Data Processing Addendum

1. Scope and roles

You (the customer) are the controller of personal data about people who open your links and scan your QR codes. Apexmart LLC (“URX”, “we”) is your processor for that data. For your own account data (your name, email and billing details) URX is a controller, as described in the Privacy Policy.

2. What we process

• Subject matter and purpose: routing each visitor to the right destination and giving you analytics about your links.
• Duration: for as long as you use URX, then until deletion as described in section 8.
• Data subjects: people who open your links or scan your QR codes; your team members.
• Personal data: request details used at the moment of the click (IP address, user agent, language, referrer) and the derived click record — time, link, destination, platform, device type, browser, country and region, source and UTM parameters, and a daily-salted visitor hash. Full IP addresses are not stored with click data.
• Special categories: none are intended. Don't put sensitive data in link paths or parameters.

3. Our obligations

• We process the data only on your documented instructions — using URX as configured is your instruction — unless the law requires otherwise, in which case we'll tell you first where allowed.
• Everyone at URX who can access the data is bound by confidentiality.
• We don't sell the data or use it for advertising, and we use it for our own purposes only as the Privacy Policy describes (preventing abuse and keeping the service reliable).
• We make available the information needed to show compliance with this addendum and answer reasonable audit questions in writing.

4. Security

We protect the data with appropriate technical and organisational measures, including encryption in transit, access controls limited to people who need them, tenant isolation, hashed API keys, encrypted secrets and the practices on our security page.

5. Sub-processors

You authorise us to use these sub-processors, each bound by data protection terms at least as protective as these:

• Cloudflare — the edge network that answers links, and click analytics storage.
• Vercel — hosting the website, dashboard and API.
• Neon — the database for accounts, links and aggregated analytics.
• Clerk — sign-in and account security (your team members).
• Brevo — service emails.
• Stripe — payments (account data only).
• Google Web Risk — checking destination URLs for phishing and malware (URLs only).

We'll update this list and notify customers by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we can't address the objection, you may end the affected service.

6. International transfers

URX and some sub-processors operate outside the EEA and the UK. Where personal data is transferred out of those areas, the European Commission's Standard Contractual Clauses (and the UK Addendum, where relevant) apply to the transfer, and we rely on equivalent safeguards with our sub-processors.

7. Requests and breaches

• We help you answer requests from data subjects — for example by exporting a workspace's data, or deleting data on request — and tell you if a request reaches us directly.
• If we become aware of a personal data breach affecting your data, we notify you without undue delay, with the information you need to meet your own obligations.
• We provide reasonable help with data protection impact assessments that concern URX.

8. End of the service

You can export your links and analytics at any time. When you delete your workspace or account, we delete its personal data as described in the Privacy Policy, except where the law requires us to keep it.

9. Contact

Data protection questions: [email protected]. Apexmart LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.