the AppLovin Pixel, a tool provided by AppLovin Corporation (1100 Page Mill Road, Palo Alto, California, United States). It sends AppLovin the pages you view (their address, their title and the page you came from), your clicks on the page (the type, name and identifier of the clicked element and the address of a link, never what you type), the time spent on the page and, if you arrive from an AppLovin ad, that click's identifier (the aleid and alart parameters of the address). On the /start page, it also sends a "generate_lead" event when you give your email address (a fixed value and the page's currency, without your email address) and a "subscribe" event when the payment of your trial is confirmed (its amount and currency). As with any request, AppLovin also receives your IP address and information about your browser and device (language, screen and window sizes, page loading times). We have turned off the AppLovin Pixel's automatic collection of the email addresses typed into forms.

The AppLovin Pixel sets on our domain the _axwrt and _axwrt_ts cookies (a visitor identifier), ax_visitor (the dates and number of your visits) and, if you arrive from an AppLovin ad, _axeid and _axart (that click's identifier), for one year; it keeps a copy in your browser's local storage, and a session identifier in its session storage. If your browser accepts third-party cookies, AppLovin may also read or set its own cookies (for example axcrt, on applovin.com), and your browser calls a Google address (cm.g.doubleclick.net) that lets AppLovin match its identifier with Google's (cookie syncing).

We use this data to measure the results of our AppLovin ads and to show our ads, in the mobile apps of the AppLovin network, to people who visited our website or the /start page (retargeting). AppLovin may also use it for its own purposes. For more information about AppLovin's collection and use of your information visit: https://legal.applovin.com/privacy/. Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form); the AppLovin Pixel is then no longer loaded, and its cookies and what it keeps in your browser are deleted.

Our ads page outside Europe. On the same terms as the Meta Pixel (see "Meta Pixel"): on the /start page (app.apogee.ad/start and /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), when your browser's time zone is that of the United States, Canada (except a browser set to French, as in Quebec), Australia, New Zealand or the United Arab Emirates, the AppLovin Pixel loads as soon as the page opens, without waiting for your choice; the "Cookie settings" link under the form or the Global Privacy Control signal stop it and delete its cookies. Legal basis on that page: our legitimate interest in measuring our ads. Everywhere else, including the European Union, the United Kingdom and Switzerland, the AppLovin Pixel only loads with your consent.

Apogee and AppLovin Corporation are joint controllers (Article 26 GDPR) for the collection of this data by the AppLovin Pixel and its transmission to AppLovin (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). How AppLovin then uses it is its sole responsibility. You can exercise your rights with either of us: write to hello@apogee.ad or use AppLovin's form (applovin.com/en/privacy-data-request), described in its privacy policy; AppLovin has appointed a representative in the European Union (Prighter, Hanover, Germany).

AppLovin Corporation is established in the United States: this data is sent there directly. AppLovin states in its privacy policy that it complies with the EU–US Data Privacy Framework and its UK and Swiss extensions. How long AppLovin keeps the data it receives is set by AppLovin (generally two years at most, according to its privacy policy). Our server sends nothing to AppLovin.

The application's /start page

Our Meta ads may bring you to the app.apogee.ad/start page (or /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), where you ask for access to Apogee without creating an account: you give your first name, your email address, your WhatsApp number and your "About you" answers (see "Data processed"). We use them to email you a personal link, to open on a computer, then up to five reminders over four days until you create your account (each email has a link to stop them), and to link your request to the account you create when you log in with Facebook: from your personal link, your sign-up reuses your answers. This link works for 30 days and no longer once your account is created. Your request also appears in our customer-relationship records, and we may write to you on WhatsApp, at the number you gave, to help you move to a computer. From this page, you can also pay for the 7-day trial ($1, €1 or £1) through Stripe before you have an account: Stripe receives your email address and first name, we keep your payment's and subscription's Stripe identifiers with your request to link your trial to the account you create when you log in with Facebook, and our server sends Meta, as described below, the "InitiateCheckout" event when the payment page opens and the "StartTrial" event once the trial is paid.

If you do not create an account, this data is deleted 12 months after your request. The page sets a strictly necessary cookie, apogee_start (30 days), which only lets this browser resume your request and show your link there again; it therefore does not depend on your choice about cookies. On this page we also count, without ever reading what you type, whether the form was started (a field touched or filled in, the button pressed): an anonymous statistic, like the pages viewed, with the day's visit key and without cookies; you can object to it as to audience measurement.

When you give your email address, then when you finish your request, our server sends Meta Platforms Ireland Ltd, through its Conversions API, an event ("Lead", then "OnboardingComplete") to measure the results of our ads: your email address, your first name, your request's identifier and, at the end of the request, your phone number and its country, hashed (SHA-256) before sending; the page address; the _fbp and _fbc cookie identifiers and the ad click identifier, if they exist; your IP address and information about your browser, which we do not store. These events do not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad. Meta may transfer this data to the United States (see "Meta Pixel").

7-day trial

For accounts created from the activation of the 7-day trial, signing up includes choosing a plan and paying a trial fee of €1, $1 or £1 depending on the billing currency, tax included, on the Stripe payment page: there you give a payment method and the billing information that page asks for (see "Data processed"). Stripe processes your card numbers; Apogee does not receive them. We keep the dates, plan and status of your trial, as well as your card's fingerprint computed by Stripe, which does not reveal its number: we use it to spot a card already used for another trial, in which case our team is informed.

When your trial starts, our server sends Meta Platforms Ireland Ltd, through its Conversions API, a "StartTrial" event to measure the results of our ads: the plan you chose, its billing period and its monthly price excluding tax; your email address, your name, your Apogee identifier and, if known, your phone number, city, postal code and country, hashed (SHA-256) before sending; the _fbp and _fbc cookie identifiers, the ad click identifier and the browser information recorded when you signed up, if they exist. Your IP address is not sent with this event. This sending does not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad. Meta may transfer this data to the United States (see "Meta Pixel").

Links to the application

If the address of a website page contains campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), ad click identifiers (fbclid, gclid, twclid, aleid, alart) or affiliation parameters (ref, via, fpr), the links from that page to the website's other pages and to the application app.apogee.ad carry them over, without storing anything on your device; a value containing an email address is ignored. These parameters thus follow your visit from page to page. When you click a link to another page of the website or to the application, that link also carries the website page you arrived on (ap_lp) and the name of the website you came from, without the rest of its address (ap_ref, for example www.google.com); the next page removes them from the address bar at once. If you create an account, the application keeps them with it, as the page and the website the sign-up came from. In the application, they are only used by the trackers you accept there. If you accept "Advertising and affiliation" in the cookie banner, the website also keeps these parameters, the page you arrived on and the website you came from, for the length of your visit, in your browser's session storage (apogee_attribution, deleted when the tab is closed or when you withdraw your agreement), to carry them over from any page of the website, even one you reach without following these links.

If the address contains an affiliate's token (the fpr, via or ref parameter), the website or the application also sends our server, without storing anything on your device, that token and, if there is one, the sub-identifier of their link (sid), the page viewed and the name of the website you came from, to count the clicks on that affiliate's link. If you accept "Advertising and affiliation" in the cookie banner, the ap_aff cookie keeps that token and the click's identifier and date for 60 days, to credit your sign-up to the affiliate, on the website and in the application.

The plan buttons in our pricing grid lead to the application's sign-up page, with the chosen plan and billing period in the link's address, and carry these parameters over like any link to the application. They do not open a payment page and send nothing to our server.

Website visit statistics

Every page of www.apogee.ad sends our server (hosted by Railway) the page address without its parameters, the name of the site you came from and, when they are in the page address, the utm_source, utm_medium and utm_campaign parameters (100 characters at most; a value containing an email address is ignored), then, every minute while the page is on screen, a presence signal. This stores nothing on your device, neither cookies nor local storage: it only reads your choice about trackers, to respect your objection or your agreement.

From the request, our server works out the device type, browser and operating system (without keeping the full user-agent string) and, from your IP address, on our servers and without sending it to any third party, your city, region, country and the approximate coordinates of the city. It also computes a visit key of its own for the website, from your IP address and your browser, with a secret that changes every day: one day's key looks nothing like another day's. A day's secret is deleted from our database the next day; our backups keep it until the end of their retention period. Your IP address is then discarded: we do not record it.

If you accept audience measurement with the website's cookie banner, your browser tells our server, which then also computes, for each page view, the visit key that the app.apogee.ad application computes for the same IP address and browser that day. This lets us count the website visitors who then open the application's sign-up page on the same day, from the same browser and network, without being signed in to an account. Without this agreement, the website's key cannot be matched with any data of the application.

This data is only used to produce statistics for Apogee: visitors, page views, most viewed pages, where visitors come from, countries and cities, device types and, with your agreement, this move to the sign-up page. We do not link it to your account, do not pass it on to any third party and do not use it to follow you on other websites. It is deleted after 13 months; the presence signal after 24 hours at most.

This audience measurement, apart from the move to the sign-up page, is exempt from consent (article 82 of the French Data Protection Act; CNIL guidelines of 17 September 2020). You can object to it at any time: refuse audience measurement with the "Cookie settings" link at the bottom of every page, or turn on the Global Privacy Control or "Do Not Track" signal in your browser. Your browser then sends no visit statistics at all. Your choice, agreement or refusal, is kept for 6 months; after that, and until you choose again, the visit statistics without cookies resume, without the move to the sign-up page.

Some pages load third-party resources (icons, fonts, flags), which sends your IP address to those third parties.

Traffic from AI assistants

Our host (Vercel) checks every page requested to recognise the crawlers of AI search engines and assistants (GPTBot, ClaudeBot, PerplexityBot…) and reports their visits to our provider CiteMe. This check uses, at that moment, the page address, the browser identification (user-agent), the IP address and the referring site; your IP address is never passed to CiteMe.

If you arrive from an AI assistant (ChatGPT, Perplexity, Claude, Gemini, Copilot…) before making any choice in the cookie banner, our host passes to CiteMe the landing page address with its parameters, the name of the assistant you came from, a few technical navigation indicators (Sec-Fetch headers) and, if that page is one of our conversion pages, the fact that it is a conversion. Nothing is read from or stored on your device, neither cookies nor local storage: the arrival gets a random identifier, which is kept nowhere on your side and cannot recognise you on your next visit. A page opened with an ad click identifier (gclid, fbclid…) is not counted. To spot arrivals from an AI that do not reveal where they come from, our host may also pass to CiteMe, for a page opened from another site without a referrer or by software, the page address and the same indicators, without any identifier.

With your agreement to audience measurement, CiteMe also follows your visit and conversions (for example a click to the application's sign-up) to credit them to the AI assistant you came from, using its script and the cookies described in this section.

This data is used to measure, for Apogee, traffic from AI search engines and assistants. You can object to it at any time: refuse audience measurement with the "Cookie settings" link at the bottom of every page, or turn on the Global Privacy Control or "Do Not Track" signal in your browser. Our host then only passes to CiteMe the visits of crawlers, which do not concern you.

14. Security

We implement technical and organizational measures to protect your data, including encryption of exchanges between your browser and our services (HTTPS), request rate limiting and access-control rules in the database. So that Meta can retrieve your creatives, the files intended for your ads are accessible through a technical address (URL) for as long as they are kept. No measure can rule out all risk. In the event of a data breach, we inform the CNIL and, where applicable, the people concerned, under the conditions laid down by the GDPR.

15. Emails

• Service emails: workspace invitations, notifications, automation reports and billing. They are needed for the Service to work.
• Product tips and occasional offers to account holders: you can unsubscribe at any time through the unsubscribe link in our tips and offers emails, by replying to one of our emails, or by writing to hello@apogee.ad.
• Measurement: we measure whether these emails are opened and which links are clicked, to assess their interest and adapt our exchanges with you; this information is linked to your customer relationship record.

16. Prospects

• Data: name, job title, company, business email address and phone number, notes on our exchanges, resources requested, interactions with our emails; for emails exchanged with us, the sender, recipients, date, subject and a short excerpt (never the full content or attachments); for our meetings, their title, date and participants.
• Sources: website forms, exchanges with us (email, WhatsApp, meetings), business contacts from our network or from professional sources.
• Purpose and legal basis: following up with our professional prospects and contacting them by email, phone or WhatsApp, on the basis of our legitimate interest; we may use an AI tool to prepare this outreach. You can object at any time.
• Retention: see Retention periods.
• Information: if we did not obtain your data from you, we inform you within one month of obtaining it and, at the latest, when we first contact you.

17. Data processed for our customers

When a customer uses Apogee, we process on its behalf data about people who are not our users: people who appear in its creatives, and people who comment on its ads (identifier or username, name, profile picture, comment text). The customer is responsible for this processing; to exercise your rights, contact the customer. If you write to us, we forward your request to the customer concerned.

18. Minors

The Service is intended for professionals and is not intended for people under 18.

19. Changes

We may change this policy. In the event of a significant change, we inform you by email or by a message in the application. The date of the last update is shown at the top of the page.

This version, of September 26, 2026, updated on November 3, 2026 (website visit statistics, Partners page, launch flow, Meta Pixel, links to the application, the application's /start page, 7-day trial, our ads page outside Europe, ad platforms you connect, AI assistants connected to Apogee (MCP) and the API), replaces the one dated March 9, 2026: previous version.