Privacy Policy

This Privacy Policy explains how 加洛跃迁（北京）科技有限公司 ("we", "us", or "our") collects, uses, shares, and retains personal data when you use the Aplexa Windows desktop application, aplexa.net, and related services (together, the "Service").

1. Controller and contact

加洛跃迁（北京）科技有限公司, located in Beijing, China, is the controller of personal data processed through the Service. For privacy questions or requests, email [email protected].

2. Summary

• We collect account data, billing and subscription data, token usage counters, technical data used for rate limiting and security, and support correspondence.
• We use this data to provide the Service, secure accounts, meter the included token quota, process subscriptions through Creem, and comply with law.
• Creem handles payments, taxes, invoices, and payment methods. Aplexa never receives your card data.
• The website sets no cookies and runs no analytics, advertising, or tracking. Cloudflare may set strictly necessary security cookies.
• We do not sell personal data.
• Account data is hosted on servers in Hong Kong. Our processors may process data in the United States and other countries.
• You can request access, deletion, or export of your account data at [email protected].

3. Data we collect

We never receive or store your plaintext password. We store an argon2id hash instead. Verification and reset codes are stored as hashes, not plaintext.

When you run an agent request, the prompt and relevant project context are transmitted through Aplexa's gateway to upstream model providers so they can generate a response. Payment card data is collected and processed by Creem, not by Aplexa.

4. How we use data and our legal bases

We process personal data for these purposes:

• Providing the Service: creating and authenticating accounts, processing agent requests, and metering token usage. Legal basis: performance of our contract with you.
• Subscriptions and billing: maintaining subscription status and billing periods through Creem. Legal basis: performance of our contract and compliance with legal obligations.
• Security and operations: rate limiting, abuse prevention, troubleshooting, and maintaining reliability. Legal basis: our legitimate interests in protecting the Service and its users.
• Legal compliance: tax, accounting, and responding to lawful requests. Legal basis: compliance with legal obligations.
• Support and rights requests: responding to your questions and exercising your privacy rights. Legal basis: performance of our contract, legal obligations, and our legitimate interests.

Where we rely on consent, you may withdraw it at any time. We do not use personal data for advertising, and we do not sell it.

5. Cookies and analytics

The website at aplexa.net sets no cookies and runs no analytics, advertising, or tracking scripts. Cloudflare, our DNS and CDN provider, may set strictly necessary security cookies to protect the site and mitigate abuse. These cookies are not used for profiling or advertising.

6. Sharing and processors

We do not sell personal data. We share data only as needed to operate the Service:

• Creem acts as Merchant of Record and handles payment processing, applicable taxes, invoices, and refunds. Creem processes purchase and billing data under its own terms.
• Cloudflare provides DNS, CDN, and security services and may process IP addresses and request metadata.
• Resend delivers email verification and password reset messages. It receives the email address and message content needed for delivery.
• Hosting infrastructure in Hong Kong stores account data and serves the Service.
• Upstream model providers receive the prompt and relevant project context through Aplexa's gateway to generate responses. They process this content to produce output.

Service providers process data on our instructions under contractual obligations, except where they act as independent controllers for their own services. We may also disclose data where required by law, legal process, or to protect the rights, safety, and security of our users, the Service, or the public.

7. International transfers

Account data is hosted on servers in Hong Kong. Our processors may process personal data in the United States and other countries where they operate. Where required by law, we use appropriate safeguards for these transfers, such as contractual data protection terms. You can contact [email protected] for more information about transfer safeguards.

8. Retention

• Account data is kept until you delete your account.
• Email verification and password reset codes expire after 15 minutes.
• Backups are kept for 14 days.
• Billing records are retained as required by Creem or tax law.
• Support correspondence is kept as long as needed to resolve and document the request.
• Technical logs are kept only as long as needed for security and operations.

When you request deletion, we remove account data from active systems and backup copies are purged within 14 days in the ordinary course. We may retain limited records where required by law, for tax and accounting purposes, or to establish or defend legal claims.

9. Security

Passwords are hashed with argon2id and never stored in plaintext. Data in transit is protected with TLS. Administrative access to production systems is restricted to a WireGuard-only admin network, and access follows the principle of least privilege.

We do not claim end-to-end encryption. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify affected users and authorities as required by law.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent where processing is based on consent. Under the GDPR, these rights include access, erasure, portability, and objection.

California residents have rights under the CCPA and CPRA, including the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and be free from discrimination for exercising those rights. We do not sell personal data or share it for cross-context behavioral advertising.

To exercise a right, email [email protected] with the subject "Privacy request". You can also request deletion or export of your account data at the same address. We may ask for information to verify your identity. You may use an authorized agent with proof of authorization. We respond within the time required by applicable law. If you are not satisfied, you may complain to your local data protection authority.

11. Children

The Service is intended for professional developers and is not directed to children. You must be at least 18 years old to create an account. If we learn that an account belongs to a child under 18, we will close the account. Contact [email protected] if you believe a child has created an account.

12. Changes to this policy

We may update this Privacy Policy. If we make material changes, we will notify you by email or in the app before they take effect. The effective date at the top of this page shows the current version. Continued use of the Service after the effective date means you accept the updated policy.

13. Contact