Privacy Policy

Who this policy covers

In this policy, “URX”, “we” and “us” mean Apexmart LLC, the operator of urx.si. It covers three groups of people:

• Website visitors - people browsing urx.si.
• Customers - people and organisations who sign up for URX or contact us.
• Link visitors - people who open a Smart Link or scan a QR code created with URX.

Founder profiles, analytics, acquisitions and optional health

Product profiles, launches, updates, reviews and published listings contain the fields their makers choose to publish. Existing and new Projects default to public aggregate business revenue when published. You can hide revenue numbers in your product settings at any time. Individual customers, transactions and provider credentials are outside the public metric projection.

Website analytics can include pseudonymous visitor and session identifiers, page paths, events, goals, device/browser information and the geography supplied by the collection infrastructure. Identity and retention depend on the selected website mode. Explicit account or device associations belong to authorized backend requests; a browser payment report is separate from canonical provider revenue. Expiring shared dashboards contain a restricted aggregate traffic projection.

Acquisition rooms contain private messages, participant grants, offer terms, agreement revisions, signature evidence and provider transaction observations. Files and room access require current authorized grants. Reviewed retention policies and legal holds can preserve deal evidence after an account leaves a room; active disputes and provider settlement records require separate handling.

WHOOP access requires an independent health opt-in and provider grant. Health credentials and imported history are stored privately. Publishing a health card requires a separate explicit health visibility choice. Public revenue settings never grant health publication. Disconnecting or deleting local health data removes local credentials and imported records; provider-side access can also be removed through the provider's own account controls.

Community photos/messages, notification device tokens, cofounder relay requests, affiliate attribution and newsletter subscriptions are used for their corresponding workflows. Delivery rechecks current permissions and preferences. Configured payment, signature, escrow, push, email and connected-data providers receive the information needed for the authorized workflow. Provider setup and applicable service terms determine availability.

Google user data

If you connect Google Search Console or Google Analytics to a website in URX, you choose the Google account and approve read-only access. URX then reads:

• Google Search Console (read-only): the list of properties you can access, and search performance for the property you pick - queries, pages, countries, devices, clicks, impressions, click-through rate and average position.
• Google Analytics (read-only): aggregated reports for the property you enter - daily page views, sessions and users by traffic source and page. URX does not read individual visitors from Google Analytics.

We use this data only to show it to you and your workspace inside your private URX dashboard, next to your other website analytics. It is not published, not sold, not used for advertising, not used to train AI models and not shared with anyone except the infrastructure providers that store it for us. People at URX can read it only with your permission, for security reasons, or where the law requires it.

Google access tokens are stored encrypted. Disconnecting the integration in URX deletes the stored tokens and the imported Google data. You can also remove URX's access at any time in your Google Account under Third-party apps and services.

URX's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connected AI integrations

When you authorize an AI app such as ChatGPT or Codex, URX records the app, your user and Workspace, the permissions you approve, and the connection dates. Access is limited to your current Workspace membership, role and feature allowances. Access tokens expire after one hour; refresh authorization lasts up to 30 days and can be renewed while the connection remains authorized.

For tasks you request, URX sends relevant tool results to the connected app. Depending on the permissions and task, these can include Project and link settings, Bio Page content, aggregate analytics and revenue, selected pseudonymous visitor activity, launch drafts, Growth Plans, Visibility results, team names and invitation addresses. URX does not send sign-in passwords, provider credentials, installation secrets or payment card details through these tools. Browser utilities that require local file or image processing continue to run on their website pages.

The connected app processes the information it receives under its own applicable terms and your settings. For ChatGPT and Codex, the recipient is OpenAI. Review the app and permissions before connecting and request only information you are authorized to share. Google Search Console and Google Analytics report sharing remains disabled until its separate policy and consent requirements are completed; connecting an AI app does not by itself share Google reports.

Consequential changes use an encrypted preview containing the proposed inputs and affected resources. A preview expires after ten minutes. Preview inputs and operation receipts are scheduled for deletion by hourly maintenance once they are more than 24 hours old. The resulting URX records and security/audit records follow the retention rules below. URX does not store your entire AI conversation through this integration.

You can disconnect an app in Connected apps. This stops future access and token renewal; it does not erase information already sent to the app or undo requested changes. Use the connected app's own data controls for its copies. Directory submissions share the approved listing kit with the selected directories only after you confirm the preview.

Visitors to urx.si

We measure how the website is used with privacy-friendly, cookieless analytics: pages viewed, referring site, country, device type and browser, in aggregate. We don't use advertising cookies or cross-site trackers, and we don't build profiles of website visitors.

Our hosting provider keeps short-lived server logs (such as IP address, time and requested page) to keep the site secure and running.

URX customers

When you create an account or contact us, we collect what you give us:

• Your email address, and your name if you provide it.
• The contents of messages you send us.
• For accounts: your links, destinations, routing rules, QR code settings, domains and billing details.

If you sign in with Google, Google tells us your name, email address and profile picture. Passwords are stored only as a secure hash, and two-factor secrets and passkeys only in the form needed to check them. Essential cookies keep you signed in and protect the sign-in steps; they aren't used for anything else.

Payment card details are handled by our payment provider and never stored on our servers.

If you follow one of our signup campaign links, we record its short source label, such as a URX article or social profile, when your verified account first reaches URX. We don't store a raw referring URL or add a tracking cookie, browser-storage identifier or cross-session visitor profile for this. A missing source remains unknown; later visits don't replace it.

We also record limited workspace milestones, such as its creation and first resolved Smart Link or Bio Page button activity, to measure account activation and return use in aggregate. These measures don't identify individual link visitors or establish that they installed an app or made a purchase.

People who open URX links

When someone opens a URX link, we use information from their request to decide where to send them and to give the link's owner aggregate analytics. For each click we record:

• The time, the link, and the destination we chose (including which routing rule applied).
• Platform, operating system, device type and browser, derived from the user agent.
• Country, region and city, looked up from the IP address at the time of the click (with a position rounded to about 11 km for maps), and the browser's preferred language.
• The referring site, any UTM parameters on the link, whether it came from a URX QR code, and which domain was used.

We don't store full IP addresses with click data, and redirects don't set tracking cookies. To count unique visitors we use short-lived, anonymised signals that can't be used to identify a person.

Two features a link's owner can turn on work slightly differently. An A/B test sets a cookie for that link only, for up to 30 days, so a returning visitor sees the same version. Deferred deep linking on iPhones and iPads keeps a keyed, one-way hash of the visitor's network (never the IP address itself) for at most one hour, so the owner's app can open on the right screen after it is installed; it is deleted as soon as the app claims it.

Contacts (Growth plan) let a link's owner report when someone who came through their link signs up or pays in the owner's own product. We then keep the owner's own user id for that person, a name and email address only if the owner sends them, the link that brought them, and the amounts they paid, so the owner can see which links bring paying customers. The owner decides what to send, and it is deleted with their workspace.

A Bio Page can ask visitors for an email address (a sign-up or a step before the page opens) or to answer a short form. What a visitor sends is kept for the page's owner to read and export, and deleted when they delete it, the page or their workspace. We keep a keyed hash of the visitor's network for a few minutes to slow down floods, never the address itself. A page's chosen fonts load from Google Fonts, and its video or music players from the service that hosts them.

For this data, the customer who owns the link decides why it is collected; we process it on their behalf. We also use it ourselves, in limited ways, to prevent abuse and keep the service reliable. If you have a question about a specific link, you can contact its owner or us.

How we use data

• To provide the service: routing visitors, showing analytics, generating QR codes.
• To run your account, send service emails (about your account, billing, usage and security), and reply when you contact us.
• To detect and stop abuse such as phishing, malware and spam links.
• To understand, in aggregate, how URX and urx.si are used so we can improve them.
• To meet legal obligations, such as keeping billing records.

We don't sell personal data, and we don't use link-visitor data for advertising or profiling. On the Free plan, visits past the monthly click allowance see a URX page that can carry a sponsor's message; sponsors only ever receive totals (how many times it was seen and chosen, by day, country and device type), never which links carried it or anything about a visitor. The page sets no cookies and loads no third-party scripts. Paid plans never show it.

Who we share it with

We use a small number of service providers who process data for us under contract:

• Cloudflare - the edge network that answers URX links; hosting for the website, dashboard, API and database; click analytics storage; and the bot check on the sign-up and sign-in forms.
• Brevo - service emails and contact-form messages.
• Stripe - payments, for paid plans.
• Google Web Risk - checking destination URLs for known phishing and malware, when enabled.
• An AI provider (OpenRouter) - writing AI drafts you ask for and your Growth Plan, and searching the web for it. It receives your product's public details and your questions, not your account details.
• A marketing-knowledge provider - finding proven growth tactics for your Growth Plan. It receives short topic searches about your product's category through URX's own account, never your name, email or questions.
• A cookieless website analytics provider - aggregate website statistics.

We may disclose information if the law requires it, or to protect people from harm, fraud or abuse. If URX is ever involved in a merger or acquisition, this policy continues to apply to data transferred.

How long we keep it

• Click analytics: according to the link owner's plan - 30 days on Free, 1 year on Pro, 2 years on Growth, or as agreed on Business.
• Account data: while your account is open, then deleted within 90 days of closure, except records we must keep by law.
• Signup-source and identifiable workspace-milestone data are removed with the account or workspace. We may retain anonymous cohort totals that cannot be linked back to it.
• Messages to us: as long as needed to handle your request.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. You can also complain to your local data protection authority.

To use any of these rights, email privacy@urx.si. We'll respond within 30 days.

We only send service emails - about your account, billing, usage and security - because they're part of running the service. We don't send marketing emails. Usage warnings and domain alerts can be turned off in your workspace settings. To ask about any email from us, write to privacy@urx.si.

Security

We protect data with encryption in transit, access controls and careful choice of providers. No system is perfect; if we ever have a breach that affects you, we'll tell you promptly. See our security page for more.

Changes to this policy

If we make meaningful changes, we'll update the date above and, for customers, let you know by email before they take effect.

Contact

Questions about privacy: privacy@urx.si. Everything else: contact us.

By post: Apexmart LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.