Privacy policy
Last updated: October 21, 2026
1. Scope
This policy covers visitors to www.apogee.ad, users of the Apogee service (app.apogee.ad), our prospects and our affiliates. It also describes the data we process on behalf of our customers (see Data processed for our customers).
2. Controller
APOGEE SAS, 32 Rue de Paris, 92100 Boulogne-Billancourt, France. For any question about your personal data: hello@apogee.ad.
3. Data processed
| Category | Data | Source |
|---|---|---|
| Account (Facebook login) | Facebook identifier, name, email address, profile picture; Meta access token; list of the Pages you manage, with their access tokens and the linked Instagram professional accounts; permissions granted. | Meta, when you log in |
| Sign-up | WhatsApp number if you choose to give it, with the date and version of the text shown, and whether you agreed to receive our tips and offers on WhatsApp; your team size, role, workspace name, how you launch ads today (and the tool you use), how you heard about Apogee (and, where applicable, who recommended it); your browser language. | You, when you sign up |
| Access request from our ads (/start page) | First name and email address; WhatsApp number, with the date and version of the text shown, and whether you agreed to receive our tips and offers on WhatsApp; your "About you" answers (team size, role, workspace name, how you launch ads today (and the tool you use), how you heard about Apogee (and, where applicable, who recommended it)) and your browser language; the page language, the type of device (phone or computer) and whether it was opened in Instagram's or Facebook's in-app browser; the campaign, ad click and affiliation parameters of the page address, the referring site (its name only) and, if your browser has them, the _fbp and _fbc cookie identifiers; the dates of the steps, of the sending and opening of your personal link and of the reminders. Your IP address is not stored. | You, on the application's /start page |
| Meta advertising data | Ad accounts, campaigns, ad sets, ads, creatives, performance statistics, pixels and conversion events, catalogs; posts and comments of your Pages and Instagram accounts (comment analysis). | Meta, according to the permissions you grant |
| Advertising data from the other platforms you connect | TikTok, Snapchat, X, Google Ads, Pinterest, AppLovin: the ad accounts, pages and profiles you can use, what a launch needs, the delivery statistics where Apogee displays them, and the access tokens or key of the connection; for Google Ads, the email address of the Google account; for Pinterest, your username (see "Ad platforms you connect"). | The platform you connect, according to the access you grant; you, for the AppLovin key |
| Content you provide | Creative files (images, videos), text, naming conventions, product-page addresses and their visible text, brand assets; transcripts of video audio. | You; transcripts are produced by the Service |
| Integrations you connect | Google Drive (Google account email address, read access to files), Dropbox, Frame.io/Adobe, Slack, Discord (Discord identifier for community roles), and the corresponding access tokens. | The services you connect |
| Billing (via Stripe) | Name, email address, billing address, VAT number, plan, invoices, payment status; for the 7-day trial, the payment method given at sign-up (its numbers are processed by Stripe, not by Apogee), the dates and status of the trial, the card fingerprint computed by Stripe, which does not reveal its number (see "7-day trial"). | You, via Stripe |
| Usage and technical data | Pages viewed in the application (the page address without its parameters), the referring site (its name only), device type, browser and operating system, approximate location (city, region, country and approximate coordinates of the city), timestamps, a visit key valid for one day (see "Website visit statistics") and, every minute while the application is on screen, a presence signal kept for 24 hours at most. Your IP address is used at that moment to work out this location, on our servers, to compute this key and to limit the number of requests; it is then discarded: we do not record it. If you are not signed in to an account and refuse audience measurement, the application sends none of this; with the Global Privacy Control or "Do Not Track" signal, neither the key nor the presence signal. In the launch flow: the steps you reach, the time spent on each, counts (files, ads, naming-convention detections, files not fully recognised, corrections) and the result of a detection or of the launch, with the ad account concerned; these statistics never contain a file name, an ad name or anything you type. Detailed usage statistics and session recording, if you consent (see "Cookies and trackers"). | Your browser, when you use the Service |
| Communications | Emails, WhatsApp messages (if you write to us, or if we write to you at the number you gave us), feedback form; interactions with our emails (opens, clicks on links). | You; our email provider for opens and clicks |
| Customer relationship management | History of your use of the Service (logins, launches, errors encountered, the partner offers on the Partners page that you view and click on), sign-up answers, plan and payments, interactions with our emails, notes on our exchanges, a follow-up priority calculated from these elements. | The Service; Stripe; our email provider; us |
| Workspaces | Name and email address of invited members, name of the person who invites them. | The member who sends the invitation |
| Affiliates | Identity, email address, payout and tax details, statistics on clicks, referred customers and commissions. | You; FirstPromoter |
| Website visitors | Visit statistics, without cookies: the page viewed (its address without parameters), the referring site (its name only), the utm_source, utm_medium and utm_campaign parameters of the page address, device type, browser and operating system, approximate location (city, region, country and approximate coordinates of the city), timestamp, a visit key valid for one day and a presence signal; if you accept audience measurement, the application's visit key for the same day as well (see "Website visit statistics"). Your IP address is used at that moment for the location and the keys; it is then discarded: we do not record it. Arrivals from an AI assistant, without cookies: the landing page, campaign parameters and the name of the assistant, passed to CiteMe (see "Traffic from AI assistants"). Trackers that need your agreement: see "Cookies and trackers". | Your browser |
| Prospects | See Prospects. | — |
| People who appear in our customers' content | See Data processed for our customers. | — |
Permissions requested from Meta at login
public_profile, email, pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_posts, pages_manage_engagement, pages_manage_ads, ads_management, ads_read, business_management, catalog_management, instagram_basic, instagram_content_publish, instagram_manage_insights, instagram_manage_comments.
Profile information read: identifier, name, email address, picture.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service: account, imports, launches, integrations, AI features, workspaces, notifications you set up | Performance of the contract |
| Billing and accounting | Performance of the contract; legal obligation |
| Support | Performance of the contract; legitimate interest: answering the people who contact us |
| Support and onboarding help on WhatsApp, at the number you give us when you sign up | Performance of the contract (support); legitimate interest: helping you get started with the Service. You can ask us at any time to stop writing to you on WhatsApp |
| Product tips and offers on WhatsApp | Consent (a box left unticked by default, at sign-up); you can withdraw it at any time by replying "STOP" or by writing to hello@apogee.ad |
| Access request from our ads (/start page): emailing you your personal link, then up to five reminders over four days until you create your account; linking your request to the account you create with Facebook (from your link, your sign-up reuses your answers); measuring the results of our ads (events sent to Meta by our server, see "The application's /start page") | Legitimate interest: answering your access request and measuring how well our ads work; you can object at any time by writing to hello@apogee.ad |
| 7-day trial: checking that one card is only used for one trial (card fingerprint); measuring the results of our ads (event sent to Meta by our server, see "7-day trial") | Legitimate interest: preventing abuse of the trial and measuring how well our ads work; you can object to the measurement at any time by writing to hello@apogee.ad |
| Security, prevention of abuse and fraud, connection logs | Legitimate interest: protecting the Service and its users against abuse and fraudulent access |
| Internal usage statistics, based on our logs | Legitimate interest: understanding how the Service is used in order to improve it |
| Website visit statistics, without cookies (see "Website visit statistics") | Legitimate interest: measuring our website's audience. Audience measurement exempt from consent, which you can object to at any time; the move from the website to the application's sign-up page is only counted with your consent |
| Traffic from AI assistants, without cookies (see "Traffic from AI assistants") | Legitimate interest: measuring the share of our audience that comes from AI search engines and assistants. Nothing is read from or stored on your device; you can object at any time. CiteMe only follows the visit and conversions with your consent |
| On the website: audience measurement (Google Analytics), advertising conversion measurement (Google Ads), referral attribution (FirstPromoter), measurement of traffic from AI assistants (CiteMe), the move from the website to the application's sign-up page (Apogee visit statistics, without cookies), measuring the results of our Meta ads and ad retargeting (Meta Pixel), keeping, for the length of the visit, the campaign parameters, landing page and referring site passed to the application, measuring the results of our X ads and ad retargeting (X Pixel); in the application: usage statistics and session recording (PostHog), audience measurement (Google Analytics, Vercel Analytics), advertising conversion measurement (Google Ads), referral attribution (FirstPromoter), measuring the results of our Meta ads and ad retargeting (Meta Pixel of the /start page), measuring the results of our X ads and ad retargeting (X Pixel of the /start page) | Consent (see "Cookies and trackers") |
| Linking a sign-up or a payment to the ad, affiliate or page that brought you (links to the application) | Legitimate interest: knowing where our sign-ups and sales come from; you can object at any time. Keeping this information for the length of the visit relies on your consent |
| Product tips and occasional offers by email to account holders | Legitimate interest (customer relationship, professional use); you can object at any time |
| Managing our relationship with our users and customers (usage history, sign-up answers, subscription, interactions with our emails, notes), including with an AI tool that prepares our outreach | Legitimate interest: following up on our business relationship and adapting our exchanges; you can object at any time |
| Following up with our professional prospects | Legitimate interest: making Apogee known to professionals (see "Prospects") |
| Affiliate program | Performance of the affiliate terms |
| Internal team alerts (signups, subscriptions, errors) | Legitimate interest: monitoring the activity of the Service in real time and responding to errors |
| Defending our rights | Legitimate interest: establishing, exercising or defending our rights |
No decision producing legal effects concerning you or similarly significantly affecting you is made solely on the basis of automated processing. Our customer relationship tool calculates a follow-up priority from your use of the Service and your interactions with our emails; it is only used to organise our outreach.
Logging in with a Meta account is required to use the Service; billing data, including a payment method, is required to subscribe to a paid plan and, for accounts created from the activation of the 7-day trial, from sign-up.
5. Recipients and processors
Your data is disclosed to persons authorized by Apogee and, for the part that concerns them, to the following providers. Apogee does not sell your data.
| Provider | Role | Data |
|---|---|---|
| Vercel | Hosting and delivery of the website and the application; transit of the files you import; audience measurement in the application (Vercel Analytics), with your consent | Technical data, files |
| Railway | Hosting of our server (API), European region | All service data |
| Supabase | Database and file storage, Paris region | All service data |
| Stripe | Payments and invoicing. Stripe also acts as a separate controller for its own obligations (fraud prevention, legal obligations). | Billing data |
| Resend | Sending emails | Email address, name, email content, opens and clicks |
| Google (Workspace) | Business email (including hello@apogee.ad) and appointment booking | Emails you send us; name and email address when you book an appointment |
| Inngest | Running background tasks | Data needed for these tasks, including access tokens |
| Anthropic (Claude) | AI features; preparing our outreach | File names, product-page text, advertising data, messages sent to Autopilot, analysed comments (display name and text); data about our contacts (name, company, usage history, subscription, sign-up answers without the WhatsApp number, notes, subject and short excerpt of the latest emails exchanged, partly masked) |
| Google (Gemini) | AI features | File names, images and videos of analysed creatives |
| OpenAI | Transcription of video audio, search in Autopilot suggestions | Video audio, queries |
| fal.ai | Image generation and editing (Creative Studio) | Brand and product images |
| PostHog (EU region) | Usage statistics and session recording in the application, with your consent | Usage events, identifier, email address, plan |
| Google (Analytics, Ads) | Audience measurement and advertising conversion measurement, with your consent | Browsing data, tracker identifiers |
| Meta (Meta Pixel, website and the application's /start page) | Measuring the results of our Meta ads and ad retargeting, with your consent. Meta Platforms Ireland Ltd is joint controller with Apogee for the collection and transmission of this data, then solely responsible for how it uses it (see "Meta Pixel"); events of the /start page and of a trial's start sent by our server, based on our legitimate interest (see "The application's /start page" and "7-day trial") | Pages viewed (page address), display of our pricing, clicks on key actions (booking a call, contacting us), _fbp and _fbc cookie identifiers, IP address and browser information; for the /start page, events of the access request with hashed email address, first name and phone number; for a trial that starts, the plan, its billing period and its price, with hashed email address, name, Apogee identifier, phone number and billing address |
| X (X Pixel, website and the application's /start page) | Measuring the results of our X ads and ad retargeting, with your consent. Twitter International Unlimited Company is joint controller with Apogee for the collection and transmission of this data, then solely responsible for how it uses it (see "X Pixel"); conversion events sent by our server, based on our legitimate interest (see "X Pixel") | Pages viewed (page address), X click identifier (_twclid cookie), IP address and browser information; for the events sent by our server (access request from /start, sign-up, payment page, payment method validated, first payment and payments), the X click identifier, the hashed email address and phone number, the amount excluding tax, and, during your own visit only, the IP address and browser information |
| FirstPromoter | Affiliate program platform | Affiliate data; when you log in, if you have accepted affiliation trackers, your email address and Apogee identifier, to credit your signup to an affiliate |
| CiteMe (website only) | Measuring traffic from AI search engines and assistants: crawler visits and arrivals from an AI assistant, without cookies; following the visit and conversions, with your consent | Page viewed, referrer, campaign parameters; with your consent, visitor identifier |
| Discord | Internal team notifications (signups, subscriptions, errors) and the Apogee community | Name, email address, plan, WhatsApp number given at sign-up; Discord identifier |
| Technical logging and internal display providers | Keeping the server's technical logs; internal display of service activity | Technical logs, first names |
- Meta: the source of your advertising data and the recipient of the content you launch. Meta acts as a separate controller. For the website's Meta Pixel, see Meta Pixel.
- Other ad platforms you connect (TikTok, Snapchat, X, Google Ads, Pinterest, AppLovin): when you connect one of them, it is the source of the advertising data Apogee reads from it and the recipient of the content you launch on it, and it acts as a separate controller (see Ad platforms you connect).
- Services you connect (Google Drive, Dropbox, Adobe/Frame.io, Slack): the exchanges take place at your request and their own policies apply.
- WhatsApp (Meta): if you write to us on WhatsApp, or if we write to you at the number you gave us, WhatsApp processes these exchanges under its own terms.
- Partners (offers on the Partners page): we send them no data about you; the links to their websites carry parameters that identify Apogee, never you. On their websites, their own policies apply.
- Authorities: where the law requires it.
6. Ad platforms you connect
You can connect your own ad accounts to Apogee to launch your ads on them: Meta (Facebook, Instagram), TikTok, Snapchat, X, Google Ads (YouTube), Pinterest and AppLovin. Some of these platforms may not be available in your account yet. You connect each one yourself, through the platform's official sign-in or, for AppLovin, with an API key you create in your AppLovin account. When you connect one of these platforms:
- What Apogee sends to the platform, at your request: the creatives (videos, images) and the texts you upload or write, and the campaign, ad set (ad group, ad squad, line item) and ad settings, the targeting and the budget you choose.
- What Apogee reads from the platform: the ad accounts, pages and profiles you can use, what a launch needs (for example your pixels, or your campaigns and ad sets when you add ads to them) and, where Apogee displays them, the delivery statistics of your campaigns, ad sets and ads.
- Tokens and keys: the access tokens the platform gives Apogee when you sign in, or the key you paste, are stored on our servers and never shown to anyone else. They are only used to carry out, on your own ad accounts, what you ask Apogee to do (including when our support team acts on your behalf, with your agreement). They are deleted from our database when you disconnect the platform in Apogee or when your account is deleted.
- Each platform acts as a separate controller for the data it receives, under its own terms and privacy policy (links below). Apogee does not sell the data it receives from these platforms.
| Platform and connection | Apogee sends | Apogee reads | Privacy policy |
|---|---|---|---|
| Meta (Facebook, Instagram) Facebook login (OAuth), with the permissions listed under "Data processed" | Creatives, texts, campaigns, ad sets and ads | Ad accounts, Pages and Instagram accounts, pixels, catalogs, campaigns, ad sets, ads and their statistics; comments on your ad posts when you turn on comment analysis | facebook.com/privacy/policy |
| TikTok TikTok sign-in (OAuth) | Creatives, texts, campaigns, ad groups and ads | Advertiser accounts, identities, pixels, campaigns, ad groups, ads and their statistics | tiktok.com/legal/privacy-policy |
| Snapchat Snapchat sign-in (OAuth) | Creatives, texts, campaigns, ad squads and ads | Organizations and ad accounts, public profiles, pixels, audiences, campaigns, ad squads, ads and their statistics | values.snap.com/privacy/privacy-policy |
| X X sign-in (OAuth 1.0a) | Creatives, texts, campaigns, line items and the posts of your ads, published as promoted-only posts (they do not appear on your profile) | Ad accounts, the profiles you can promote, funding sources, conversion tags | x.com/en/privacy |
| Google Ads (YouTube) Google sign-in (OAuth): access to Google Ads (adwords scope) and the email address of your Google account | Videos, uploaded through the Google Ads API as unlisted YouTube videos; texts, campaigns, ad groups and ads | The Google Ads accounts you can access; the email address of the Google account, to show which account is connected | policies.google.com/privacy |
| Pinterest Pinterest sign-in (OAuth 2.0): read and write access to ads, Pins and boards, read access to your user account | Creatives, texts, campaigns, ad groups and ads; each ad uses an ad-only Pin, which does not appear on your boards | Ad accounts, conversion tags, your Pinterest username | policy.pinterest.com/privacy-policy |
| AppLovin The Campaign Management API key and account ID that you paste | Creatives, texts, campaigns and creative sets | Your account's campaigns, to check the key and the launch | legal.applovin.com/privacy |
Google Ads: Apogee only uses the data it receives from Google to connect your Google Ads accounts, launch the ads you create and show you information about them in Apogee. Apogee does not sell this data, does not use it for ad targeting or personalization (other than the ads you create and launch yourself), and does not use it to develop, improve or train generalized AI models. Apogee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Apogee's access from your Google account (myaccount.google.com/permissions).
7. Transfers outside the European Economic Area
Some providers are established outside the European Economic Area, in particular in the United States (for example Vercel Inc. and Railway Corporation) and in Singapore (Supabase Pte. Ltd.), or may process data there.
For providers that are covered by them or offer them, these transfers rely on an adequacy decision of the European Commission, in particular the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses included in the provider's contractual terms. You can obtain a copy of these safeguards by writing to hello@apogee.ad.
For the Meta Pixel data sent to Meta, see Meta Pixel.
8. Retention periods
- Account: for as long as your account exists. When you ask for your account to be deleted (see Deleting your data), we handle your request manually and delete the data concerning you, except the data we must keep to comply with a legal obligation or to establish, exercise or defend our rights.
- Sign-up answers and WhatsApp number: for as long as your account exists; you can ask us at any time to delete your number. The record of your agreement to receive our offers on WhatsApp is kept for as long as that agreement stands, then as long as needed to prove it.
- Access requests from our ads (/start page): if you do not create an account, 12 months after your request, then deleted automatically; if you create an account, the request is linked to it and kept as long as your account.
- 7-day trial (dates, status, card fingerprint): as long as your account exists; invoices and accounting records, including the one for the trial fee, follow the retention of billing data.
- Meta access tokens and your Pages data: until you disconnect Facebook in Apogee or your account is deleted.
- Integration access tokens: until you disconnect the integration in Apogee or your account is deleted.
- Access tokens and keys of the other ad platforms you connect: until you disconnect the platform in Apogee or your account is deleted.
- Imported files: files used in a launch are deleted automatically about 24 hours after the launch; files that are not launched, about 7 days after they are imported; AI-generated images, about 24 to 48 hours after they are created, unless you save them in a template; brand assets and templates, until you delete them or your account is deleted.
- Billing data and accounting records: 10 years (accounting obligation).
- Connection logs and technical logs: for as long as needed for the security of the Service and for diagnosing errors. Apart from our internal administration console (for our team only), they contain no IP address; the request logs of our hosting providers (Vercel, Railway) do, for the period each of them sets.
- Website visit statistics: 13 months, then deleted automatically; the presence signal, 24 hours at most.
- Customer relationship management (usage history, interactions with our emails, notes): for as long as your account exists; for prospects, see below.
- Exchanges with us (emails, messages, feedback form): for as long as they are useful for following up on your request and our relationship; you can ask for them to be deleted. In our follow-up tool, the subjects and excerpts of the emails synced from our mailbox are deleted after 24 months, and the meetings from our calendar 24 months after they took place.
- Workspace invitations: until the workspace is deleted.
- Usage statistics and session recordings (PostHog): according to the retention period of our PostHog account.
- Internal team alerts: in the history of our internal tools, until they are deleted.
- Comments analysed for a customer: until the customer asks for them to be deleted or until the customer's account is deleted.
- Prospects: in our follow-up tool, prospect records with no exchange at all with us are deleted automatically after 3 years without activity; other prospect data is kept for as long as it is useful to our business relationship. You can ask for it to be deleted at any time.
- Affiliates: for the duration of participation in the program, then for the legal retention period for accounting records as regards payment data.
- Unsubscribe list: kept so that your objection continues to be honoured.
- Your tracker choice: 6 months.
- Meta Pixel: _fbp cookie (90 days according to Meta) and _fbc cookie (set by Meta); the data received by Meta, for the period Meta sets (see Meta Pixel).
- Campaign parameters kept for the visit: until the tab is closed.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection. You can object at any time to our emails and to prospecting. You can withdraw your consent at any time, and give instructions on what happens to your data after your death.
To exercise your rights, write to hello@apogee.ad. We may ask you to prove your identity.
We reply within one month, which may be extended by two months given the complexity or number of requests; in that case we let you know.
You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
10. Deleting your data, including Meta data
- In Apogee, you can disconnect your Facebook account (Account menu): the Meta access token is revoked with Meta and your Pages data is deleted from our database.
- You can also remove Apogee from your Facebook account: Settings & privacy → Settings → Apps and websites.
- To ask for your account and your data to be deleted, write to hello@apogee.ad from your account's email address, with the subject "Delete my data". We confirm the deletion once it is done, within the time frame set out in Your rights, subject to the data the law requires us to keep.
11. Google user data
- Access: if you connect Google Drive, Apogee accesses the email address of your Google account and, read-only, your Google Drive files. Apogee only imports the files you select.
- Use: to import them into Apogee and create the ads you launch.
- Sharing: imported files are sent to Meta, or to the other ad platform you connect, when you launch ads, and may be analysed by the AI providers listed above when you use an AI feature. Apogee does not sell these files, does not use them for ad targeting or personalization (other than the ads you create and launch yourself), and does not use them to develop, improve or train generalized AI models.
- Storage and protection: the access and refresh tokens are stored in our database, hosted by Supabase (Paris region); the access token is passed to our background task provider (Inngest) to carry out imports; exchanges are encrypted (HTTPS).
- Retention and deletion: imported files are kept as set out in Retention periods. These tokens are deleted from our database when you disconnect Google Drive in Apogee; you can also revoke access from your Google account (myaccount.google.com/permissions).
- Google Ads: if you connect Google Ads to launch ads on YouTube, Apogee accesses your Google Ads accounts and the email address of your Google account; see Ad platforms you connect for how this data is used, stored, shared and deleted.
Apogee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
12. Cookies and trackers
The website and the application use cookies and similar trackers (browser local storage, pixels, measurement scripts). Here they are, by purpose.
Necessary trackers (no consent required)
| Name | Purpose | Where | Lifetime |
|---|---|---|---|
| apogee_token | Session and authentication in the application (browser local storage) | Application | Login token valid for 7 days |
| Server session cookie | Session and authentication | Application | 24 hours |
| Interface preferences | Theme, selected account, sidebar, which login screen to show and a sign-up to resume (browser local storage) | Application | Until cleared |
| apogee_consent | Keeping your choice about trackers | Website and application | 6 months |
| apogee_start | Resuming on this browser the access request started on the /start page and showing your personal link there again (see "The application's /start page") | The application's /start page | 30 days |
| Stripe | Operation and security of the Stripe payment pages | Stripe payment pages | Set by the provider |
Audience measurement
| Name | Purpose | Where | Lifetime |
|---|---|---|---|
| PostHog | Usage statistics and session recording, with your consent (input fields are masked) | Application | ph_… cookie: 1 year; copy in browser local storage: until cleared |
| Google Analytics 4 (_ga, _ga_…) | Audience measurement | Website and application | At most 13 months from when they are set |
| Vercel Analytics | Audience measurement | Application | Set by the provider |
| CiteMe (__cme_ref__, __cme_att__, __cme_lead__, __cme_vid__) | Measuring traffic from AI search engines and assistants | Website | __cme_ref__: 30 minutes; __cme_att__ and __cme_lead__: 30 days; __cme_vid__: 1 year |
| Apogee visit statistics: move to sign-up | Counting, without cookies, the website visitors who then open the application's sign-up page (see "Website visit statistics") | Website | Nothing is stored on your device |
Audience measurement exempt from consent
| Name | Purpose | Where | Lifetime |
|---|---|---|---|
| Apogee visit statistics | Website audience measurement, without cookies or local storage (see "Website visit statistics") | Website | Nothing is stored on your device |
Advertising
| Name | Purpose | Where | Lifetime |
|---|---|---|---|
| Google Ads | Advertising conversion measurement | Website and application | Set by the provider |
| Meta Pixel (_fbp, _fbc) | Measuring the results of our Meta ads and showing our ads on Facebook and Instagram to website visitors (retargeting), based on pages viewed, the display of our pricing and clicks on key actions; on the /start page, the page view and the access request; Meta may also use this data for its own purposes (see "Meta Pixel") | Website and the application's /start page | _fbp: 90 days according to Meta; _fbc (if you arrive from a Meta ad): set by Meta. If your browser accepts third-party cookies, Meta may also read or set its own cookies (for example "fr", 90 days according to Meta) |
| X Pixel (_twclid) | Measuring the results of our X ads and showing our ads on X to visitors of the website and the /start page (retargeting), based on pages viewed; X may also use this data for its own purposes (see "X Pixel") | Website and the application's /start page | _twclid (if you arrive from an X ad): 30 days according to X. If your browser accepts third-party cookies, X may also read or set its own cookies |
| apogee_attribution (session storage) | Keeping, for the length of the visit, the campaign and affiliation parameters, the landing page and the referring site, to pass them to the application (see "Links to the application") | Website | Until the tab is closed |
Affiliation
| Name | Purpose | Where | Lifetime |
|---|---|---|---|
| FirstPromoter | Crediting a signup to the affiliate whose link was clicked | Website and application | The program's attribution period (60 days) |
Apart from our website visit statistics, which store nothing on your device (see below), audience measurement, advertising and affiliation trackers are only set with your agreement, on the website and in the application. You can accept or refuse, then change your choice at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form). Your choice is kept for 6 months and applies to both the website and the application.
Meta Pixel
On www.apogee.ad and on the application's /start page (app.apogee.ad/start), and only if you accept "Advertising and affiliation" in the cookie banner (outside Europe, on our ads page: see below), we use the Meta Pixel, a tool provided by Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, D04 X2K5, Ireland). On the website, it sends Meta the pages you view (their address), the display of our pricing and your clicks on key actions: booking a call, writing to us on WhatsApp. On the /start page, it sends the page view and, when you give your email address, a "Lead" event. As with any request, Meta also receives your IP address and information about your browser. The Meta Pixel sets the _fbp and _fbc cookies on our domain and, if your browser accepts third-party cookies, Meta may also read or set its own cookies. We have turned off the automatic sending of clicks on other buttons and of page metadata (the Meta Pixel's "automatic configuration").
We use this data to measure the results of our ads on Facebook and Instagram and to show our ads there to people who visited our website or the /start page (retargeting). Meta may also use it for its own purposes, described in its privacy policy. Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form); the Meta Pixel is then no longer loaded and the _fbp and _fbc cookies are deleted.
Our ads page outside Europe. On the /start page (app.apogee.ad/start and /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), when your browser's time zone is that of the United States, Canada (except a browser set to French, as in Quebec), Australia, New Zealand or the United Arab Emirates, the Meta Pixel loads as soon as the page opens, without waiting for your choice: the law of these countries asks for clear information and a simple way to refuse rather than prior consent. The "Cookie settings" link under the form tells you so and stops it at any time (the _fbp and _fbc cookies are then deleted); a browser that sends the Global Privacy Control signal is treated as a refusal. Legal basis on that page: our legitimate interest in measuring our ads, which you can object to in these ways. Everywhere else, including the European Union, the United Kingdom and Switzerland, nothing changes: the Meta Pixel only loads with your consent, which you can give with that same link (on that page the cookie banner does not open by itself).
Apogee and Meta Platforms Ireland Ltd are joint controllers (Article 26 GDPR) for the collection of this data by the Meta Pixel and its transmission to Meta (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). How Meta then uses it is its sole responsibility. Meta's joint controller addendum ("Controller Addendum", facebook.com/legal/controller_addendum) sets out the roles: Apogee provides you with this information; Meta Platforms Ireland Ltd enables the exercise of your rights of access, rectification, erasure, restriction and portability (Articles 15 to 20 GDPR) over the data it keeps after the transmission. You can exercise your rights with either of us: write to hello@apogee.ad or see Meta's privacy policy (facebook.com/privacy/policy), which also describes its legal bases and how to exercise your rights with Meta.
Meta Platforms Ireland Ltd may transfer this data to Meta Platforms, Inc., in the United States. Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework (list kept by the US Department of Commerce, dataprivacyframework.gov); Meta describes in its privacy policy the safeguards it applies to its transfers. How long Meta keeps the data it receives is set by Meta.
X Pixel
On www.apogee.ad and on the application's /start page (app.apogee.ad/start), and only if you accept "Advertising and affiliation" in the cookie banner (outside Europe, on our ads page: see below), we use the X Pixel, a tool provided by Twitter International Unlimited Company (Dublin, Ireland), which provides X's advertising services in the European Union. It sends X the pages you view (their address). As with any request, X also receives your IP address and information about your browser. If you arrive from an X ad, the X Pixel keeps that click's identifier in the _twclid cookie, on our domain; if your browser accepts third-party cookies, X may also read or set its own cookies.
We use this data to measure the results of our ads on X and to show our ads there to people who visited our website or the /start page (retargeting). X may also use it for its own purposes, described in its privacy policy (x.com/privacy). Legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link at the bottom of every page of the website or, in the application, with the "Cookie settings" link (sign-up and sign-in pages, Account page, under the /start form); the X Pixel is then no longer loaded and the _twclid cookie is deleted.
Our ads page outside Europe. On the same terms as the Meta Pixel (see "Meta Pixel"): on the /start page (app.apogee.ad/start and /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), when your browser's time zone is that of the United States, Canada (except a browser set to French, as in Quebec), Australia, New Zealand or the United Arab Emirates, the X Pixel loads as soon as the page opens, without waiting for your choice; the "Cookie settings" link under the form or the Global Privacy Control signal stop it and delete the _twclid cookie. Legal basis on that page: our legitimate interest in measuring our ads. Everywhere else, including the European Union, the United Kingdom and Switzerland, the X Pixel only loads with your consent.
Apogee and Twitter International Unlimited Company are joint controllers (Article 26 GDPR) for the collection of this data by the X Pixel and its transmission to X (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). How X then uses it is its sole responsibility. You can exercise your rights with either of us: write to hello@apogee.ad or see X's privacy policy (x.com/privacy), which also describes how to exercise your rights with X.
Our server also sends X, through its Conversion API, events to measure the results of our ads: your access request from the /start page, the creation of your account, the opening of the payment page, the validation of your payment method, your first payment and each of your payments, with the amount excluding tax of the plan or of the payment. Each event carries the X click identifier of your arrival, if it exists, your email address and phone number, hashed (SHA-256) before sending, and, if it is sent during your own visit, your IP address and information about your browser, which we do not store. These events do not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad.
X may transfer this data outside the European Union, notably to X Corp., in the United States; X describes in its privacy policy the safeguards it applies to these transfers. How long X keeps the data it receives is set by X.
The application's /start page
Our Meta ads may bring you to the app.apogee.ad/start page (or /en/start, also served at www.apogee.ad/onboardingbf and /en/onboardingbf), where you ask for access to Apogee without creating an account: you give your first name, your email address, your WhatsApp number and your "About you" answers (see "Data processed"). We use them to email you a personal link, to open on a computer, then up to five reminders over four days until you create your account (each email has a link to stop them), and to link your request to the account you create when you log in with Facebook: from your personal link, your sign-up reuses your answers. This link works for 30 days and no longer once your account is created. Your request also appears in our customer-relationship records, and we may write to you on WhatsApp, at the number you gave, to help you move to a computer. From this page, you can also pay for the 7-day trial ($1, €1 or £1) through Stripe before you have an account: Stripe receives your email address and first name, we keep your payment's and subscription's Stripe identifiers with your request to link your trial to the account you create when you log in with Facebook, and our server sends Meta, as described below, the "InitiateCheckout" event when the payment page opens and the "StartTrial" event once the trial is paid.
If you do not create an account, this data is deleted 12 months after your request. The page sets a strictly necessary cookie, apogee_start (30 days), which only lets this browser resume your request and show your link there again; it therefore does not depend on your choice about cookies. On this page we also count, without ever reading what you type, whether the form was started (a field touched or filled in, the button pressed): an anonymous statistic, like the pages viewed, with the day's visit key and without cookies; you can object to it as to audience measurement.
When you give your email address, then when you finish your request, our server sends Meta Platforms Ireland Ltd, through its Conversions API, an event ("Lead", then "OnboardingComplete") to measure the results of our ads: your email address, your first name, your request's identifier and, at the end of the request, your phone number and its country, hashed (SHA-256) before sending; the page address; the _fbp and _fbc cookie identifiers and the ad click identifier, if they exist; your IP address and information about your browser, which we do not store. These events do not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad. Meta may transfer this data to the United States (see "Meta Pixel").
7-day trial
For accounts created from the activation of the 7-day trial, signing up includes choosing a plan and paying a trial fee of €1, $1 or £1 depending on the billing currency, tax included, on the Stripe payment page: there you give a payment method and the billing information that page asks for (see "Data processed"). Stripe processes your card numbers; Apogee does not receive them. We keep the dates, plan and status of your trial, as well as your card's fingerprint computed by Stripe, which does not reveal its number: we use it to spot a card already used for another trial, in which case our team is informed.
When your trial starts, our server sends Meta Platforms Ireland Ltd, through its Conversions API, a "StartTrial" event to measure the results of our ads: the plan you chose, its billing period and its monthly price excluding tax; your email address, your name, your Apogee identifier and, if known, your phone number, city, postal code and country, hashed (SHA-256) before sending; the _fbp and _fbc cookie identifiers, the ad click identifier and the browser information recorded when you signed up, if they exist. Your IP address is not sent with this event. This sending does not depend on your choice about cookies. Legal basis: our legitimate interest in measuring how well our ads work; you can object at any time by writing to hello@apogee.ad. Meta may transfer this data to the United States (see "Meta Pixel").
Links to the application
If the address of a website page contains campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), ad click identifiers (fbclid, gclid, twclid) or affiliation parameters (ref, via, fpr), the links from that page to the website's other pages and to the application app.apogee.ad carry them over, without storing anything on your device; a value containing an email address is ignored. These parameters thus follow your visit from page to page. In the application, they are only used by the trackers you accept there. If you accept "Advertising and affiliation" in the cookie banner, the website also keeps these parameters, the page you arrived on and the website you came from, for the length of your visit, in your browser's session storage (apogee_attribution, deleted when the tab is closed or when you withdraw your agreement), to carry them over from any page of the website, even one you reach without following these links.
The plan buttons in our pricing grid lead to the application's sign-up page, with the chosen plan and billing period in the link's address, and carry these parameters over like any link to the application. They do not open a payment page and send nothing to our server.
Website visit statistics
Every page of www.apogee.ad sends our server (hosted by Railway) the page address without its parameters, the name of the site you came from and, when they are in the page address, the utm_source, utm_medium and utm_campaign parameters (100 characters at most; a value containing an email address is ignored), then, every minute while the page is on screen, a presence signal. This stores nothing on your device, neither cookies nor local storage: it only reads your choice about trackers, to respect your objection or your agreement.
From the request, our server works out the device type, browser and operating system (without keeping the full user-agent string) and, from your IP address, on our servers and without sending it to any third party, your city, region, country and the approximate coordinates of the city. It also computes a visit key of its own for the website, from your IP address and your browser, with a secret that changes every day: one day's key looks nothing like another day's. A day's secret is deleted from our database the next day; our backups keep it until the end of their retention period. Your IP address is then discarded: we do not record it.
If you accept audience measurement with the website's cookie banner, your browser tells our server, which then also computes, for each page view, the visit key that the app.apogee.ad application computes for the same IP address and browser that day. This lets us count the website visitors who then open the application's sign-up page on the same day, from the same browser and network, without being signed in to an account. Without this agreement, the website's key cannot be matched with any data of the application.
This data is only used to produce statistics for Apogee: visitors, page views, most viewed pages, where visitors come from, countries and cities, device types and, with your agreement, this move to the sign-up page. We do not link it to your account, do not pass it on to any third party and do not use it to follow you on other websites. It is deleted after 13 months; the presence signal after 24 hours at most.
This audience measurement, apart from the move to the sign-up page, is exempt from consent (article 82 of the French Data Protection Act; CNIL guidelines of 17 September 2020). You can object to it at any time: refuse audience measurement with the "Cookie settings" link at the bottom of every page, or turn on the Global Privacy Control or "Do Not Track" signal in your browser. Your browser then sends no visit statistics at all. Your choice, agreement or refusal, is kept for 6 months; after that, and until you choose again, the visit statistics without cookies resume, without the move to the sign-up page.
Some pages load third-party resources (icons, fonts, flags), which sends your IP address to those third parties.
Traffic from AI assistants
Our host (Vercel) checks every page requested to recognise the crawlers of AI search engines and assistants (GPTBot, ClaudeBot, PerplexityBot…) and reports their visits to our provider CiteMe. This check uses, at that moment, the page address, the browser identification (user-agent), the IP address and the referring site; your IP address is never passed to CiteMe.
If you arrive from an AI assistant (ChatGPT, Perplexity, Claude, Gemini, Copilot…) before making any choice in the cookie banner, our host passes to CiteMe the landing page address with its parameters, the name of the assistant you came from, a few technical navigation indicators (Sec-Fetch headers) and, if that page is one of our conversion pages, the fact that it is a conversion. Nothing is read from or stored on your device, neither cookies nor local storage: the arrival gets a random identifier, which is kept nowhere on your side and cannot recognise you on your next visit. A page opened with an ad click identifier (gclid, fbclid…) is not counted. To spot arrivals from an AI that do not reveal where they come from, our host may also pass to CiteMe, for a page opened from another site without a referrer or by software, the page address and the same indicators, without any identifier.
With your agreement to audience measurement, CiteMe also follows your visit and conversions (for example a click to the application's sign-up) to credit them to the AI assistant you came from, using its script and the cookies described in this section.
This data is used to measure, for Apogee, traffic from AI search engines and assistants. You can object to it at any time: refuse audience measurement with the "Cookie settings" link at the bottom of every page, or turn on the Global Privacy Control or "Do Not Track" signal in your browser. Our host then only passes to CiteMe the visits of crawlers, which do not concern you.
13. Security
We implement technical and organizational measures to protect your data, including encryption of exchanges between your browser and our services (HTTPS), request rate limiting and access-control rules in the database. So that Meta can retrieve your creatives, the files intended for your ads are accessible through a technical address (URL) for as long as they are kept. No measure can rule out all risk. In the event of a data breach, we inform the CNIL and, where applicable, the people concerned, under the conditions laid down by the GDPR.
14. Emails
- Service emails: workspace invitations, notifications, automation reports and billing. They are needed for the Service to work.
- Product tips and occasional offers to account holders: you can unsubscribe at any time through the unsubscribe link in our tips and offers emails, by replying to one of our emails, or by writing to hello@apogee.ad.
- Measurement: we measure whether these emails are opened and which links are clicked, to assess their interest and adapt our exchanges with you; this information is linked to your customer relationship record.
15. Prospects
- Data: name, job title, company, business email address and phone number, notes on our exchanges, resources requested, interactions with our emails; for emails exchanged with us, the sender, recipients, date, subject and a short excerpt (never the full content or attachments); for our meetings, their title, date and participants.
- Sources: website forms, exchanges with us (email, WhatsApp, meetings), business contacts from our network or from professional sources.
- Purpose and legal basis: following up with our professional prospects and contacting them by email, phone or WhatsApp, on the basis of our legitimate interest; we may use an AI tool to prepare this outreach. You can object at any time.
- Retention: see Retention periods.
- Information: if we did not obtain your data from you, we inform you within one month of obtaining it and, at the latest, when we first contact you.
16. Data processed for our customers
When a customer uses Apogee, we process on its behalf data about people who are not our users: people who appear in its creatives, and people who comment on its ads (identifier or username, name, profile picture, comment text). The customer is responsible for this processing; to exercise your rights, contact the customer. If you write to us, we forward your request to the customer concerned.
17. Minors
The Service is intended for professionals and is not intended for people under 18.
18. Changes
We may change this policy. In the event of a significant change, we inform you by email or by a message in the application. The date of the last update is shown at the top of the page.
This version, of September 26, 2026, updated on October 21, 2026 (website visit statistics, Partners page, launch flow, Meta Pixel, links to the application, the application's /start page, 7-day trial, our ads page outside Europe, ad platforms you connect), replaces the one dated March 9, 2026: previous version.