Who we are
Apexly ("Apexly", "we", "us") is operated by Vijay Tambe from India. For anything in this policy, write to support@apexly.dev.
Our two roles
- For our customers (the software companies that sign up and use the dashboard or API), we are the controller of their account data.
- For our customers' users (people who visit a domain served through Apexly, or who use a connect page to add a DNS record), we act on our customer's behalf as a processor. Questions about how a particular site uses your data should go to the company that runs that site; we will help them answer.
What we collect
Account and app data
- Name and email address, and the basic profile GitHub or Google returns if you sign in with them.
- Sign-in sessions (a session cookie and its record on our servers) and the IP address used to request a sign-in link, for rate limiting.
- Your app settings: origin URL, webhook URL, white-label hostname and similar configuration.
- API keys, stored only as one-way hashes; the full key is shown to you once. Signing secrets are encrypted at rest.
- The plan or license on your account and records of operator changes to it.
Domains you register
- Hostnames, their status history, and any metadata you attach (for example a customer name).
- Results of DNS lookups we make to verify each domain (the records we found), and certificate details (issuer, validity).
- Webhook delivery records: event type, target URL, response code and timing. We do not store the bodies your endpoint returns.
Traffic through the edge
- For each request: time, hostname, path, method, response status, bytes sent, timing and the visitor's IP address, used for security, debugging and abuse prevention.
- Per-domain request and byte counts per day, used for usage limits and billing.
- We never log request or response bodies, and never log query strings (they can carry tokens).
Connect page
- If someone asks to be emailed when their domain is live, we store that email address only until we send that one email, then delete it.
Abuse reports and support
- What you send us in an abuse report or support email, including your contact details.
How we use it
- To provide the service: verify DNS, obtain and renew certificates, route traffic to your origin, send webhooks and the emails you or your customers asked for.
- To keep it safe: rate limits, fraud and phishing screening, investigating abuse reports, securing accounts.
- To measure usage against your plan and, once paid plans are switched on, to bill for it.
- To talk to you about your account: sign-in links, alerts about your domains, and service changes. We do not send marketing email without your consent.
- To meet legal obligations.
We do not sell personal data, and we do not use it for advertising.
What becomes public
Certificate authorities publish every certificate they issue in public Certificate Transparency logs. When we obtain a certificate for a hostname, that hostname becomes publicly visible in those logs. This is how HTTPS works everywhere, not something specific to Apexly. Do not register hostnames whose names you need to keep secret.
Service providers
We share data only with providers that help us run the service, and only what each one needs:
- Amazon Web Services: hosting, storage, backups and sending email (Amazon SES).
- Let's Encrypt (Internet Security Research Group) and, as a fallback, ZeroSSL: certificate issuance; they receive the hostname.
- Google Safe Browsing: we check hostnames and origin URLs against known phishing and malware lists.
- GitHub and Google: only if you choose to sign in with them.
The marketing site uses no analytics, no advertising pixels and no third-party trackers; its fonts and assets are served from our own domain.
Where data lives
Our servers and backups are in the AWS Asia Pacific (Mumbai) region. Some service providers above operate in other countries (for example the United States); when data goes to them it is limited to what they need and protected by their own commitments.
How long we keep it
- Account, app and domain data: while your account is open. When you delete a domain it stops being served at once and its certificate is deleted.
- Domains that never connected: purged 30 days after they expire.
- DNS lookup records: 7 days.
- Edge request logs: 7 days.
- Daily usage counts: as long as needed for billing and accounting.
- Backups: 30 days, then deleted automatically.
- Connect-page "email me" addresses: until the one email is sent.
When you close your account we delete its data, except what we must keep by law; it leaves backups within 30 days.
Security
Traffic is encrypted in transit. API keys are stored as one-way hashes, secrets are encrypted at rest, every customer's data is isolated from every other customer's, and access to production is limited to the operator. No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay.
Your rights
Depending on where you live (including under India's Digital Personal Data Protection Act, 2023 and the EU and UK GDPR), you can ask to access, correct, export or delete your personal data, object to or restrict some uses, and withdraw consent where we rely on it. Write to support@apexly.dev; we answer within 30 days. You can also complain to your local data protection authority.
Children
Apexly is a business service and is not meant for anyone under 18.
Changes
If we change this policy we update this page and the date at the top. For significant changes we also email account owners before they take effect.