Privacy Policy — Apex Digital Media

Who we are, and what this policy covers

Apex Digital Media LLC is a Florida limited liability company. We build and operate customer-acquisition systems for licensed insurance agents and agencies. We are not an insurance carrier, we do not sell insurance, and we do not provide insurance, investment, tax or legal advice.

Apex Digital Media LLC 55 Weston Rd Suite 205 Weston, FL 33326 privacy@apexdm.co

This policy covers:

apexdm.co, our business website, including the pages describing our programs and the application form for agencies who want to work with us
app.apexdm.co, the client portal where agencies and their producers manage their account and review what we delivered
The business communications we send to applicants, clients and their staff

This policy does not cover consumers. Consumers who ask to be called reach us through Summers Ahead, a brand of Apex Digital Media LLC, and their information is governed by the Summers Ahead Privacy Policy at summersahead.com/privacy. If you are an individual consumer who was called about retirement planning, that is the policy you want.

There is one place the two meet, and it is set out in full under "Consumer information in the client portal" below.

Information we collect

From agencies applying to work with us

When you submit the application on apexdm.co:

Business contact information. First and last name, business email address, business or mobile phone number, company or agency name, and a company website or professional profile link.

Business and qualification answers. Your role and decision-making authority; your organization's licensing and production status; the products you sell; producer headcount and an approximate annual premium band; the states you are licensed in and the states you want covered; the consumer profile you want to reach; your capacity; your budget band; your desired start timeline; and any free-text context you add.

Your consent. The exact wording of the consent you agreed to, and the date and time you agreed to it.

Advertising and attribution data. If you arrive from an advertisement or a tagged link, we capture the campaign tags in the web address, the advertising platform's click identifier, the landing page, and the referring page. Where our advertising pixel is active we also read the cookies that pixel sets in your browser.

Technical data. The IP address and browser user agent your device sends when you submit, used for fraud prevention and advertising measurement.

Information we derive. From your answers we compute an internal qualification score, tier and the reasons behind them. This is used to route your application. It is not shown back to you and it is not shared with any advertising platform.

Scheduling information. If your application qualifies we issue a single-use booking link. When you use it, our scheduling provider collects the booking details you give it and tells us that a call was booked, moved or cancelled.

From clients and their staff using the portal

Account information. Name, business email address, a securely hashed password, session records, and which seats and permissions your organization has assigned.

Organization information. Your legal or trading name, the states your organization is licensed in, your named contacts by role, your program configuration, and your activation status.

Commercial information. Your signed agreement and its terms, your prepaid unit balance, your delivery window, invoices and payment status, and any disputes you raise and how they were decided.

Usage information. What you viewed and did in the portal, recorded against your account.

Payment information

Payment card and bank details are collected and processed by our payment processor. We never see or store your full card number. We hold only what the processor returns to us: a customer reference, an invoice reference, the amount, and whether it was paid.

From your own communications with us

Emails, text messages, support requests, and notes from calls with our team.

Consumer information in the client portal

This is the one section where the two sides of the business meet, and it is worth reading carefully if you are a client.

Our consumer-facing brand, Summers Ahead, obtains consumer consent, calls consumers, and where a consumer agrees, transfers that consumer to a licensed agent at one of our client agencies. Consumers are told the agency's name before the introduction and consent to it.

What that means for the portal. When a transfer is delivered to your organization, information about that consumer appears in your portal account: their first name and where given their last name, their phone number, their state, a short summary of what they said they wanted to work out, the time and outcome of the transfer, and a link to the call recording.

Who is responsible for what. We are responsible for obtaining and evidencing the consumer's consent, and for what we do with that information before and during the transfer. From the moment the transfer is delivered to you, your organization holds its own copy and makes its own decisions about it. Your organization is independently responsible for how it stores, uses, secures and disposes of that copy, for its own privacy notice to that consumer, and for its own compliance with telemarketing, insurance and privacy law.

What we ask of you. Use consumer information only to serve the consumer who was introduced to you. Do not resell it, add it to an unrelated marketing list, or pass it to another agency. Honour a consumer's request to stop, and tell us if you receive one so we can honour it too. Delete or return it when it is no longer needed for the consumer relationship.

Who controls the information. We are the controller of the consumer information we collect. Your organization is an independent controller of the consumer information it receives on a transfer.

The data terms between us. There is no separate data protection addendum. The data-protection terms between us are in your client service agreement and the portal Terms of Use, and they cover the recording links in the portal too. Among them: you may not use call recordings to train any machine learning system.

How we use information

To evaluate whether an applying agency fits a program, and to route the application
To detect and link repeat or duplicate applications from the same person or organization
To create and manage a booking for a program-fit call
To open, configure and operate your portal account
To deliver the service you bought, including routing consumers to producers licensed in the consumer's state
To measure delivery, calculate what is billable, invoice you and take payment
To review and decide disputes you raise, which can involve reviewing the recording and transcript of the call in question
To grade our own team's calls for quality and training
To communicate with you about your application, your account, your deliveries and your invoices, in line with the consent you gave
To detect, prevent and investigate fraud, abuse and misuse of the platform
To measure and improve our own advertising, as described under "Cookies, pixels and advertising"
To operate, secure, debug and improve the site, the portal and the underlying systems
To comply with our legal obligations and to establish or defend legal claims

We rely on the information you affirmatively give us, on the consent you gave when submitting it, on the contract between us where you are a client, and on our legitimate interest in operating and securing the service.

Service providers

Each acts on our instructions, receives only what it needs, and is bound to keep it confidential. By category:

Hosting and database providers, which run the site, the portal and the database
Telephony and dialer providers, which place, route and connect calls and store recordings
AI transcription and analysis providers, which convert recordings to text and score them
Email and SMS providers, which deliver our messages
Payment processors, which take payments and issue invoices
Scheduling providers, which run the booking links
Advertising platforms, which measure the performance of our advertising
Customer relationship and support tools, which hold our record of dealings with you
Professional advisers, such as lawyers and accountants, under a duty of confidence

We do not name individual providers here because the list changes and a stale list is worse than none. Email privacy@apexdm.co and we will tell you the current ones.

Insurance agent clients

Where you are an applicant or a client, we do not share your business information with other clients. Consumer information is delivered to the one client agency the consumer agreed to be introduced to, as described above.

Legal and corporate

We may disclose information where the law requires it, in response to valid legal process, to establish or defend a legal claim, to enforce our agreements, to protect the rights, property or safety of Apex Digital Media LLC, our staff, our clients, consumers or the public, and to a regulator investigating a complaint. If our business or its assets are sold or merged, information may transfer as part of that, subject to this policy continuing to apply.

What we do not do

We do not sell your business information for money, we do not rent it, and we do not trade it. We do not send advertising platforms your qualification tier, your score, the reasons behind either, your free-text answers, your commercial terms, or any consumer information.

Sharing for advertising. Our advertising measurement on apexdm.co, described in the next section, gives advertising platforms identifiers and information about what you did on our site. California law calls that "sharing" for cross-context behavioural advertising, even though no money changes hands, and we treat it as sharing. You can opt out at any time, as set out under "How to opt out" below, and we honour a Global Privacy Control signal as an opt-out.

Cookies, pixels and advertising

On apexdm.co. We store campaign tags and click identifiers from the web address you arrived on in your browser's local storage, so that an application you submit later in the same session can be attributed to the advertisement that brought you. Where our advertising pixel is active it sets that platform's own cookies in your browser.

Server-side measurement. We also send measurement events from our own servers when an application is submitted and when a call is booked. Where a business email address or phone number is included, it is first put through a one-way cryptographic hash, so the platform receives a scrambled fixed-length string rather than a readable address or number. Alongside it we send a general value and category signal derived from the outcome, never the tier, score or reasons themselves, plus the click identifiers and technical data the platform uses to match the event to an advertisement.

In the portal. app.apexdm.co uses only the cookies needed to keep you signed in, hold your session and remember your display preferences. We do not run advertising pixels inside the client portal, and no consumer information is ever transmitted to an advertising platform.

How to opt out.

On our side: email privacy@apexdm.co and ask us to stop using your information for advertising measurement.
On the platform's side: every major advertising platform has ad-preferences controls in your account settings, which apply across all advertisers.
In your browser: most browsers let you block or delete cookies. Industry opt-out tools are at optout.aboutads.info and optout.networkadvertising.org.
Global Privacy Control: we treat a Global Privacy Control signal as a valid request to opt out of sharing for advertising.

How long we keep information

We keep each kind of record for a set period:

Consent records. The record of who authorised contact, when, and the exact wording they agreed to: five years.
Call recordings, transcripts and their grading, and delivery and dispute records: four years.
Financial and tax records: seven years.
Application records, portal account and usage records, and message logs: twenty-four months, running from the end of our relationship with you or from your last activity, whichever is later.
Do-not-contact records. Kept indefinitely, because the record is what stops contact resuming and makes sure you are never contacted again.
Anything under legal hold, until the matter ends, even where its period above has passed.

One thing we deliberately do not delete. When you submit a new application within 30 days of an earlier one, the earlier application is marked superseded rather than deleted, so the full record of what was submitted and decided survives.

Your choices and rights

Text messages: reply STOP to any text from us to opt out, HELP for help.
Calls and email: email privacy@apexdm.co and ask us to stop. We add you to our internal do-not-contact list.
Marketing versus service messages: opting out of marketing does not stop essential messages about an active account, such as invoices, security notices and delivery notifications. To stop those, close your account.
Access: ask what we hold about you, where it came from, and who we shared it with.
Correction: tell us what is wrong and we will fix it.
Deletion: ask us to delete what we hold. We will, except where we must keep records for legal, tax, audit, fraud-prevention or dispute-resolution reasons, or where the record belongs to your organization rather than to you personally. We will tell you which applies.
Portability: ask for a copy in a common machine-readable format.
Portal account: you can update your own contact details in the portal. Ask your organization's administrator, or us, to close a seat.

How to exercise any of these. Email privacy@apexdm.co or write to the postal address above. We acknowledge within 10 business days and complete within 45 calendar days, with one 45-day extension if a request is genuinely complex, which we will tell you about with the reason. There is no charge, and we will not treat you differently for asking. We may need to verify your identity, and we may need your organization's administrator to confirm a request that affects organization-level records.

If you live in California

The California Consumer Privacy Act, as amended, covers business contact information as well as consumer information. If you are a California resident, it applies to you here.

Categories we collect: identifiers (name, business email, phone, IP address, online identifiers); commercial information (what you applied for, what you bought, what was delivered, invoices); professional or employment information (your role, licensing, production and capacity); internet or network activity (site and portal usage, campaign attribution); audio information (recordings of calls with our team, and recordings delivered to your portal); and inferences (your qualification tier and the reasons behind it).

Sources: you; your organization; advertising platforms; and our own systems.

Purposes: as listed under "How we use information".

Disclosure for a business purpose: to the service provider categories listed above.

Sale and sharing: we do not sell personal information for money. Our advertising measurement on apexdm.co is sharing for cross-context behavioural advertising, as explained under "Who we share information with". To opt out, email privacy@apexdm.co or send a Global Privacy Control signal, which we honour.

Sensitive personal information: we do not collect Social Security numbers, government identifiers, precise geolocation, or account credentials beyond the password you set for the portal, which is stored only as a secure hash and is never readable by us.

Your rights: to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, and not be discriminated against for exercising any of them. Exercise them at privacy@apexdm.co. You may use an authorised agent with written proof of authority.

If you live in Florida

We are a Florida limited liability company. The Florida Digital Bill of Rights applies only to businesses above a $1 billion revenue threshold, so it does not currently apply to Apex Digital Media LLC. We honour the same rights voluntarily for Florida residents: access, correction, deletion, portability, and opt-out of targeted advertising, the sale of personal data, and certain profiling.

Exercise them at privacy@apexdm.co. If we refuse a request we will tell you why, and you may appeal by replying and asking for a review. We will respond in writing within 60 days, and if we still refuse we will tell you how to complain to the Florida Attorney General.

If you live in another state

We do business with agencies across the states our clients are licensed in, and several of those states have comprehensive privacy laws granting broadly the same rights: to know, access, correct, delete, obtain a portable copy, and opt out of targeted advertising and the sale of personal data.

We apply one process to everyone. Wherever you live, write to privacy@apexdm.co and we will handle your request under the timelines in this policy, without asking you to prove your state qualifies you. Where your state gives a right to appeal a refusal, you have it on the terms in the Florida section, and where your state's attorney general takes privacy complaints, you may complain to them.

Most state privacy laws exempt business contact information, meaning information about you in your role at a business. California's does not. We apply the same process either way.

Children

apexdm.co and app.apexdm.co are business tools for licensed insurance and financial professionals. They are not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child's information has reached us, email privacy@apexdm.co and we will delete it.

Security

Records are held in a database that rejects unauthenticated and client-side requests. Only our own server-side systems can read or write them.
Portal accounts are individual. One person, one account. Every action is logged against the account that took it.
Passwords are stored only as a secure one-way hash. We cannot read anyone's password, including our own staff's.
Access is limited to staff who need it, and everyone with access is under a written confidentiality and data-handling obligation prohibiting export, copying, screenshotting or removal of records.
Client organizations are separated at the database level. One client cannot read another client's records.
We do not ask for or store Social Security numbers, account numbers or bank logins. Payment details stay with our payment processor.

No system is perfectly secure and we cannot promise absolute security. If a breach affects your information we will notify you and any regulator as the law requires.

Changes to this policy

We may update this policy as the business changes. When we do we will change the "Last updated" date at the top. If a change materially affects how we use information we already hold, we will tell affected clients and applicants by email before it takes effect.

We describe any new product separately, and before it collects data, rather than folding it silently into this policy.

Contact us

Privacy questions, and access, correction or deletion requests: privacy@apexdm.co

Post: Apex Digital Media LLC 55 Weston Rd Suite 205 Weston, FL 33326

Consumers: if you were called about retirement planning, the policy that covers you is at summersahead.com/privacy. You can also write to the address above and we will handle it.