1.Overview
This Privacy Policy explains how Caspian Solutions ("Caspian", "we", "us") collects, uses and shares personal information when you visit ats.apexsales.ai (the "Site") or use the Apex ATS application, careers pages, feeds and related services (the "Service"). It also explains the different roles we play: we are the controller for Site visitors and for the account details of our customers' users, and we are a processor for applicant data that our customers store in their workspaces.
2.What we collect on the website
- Form submissions: when you request a demo, contact us, apply for a service or partner program, ask for support, or subscribe to the newsletter, we collect what you type: typically name, work email, company, phone, role count, website and your message. Submissions are emailed to management@apexsales.ai and stored in our database so we can follow up.
- Account sign-up: when you create an account we collect your name, email, password (stored hashed by our authentication provider), organization name and timezone.
- Technical data: server logs record IP address, browser type, referring page, pages viewed and timestamps. We use these for security and to understand how the Site is used.
- Cookies: see the Cookies section below and our Cookie Policy.
3.What we collect in the product
- User account data: name, email, role, workspace membership, login events and support requests from the people our customers invite.
- Customer content: jobs, templates, settings, notes, and configuration such as connected messaging accounts.
- Applicant data: the information applicants submit through a customer's careers page or that a customer uploads, including name, contact details, city, LinkedIn URL, resume file and extracted text, screening answers, cover letter, source, SMS consent status and the messages, notes, scores, stage history and interviews attached to the record.
- Messaging data: the content, timestamps, delivery status and provider identifiers of SMS and email sent and received through the Service, including opt-out events.
- Usage data: which features are used and when, aggregated to improve the Service.
4.Applicant data and the employer's role
If you applied for a job through an Apex ATS careers page, the employer you applied to is the controller of your application. They decide what to collect, how long to keep it and who on their team can see it. Caspian processes that data on the employer's instructions under our Data Processing Addendum and does not use it for our own purposes beyond running and securing the Service.
To access, correct or delete your application, contact the employer first; their contact details are on their careers page. If you cannot reach them, email us at management@apexsales.ai and we will pass on your request and help the employer respond.
5.How we use information
- To provide the Service: host workspaces, parse and score applications, deliver messages, book interviews, generate feeds and reports.
- To run accounts: authentication, billing, support, notices about the Service and changes to terms.
- To respond to you: answer demo, contact, support and partner requests.
- To improve and secure the Service: monitor performance, detect abuse, fix bugs and understand aggregate usage.
- To send our newsletter, only if you subscribed. Every issue has a one-click unsubscribe.
- To comply with law and enforce our terms.
We do not sell personal information, we do not use applicant data to train models for third parties, and we do not show advertising.
7.SMS and email data
Customers send SMS through their own Twilio account and email through Resend. Message content and metadata pass through those providers and are stored in the customer's workspace so the hiring team can see the conversation. Applicants give SMS consent on the careers page apply form; the consent timestamp is stored on their record. Replying STOP to any text opts the applicant out and the Service will not send further texts to that number. Our SMS Terms at ats.apexsales.ai/legal/sms-terms describe the applicant messaging program.
8.How long we keep information
- Website form submissions: as long as needed to respond, then as part of our business records for up to three years.
- Account data: for the life of the account and 60 days after closure, then deleted from production, with backups expiring within a further 30 days.
- Applicant data: according to the customer's instructions and their retention settings; customers can delete applicants at any time. When a workspace is deleted, its applicant data is deleted on the schedule above.
- Server logs: up to 90 days unless needed for a security investigation.
- Legal and billing records: as required by law, typically seven years.
9.Security
Data is encrypted in transit (TLS 1.2 or higher) and at rest. Every customer's data is isolated by organization with database Row Level Security. Resume files are stored in a private bucket and served through short-lived signed links. Access by our staff is limited to what is needed to support customers and is logged. Details are on our Security page. No system is perfectly secure, so please report concerns to management@apexsales.ai.
10.Sharing and subprocessors
We share personal information only with providers that help us run the Service, under contracts that restrict their use of it:
- Supabase (database, authentication, file storage), hosted on AWS in the United States.
- Cloudflare (hosting, CDN and DDoS protection).
- Twilio (SMS delivery), when a customer connects a Twilio account.
- Resend (email delivery for product email and website forms).
- A payment processor for subscription billing.
We may also disclose information when required by law, to protect the rights and safety of people or the Service, or as part of a merger or acquisition, in which case this policy continues to apply to the transferred data. The current subprocessor list is maintained in the Data Processing Addendum.
11.International transfers
Caspian is based in the United States and our providers store data primarily in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our customers and subprocessors, together with the safeguards described on our Security page.
12.Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. California residents have the rights described in our GDPR and CCPA notice, including the right to know, delete and correct, and the right to opt out of sale or sharing (we do neither).
To exercise a right, email management@apexsales.ai. We will verify your identity and respond within 30 days (45 days for CCPA requests, extendable once). If your request concerns an application you made to an employer, we will route it to that employer as controller and assist them.
13.Children
The Site and Service are for business use and are not directed to children under 16. We do not knowingly collect personal information from children. Employers who accept applications from people under 18 are responsible for complying with applicable youth employment and privacy laws. If you believe a child has provided us information, email us and we will delete it.
14.Changes to this policy
We may update this policy as the Service and the law change. Material changes will be announced by email to account owners or by a notice on the Site at least 14 days before they take effect. The date at the top of this page shows the current version.
15.Contact
Caspian Solutions, operator of Apex ATS. Email management@apexsales.ai for privacy questions or requests. Our privacy contact handles GDPR and CCPA requests and can be reached at the same address.
Last updated: September 2026.