Privacy Policy

1. Information We Collect

APEX is an invite-only, business-to-business logistics platform — accounts are provisioned by APEX staff or an organization's own administrators, not through open public signup. We collect the following categories of information, all supplied directly by the account holder, their organization, or generated through the account holder's own use of the Platform:

• •Name, email address, phone number, and job title/role
• •Organization affiliation (client team, vendor, restaurant, flight kitchen, or wellness practice)
• •Login credentials (passwords are stored in encrypted/hashed form and are never visible to APEX staff)

• •Invoice and billing history within the Platform
• •Payment card and bank account details are collected and processed directly by our payment processor, Stripe, Inc. APEX does not receive, store, or have access to full card numbers or bank account numbers.

• •For vendors receiving payment through the Platform: legal business name, tax classification, and the last four digits of a Taxpayer Identification Number (SSN or EIN), entered directly by the vendor for display and verification purposes
• •A vendor's complete, signed W-9 form is stored as an uploaded document in restricted, access-controlled storage. The full Taxpayer Identification Number is never entered into a searchable database field, log, or email — it exists only within the uploaded document itself, viewable only by authorized finance personnel.

When a client organization electronically signs a Service Agreement through the Platform, we record the signer's name, the agreement's exact content, a timestamp, IP address, and a cryptographic hash used to prove the document has not been altered after signing

Charter and event details, menu selections, dietary and allergen information relevant to catering orders, and delivery/coordination records necessary to fulfill an order

Standard log data such as IP address, browser type, access timestamps, and pages viewed, collected automatically for security and platform-operation purposes

Certain Platform features — such as menu-image scanning, nutrition estimation, order quality checks, and substitution suggestions — use a third-party AI service to process the relevant order, menu, or document data needed for that specific feature. These features assist APEX staff; they do not make a final decision on their own, and a human reviews and approves the result before it takes effect.

2. How We Use Information

We use the information described above to:

• •Operate the Platform, including coordinating catering orders, menus, deliveries, and related logistics between client teams, vendors, restaurants, and catering/flight kitchen partners
• •Process payments and vendor payouts, and generate invoices and financial records
• •Create, present, and store electronically signed Service Agreements and maintain their legal record
• •Communicate with account holders about their orders, agreements, and account activity, including sending real-time notifications and status updates
• •Meet tax reporting obligations, including issuing Form 1099-NEC to vendors as required by law
• •Maintain the security, integrity, and reliability of the Platform, including audit logging and automated health monitoring
• •Respond to support requests and resolve reported delivery or service issues

3. How We Share Information

We do not sell personal information. We share information only as necessary to operate the Platform and fulfill its core purpose, with the following categories of recipients:

• •Payment processing: Stripe, Inc., to process payments, manage vendor payouts, and collect applicable taxes on invoices
• •Email delivery: Resend, to deliver transactional emails and notifications
• •Hosting and database infrastructure: Supabase and Vercel, who host the Platform's application and data
• •Airline and charter coordination: Delta Air Lines / Delta Charters, and the specific flight kitchens, vendors, and caterers assigned to a given order, strictly to the extent necessary to coordinate that order's real-world delivery
• •AI processing: Anthropic, to power AI-assisted features such as menu scanning, nutrition estimation, order quality checks, and substitution suggestions — Anthropic receives only the specific order, menu, or document data needed for that feature, never payment or full tax-identification information
• •Legal and regulatory disclosures where required by law, or to protect the rights, property, or safety of APEX, our clients, or others

We require that any third party processing personal information on our behalf do so only for the purposes we direct, under appropriate confidentiality and security obligations.

4. Data Retention

• •Invoices and financial records are retained for the period required by applicable tax and accounting law (a minimum of four years)
• •Signed Service Agreements and their associated signature records are retained as a permanent legal record and are not deleted, consistent with standard business-record-keeping practice for executed contracts
• •Operational documents such as menus and delivery manifests, which can be regenerated from underlying order data, are retained only as long as operationally useful
• •Account information for a departed contact is retained in deactivated form unless the individual requests deletion or anonymization as described below

5. Your Privacy Rights

Depending on your location, you may have rights under applicable privacy law (including the California Consumer Privacy Act) to:

• •Know what personal information we hold about you
• •Request correction of inaccurate personal information
• •Request deletion of your personal information
• •Not be discriminated against for exercising these rights

Where a request for deletion involves a person with genuine historical activity on the Platform (for example, past orders or a signed agreement), APEX's system is built to anonymize identifying details — replacing your name, email, and phone number with a placeholder — while preserving the underlying business and legal records other parties may be entitled to rely on, such as a signed agreement's original terms. Real deletion is available where no such historical record exists. To exercise any of these rights, contact us using the information in Section 10.

6. Data Security

• •Encrypted connections for all data in transit
• •Role-based access controls limiting which categories of staff can view sensitive information such as tax documents
• •Audit logging of significant account and administrative actions
• •Tamper-evident records for electronically signed agreements
• •Regular, independently-stored backups of platform data

No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored on the Platform.

7. International and Canadian Users

APEX serves client organizations based in both the United States and Canada. For Canadian users, personal information is handled consistent with the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Personal information collected from Canadian users is processed and stored on servers located in the United States, using the same safeguards described in this Policy.

8. Children's Privacy

The Platform is a business-to-business tool intended for use by adult professionals in connection with their employment or business role. It is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated Effective Date at the top of this Policy.

10. Contact Us

Questions about this Privacy Policy or requests regarding your personal information may be directed to: