Random, first-party visitor IDs
Each visitor gets a random ID, kept in local storage and a first-party cookie for up to 365 days. Apex is not cookieless, and it does not pretend to be.
Security & privacy
Built for your privacy review
Where your data lives, what Apex stores about visitors, how consent works and where the compliance program stands, without the marketing gloss.
Where your data lives
LondonApplication and analytics, United Kingdom
IrelandDatabase
365 daysEvent retention
Apex runs in the United Kingdom (London) and Ireland. Scripts and events travel through Cloudflare's global edge network. The data processing agreement relies on the EU adequacy decision for the United Kingdom.
Visitor data, consent and access
No fingerprinting
No canvas, WebGL or font tricks. A visitor is only recognised by the ID Apex gave them.
No stored IP addresses
IP addresses are never stored. Analytics keeps the country, the device and the page, not the address.
PII filtered out
Properties that look like personal data, such as email, phone, address or card numbers, are stripped before events are stored.
Consent first
Before consent, Apex can render the assigned variant but sends no tracking events and writes no persistent ID. Revoking consent stops tracking and clears Apex storage.
Export and deletion
API endpoints answer access and erasure requests across analytics and the database. Shopify's mandatory privacy webhooks are handled too.
Roles, SSO and audit logs
Owner, admin, editor, viewer, analyst and client roles, SAML single sign-on, scoped API keys and an audit log of sensitive changes.
DPA and subprocessors
A data processing agreement under Art. 28 GDPR with a subprocessor list naming each vendor's location and transfer mechanism. An external data protection officer, PROLIANCE GmbH, is appointed.
Compliance status
Program managed in Drata, SOC 2 / ISO 27001 audit package prepared, audit not yet begun.
Apex is not SOC 2 or ISO 27001 certified today. When that changes, this page will say so.
Your data stays yours
Everything Apex learned about your shop, every result and every document, is yours and stays readable. What enters the shared model is the pattern, never your copy, your creative or your numbers.
Want Apex on your shop?
Apex can come with the research on your shop and the team that reads the results, or run on its own, and a free plan for one store needs no card. The main way in is a call: if your shop does six figures a month, book one and we'll find the setup that fits.
See if your shop is a fit
30 minutes, and you'll know exactly where your shop stands.