Privacy Policy

1. Introduction

Apex Creator Management ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website apexcreatormanagement.com and use our creator management services.

By using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use our services.

2. Information We Collect

2.1 Information You Provide

When you apply for our services through our intake form, we collect:

• Contact Information: Name, email address
• Social Media Handles: OnlyFans, Instagram, X (Twitter), TikTok, Reddit, Telegram, and optionally Threads, Fansly, YouTube, Snapchat
• Self-Reported Account Statistics: Subscriber counts, follower counts, monthly revenue ranges, posting frequency, time creating content
• Application Details: Your niche, goals, message to us
• Scheduling Information: If you request a discovery call, we collect your preferred date, time, timezone, and alternate options

2.2 Information Collected Automatically

When you interact with our website, we automatically collect:

• Usage Data: Pages visited, time spent, referring website
• Device Information: Browser type, operating system, device type (hashed and anonymized)
• IP Address: Hashed using SHA-256 for rate limiting and abuse prevention (never stored in plaintext)
• Submission Metadata: Time taken to complete forms (to detect automated bots)

2.3 Third-Party Data

We do not purchase, scrape, or automatically verify your social media profiles. All statistics you provide are self-reported and we rely on your honesty. We do not use third-party data enrichment services.

3. How We Use Your Information

We use the information we collect to:

• Evaluate your application for our creator management services
• Schedule and conduct discovery calls with you
• Communicate with you about your application status
• Provide our services if your application is approved
• Detect and prevent fraud, spam, and abuse
• Comply with legal obligations and enforce our Terms of Service
• Improve our website and services

4. Data Protection & Encryption

4.1 Email Encryption

Your email address is encrypted at rest using AES-GCM 256-bit encryption before being stored in our database. The encryption key is stored securely in our hosting environment and is never exposed in logs or to third parties.

4.2 Duplicate Detection Hashing

To prevent duplicate applications, we generate one-way HMAC-SHA256 hashes of your email address and OnlyFans handle. These hashes cannot be reversed to reveal your original information and are used solely to detect if you have previously applied.

4.3 IP Address Hashing

Your IP address is hashed using SHA-256 before storage. We do not store your plaintext IP address. The hash is used for rate limiting (preventing spam) and abuse detection only.

4.4 Security Measures

We implement industry-standard security measures including HTTPS/TLS encryption in transit, secure session cookies (HttpOnly, SameSite=Strict), rate limiting, bot protection (Cloudflare Turnstile), and parameterized database queries to prevent SQL injection.

5. Scheduling Data (Cal.com Integration)

If you schedule a discovery call, we use Cal.com, a third-party scheduling service. When you book a call:

• Your name, email, and selected date/time are shared with Cal.com to create the booking
• Cal.com creates a Google Meet link for the call
• The booking appears in our Google Calendar
• Cal.com sends you a confirmation email and calendar invite
• Cal.com may send reminder emails before the call

Cal.com's privacy policy: https://cal.com/privacy

6. Information Sharing & Disclosure

6.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6.2 Service Providers We Use

We share your information only with trusted service providers necessary to operate our business:

• Cloudflare Pages/Workers: Website hosting and API infrastructure (USA)
• Cal.com: Discovery call scheduling (optional, only if you book a call)
• Google Calendar/Meet: Video calls (via Cal.com integration)
• Email Service Provider: Transactional emails (application status updates)

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

6.3 Legal Requirements

We may disclose your information if required by law, court order, subpoena, or to protect our rights, property, safety, or the safety of others.

7. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this policy:

• Applications: Retained for 2 years after final status decision (approved/rejected) for record-keeping and to prevent duplicate applications
• Client Records: If you become a client, retained for 7 years after service termination for tax, legal, and business purposes
• Session Cookies: Automatically deleted after 2 hours of inactivity
• Rate Limiting Data: Automatically deleted after 24 hours

8. Cookies & Tracking

8.1 Session Cookies (Required)

We use a single session cookie (apex_session) for the owner dashboard login. This cookie is HttpOnly (not accessible to JavaScript),SameSite=Strict (CSRF protection), and Secure (HTTPS only). It expires after 2 hours of inactivity. This cookie is essential for security and authentication.

8.2 Cloudflare Turnstile

Our application form uses Cloudflare Turnstile to protect against bots and spam. Turnstile may set a temporary cookie to verify you are human. No personal information is collected beyond what is necessary for bot detection.

Cloudflare Turnstile privacy: https://www.cloudflare.com/privacypolicy/

8.3 No Advertising or Third-Party Trackers

We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers. We do not display ads on our website.

8.4 Analytics (If Enabled)

[Optional: If you choose to enable analytics in the future, disclose it here. For example: "We use Cloudflare Web Analytics (privacy-respecting, no cookies) to understand traffic patterns."]

9. Your Privacy Rights

9.1 General Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Objection: Object to processing of your personal information for certain purposes
• Data Portability: Receive your data in a structured, machine-readable format

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete your personal information (with exceptions)
• Right to opt-out of the "sale" of personal information (we do not sell)
• Right to non-discrimination for exercising your rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

Do Not Sell My Personal Information: We do not sell personal information as defined by the CCPA.

9.3 How to Exercise Your Rights

To exercise any of these rights, email us at: hello@example.com
We will respond within 30 days (45 days for California residents). We may ask for verification of your identity before processing your request.

10. Children's Privacy (18+ Only)

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. OnlyFans and similar creator platforms require users to be 18+. If you are under 18, do not use our services or provide any information to us. If we discover we have collected information from a minor, we will delete it immediately.

11. International Data Transfers

Our services are based in the United States. If you are accessing our website from outside the U.S., your information will be transferred to, stored, and processed in the United States. By using our services, you consent to this transfer. We take appropriate safeguards to protect your data in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated via email (if you are a client) or a prominent notice on our website. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us: