Privacy Policy

Controller and contact

The operator identified above is the data controller for Apex platform processing. The Company Information page gives its registered office, general contact and privacy contact. You can also submit a data request or privacy complaint through Settings → Your data.

Information we process

Account information includes name, email, authentication identifiers, account role and status, date of birth and age-eligibility records. Sporting profiles can include biography, education, school or university, clubs, teams and counties represented, sport, discipline, position, career level, performances and history, achievements and other accolades, structured sporting relationships, commercial availability, brand interests and representation information.

We process social links and supplied follower counts; profile and gallery photographs; highlight-video identifiers, duration, processing and playback metadata; and city, region and country. You decide which optional profile fields to supply. Do not add medical records, identity documents or residential details to a biography or public upload.

Professional activity includes saved athletes, private watchlist notes and statuses, followed-athlete updates, saved search criteria, notifications, connection requests, private messages, opportunity applications and organisation membership records. Trust records include verification evidence, qualification details, reports, blocks, moderation actions, security events and data-rights requests. Billing records include plan, status, provider references, periods and transaction metadata, not full card numbers or CVCs.

Enquiries contain the details you enter in the contact form. Operational processing includes request/device information available to hosting and delivery providers, security logs and temporary keyed network identifiers used for rate limiting. Our application counters record aggregate activity rather than a visitor identity feed.

Public and private information

When you publish a discoverable profile, the selected visibility audience may see your display name, sport, performance, achievements, coarse location, affiliation and representation information, commercial availability, social links and published media. Public pages may be indexed by search engines or copied by visitors. Changing visibility limits subsequent access through Apex but cannot guarantee removal of third-party copies.

Account email, date of birth, private messages, verification documents, billing records and internal moderation information are not public profile fields. We do not ask for your residential coordinates for discovery. Any telephone or contact details supplied privately for support are not public by default. The company’s legally disclosed registered office is distinct from users’ private addresses.

Accepted connections can exchange messages; authorised organisation users can access their relevant applications and workflows. Authorised staff can review private material where necessary for support, verification, safety, rights requests or legal obligations, subject to access controls.

Purposes and lawful bases

Contract: processing needed to register and operate your requested account, publish your chosen profile, provide discovery and professional tools, handle connections, messages and applications, deliver media, administer subscriptions and respond to service requests.

Legitimate interests: proportionate security, abuse and fraud prevention, verification integrity, moderation, service reliability, aggregate product measurement and managing professional enquiries. These interests are balanced against your rights; you may object, and we assess whether processing must stop.

Legal obligation: processing required for applicable accounting, tax, lawful requests and data-protection obligations. Consent: optional marketing where required and any optional device tracking introduced with consent controls. Agreeing to Terms is not blanket consent to all processing. You may withdraw consent without affecting earlier lawful use.

We do not require health or other special-category information for a sports profile. If a report or verification case contains sensitive information, we restrict access and assess the additional legal condition before using it. Do not send unsolicited medical information. Sporting or commercial discovery is not an automated guarantee of selection; Apex does not make solely automated decisions with legal or similarly significant effects through its discovery filters.

Recipients and service providers

Supabase provides database, authentication and image/document storage infrastructure. Stripe processes subscription payments and related billing activity and may act independently for its own regulatory and fraud-prevention purposes. Apex does not store full payment-card numbers, CVCs or raw payment credentials.

Mux processes and delivers highlight videos. Playback requires communicating with the video provider; the application disables its optional playback tracking. Resend delivers contact-enquiry email when configured. The deployment hosting and network infrastructure also handle requests and operational logs. We have not represented an unconfirmed hosting or analytics integration as active.

We may share necessary information with authorised professional advisers, authorities where law requires, and service providers under appropriate arrangements. External social links open the selected service only when you follow them. Its own notice applies. We do not sell your private messages or verification evidence.

International processing

Our providers may use infrastructure and support outside the UK. The regions, subprocessors and safeguards depend on the configured service and contract. We must assess any restricted transfer and put an appropriate lawful mechanism in place where required. We do not claim that all data remains in the UK or that a particular safeguard applies without checking the relevant arrangement. Contact the privacy contact for information about the safeguards applicable to your data.

Retention and deletion

We retain account and sporting records while needed to provide your account. A deletion request hides the athlete profile immediately and enters a staff review; it is not an instant erasure of every record. Staff must consider linked records, outstanding billing, legal obligations and safety evidence, and remove or minimise data no longer needed.

Messages, applications, verification submissions and reports are retained only while needed for the interaction, verification, complaints or a justified legal/safety purpose. Verification-document records have a 90-day review date; this is a review trigger, not a promise of automatic deletion. Legal holds must be justified and reviewed. Billing records are retained for the applicable accounting and tax requirements and any justified dispute period.

Contact enquiries are kept while being handled and for a necessary follow-up or dispute period, then reviewed for deletion or minimisation. Temporary contact rate-limit records are cleared by the submission flow after their 25-hour window; billing rate-limit records use a one-day window. Provider security logs and backups have separate configured schedules that must be confirmed before launch.

Deletion from active storage and expiry from backups can happen at different times. Restricted evidence may remain where necessary, and recipients may retain their own correspondence. You can ask for the applicable retention criteria or challenge continued retention. We do not operate a policy of retaining everything indefinitely.

Your rights and complaints

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data; object to processing based on legitimate interests; and withdraw consent where it applies. Rights have legal limits, including protecting other people’s information and retaining records required by law.

Use Settings → Your data to download available account and sporting records or submit a fuller request. Downloads do not automatically include media originals or third-party evidence requiring review. You can instead contact the privacy contact without an account. We may need proportionate information to confirm identity. We normally respond within one month; if a permitted extension is needed, we will explain it.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. Please contact us if you would like us to investigate first; this does not limit your right to approach the ICO.

Security, children and changes

We use scoped access controls, private storage and restricted moderation workflows to reduce unauthorised access. No system can guarantee absolute security. Keep account credentials secure and report suspected exposure promptly.

Standard registration remains 18+ while protected youth enrolment is closed. The protected 13–17 model processes private DOB and derived age group, guardian accounts and relationships, versioned acknowledgements, verification outcomes, privacy settings, guardian-included contact and messages, safety reports and adulthood transitions. Youth data uses restricted discovery and higher privacy defaults. Guardian acknowledgement is not the lawful basis for every activity; the activity-specific lawful-basis and sensitive-data mapping requires specialist review. Read /youth-privacy for age-appropriate information. Public pages can be accessed by children; a declared age alone does not prevent this.

Our Cookie Policy describes browser storage. We will update this notice when processing changes and give appropriate notice of material changes. The revision date appears above.

Contact enquiries

The contact form collects name, email, type, subject, message and any optional enquiry-specific details. Enquiries are stored in restricted records and may be sent to Apex through Resend. Commercial enquiries enter the commercial lead workflow. Submitting an enquiry does not subscribe you to marketing. Aggregate enquiry and Instagram-click counters do not contain message text, email or visitor identities.