Privacy Policy

This Privacy Policy describes how Aplo Systems collects, uses, stores, and protects information in connection with our website, sales process, and the custom systems we build and license to clients.

This is a plain-language draft for prospective clients. The legally binding privacy and data-processing terms are in the executed agreement and any data-processing addendum between us.

Sales and marketing data: when you contact us through the website, email, or a calendar link, we collect your name, email address, company name, phone number, and whatever else you choose to share. We use this only to respond to you and manage the sales relationship.

Client operational data: when you use the system we build for you, the business records, files, and workflow data you enter are stored in the environment you control (typically your own Supabase or cloud project). We may have limited access during implementation, support, or troubleshooting.

Usage data: our website and hosting environment may collect standard technical data such as IP address, browser type, pages visited, and error logs, through hosting logs or analytics tools.

Sales data is used to communicate with you, scope work, send quotes, and manage the client relationship.

Client operational data is used solely to deliver the system, provide support, and perform maintenance or improvements you request.

We do not sell your data for money. We do share website activity with Meta through the Meta pixel so we can measure our advertising and show ads to people who have visited this site — under some US state privacy laws that counts as 'sharing' for targeted advertising, and you can opt out at any time (see Cookies & advertising below).

We do not use client operational data to train AI models, for advertising, or for any marketing purpose.

We may use aggregated, de-identified usage patterns to improve our products and services.

By default, the system runs in a cloud project you control. You are the data controller for your business data in that environment, and you choose your own hosting region, backup policy, and access controls.

If you opt for managed hosting, Aplo may use cloud infrastructure providers such as Supabase, Vercel, or AWS. We choose providers with reasonable security practices, and regulated workloads are only hosted under a signed compliance addendum.

We follow reasonable development and operational security practices, including access controls, encrypted data in transit, encrypted data at rest where supported by the hosting provider, and limited staff access.

When the system runs in your account, you are responsible for securing that account, managing user credentials, enforcing access controls, and configuring encryption and backups.

No system is perfectly secure. If we discover a security incident affecting data we control, we will notify you promptly and take reasonable steps to mitigate it.

Sales and marketing data is retained for as long as reasonably necessary to manage the relationship, comply with legal obligations, and resolve disputes.

Client operational data is retained according to the hosting arrangement. If the system runs in your account, retention is under your control. If we host it, we retain data for the duration of the subscription and delete or return it within a commercially reasonable time after termination.

Our website uses first-party analytics to understand which pages, links, and buttons visitors use. We record a randomly generated session identifier stored in your browser, the pages you view, and the elements you click.

We also use the Meta pixel (Facebook and Instagram advertising). It sets Meta cookies and sends Meta information about your visit — such as the pages you view, your IP address, and browser details — so we can measure how our ads perform and show ads to people who have visited this site. Under US state privacy laws this is 'sharing' or 'targeted advertising'; Meta acts as a separate business for this data under its own data policy. We do not receive money for it.

Strictly necessary storage — for example, the state needed to submit a form — is always active because the site cannot work without it. This site is aimed at US visitors, so analytics and the Meta pixel are on by default and the notice on your first visit is a notice with an opt-out, not a gate.

You can opt out at any time using 'Opt out' in the notice or the 'Privacy choices' link in the site footer. Opting out deletes the session identifier from your browser, stops further analytics collection, and revokes the Meta pixel's consent so no further pixel events are sent.

We honour the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as an opt-out automatically, before anything is loaded, and no analytics or pixel data is collected.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the following bases: your consent (optional analytics and marketing email), performance of a contract (delivering and supporting the system we build for you), our legitimate interests (responding to inquiries, securing our systems, preventing abuse), and compliance with legal obligations.

Where we process client operational data on your behalf, you are the data controller and we act as a data processor under your instructions. We will enter into a data-processing addendum on request, including standard contractual clauses for international transfers where required.

Data may be processed in the United States by us or our hosting subprocessors. Where required, we rely on appropriate safeguards such as the EU standard contractual clauses.

You may request access to, correction of, or deletion of your personal data; a portable copy of it; restriction of or objection to processing; and withdrawal of consent at any time. Withdrawing consent does not affect processing already carried out.

To exercise a right, email hello@aplosystems.co. We will verify your request and respond within 30 days (extendable where the law permits). We will not discriminate against you for exercising a right.

For operational data hosted in your account, you can export, correct, or delete it directly through the system. If we host it, we will help you export or delete it on request.

If you believe we have handled your data improperly, you may lodge a complaint with your local supervisory authority.

In the past 12 months we have collected the following categories of personal information: identifiers (name, email address, phone number, IP address), commercial information (inquiries and services requested), internet or network activity (pages viewed, links clicked), and professional information (company and role). We collect it from you directly and from your use of our website, and we use it for the business purposes described above.

We do not sell personal information for money. We do share internet and network activity and device identifiers with Meta through the Meta pixel for cross-context behavioral advertising (targeted advertising), as described in Cookies & advertising above. We do not knowingly collect personal information from anyone under 16.

You can opt out of this sharing at any time using 'Opt out' in the site notice or the 'Privacy choices' link in the footer. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out request.

Residents of California, Virginia, Colorado, Connecticut, and other states with comparable laws have the right to know, delete, and correct personal information, the right to opt out of sale or sharing for targeted advertising, the right to limit the use of sensitive personal information (which we do not collect for such uses), the right to appeal a denied request, and the right to be free from retaliation for exercising these rights.

To exercise a right, email hello@aplosystems.co with the subject line 'Privacy Request'. You may use an authorized agent with written permission. We will verify your identity using information already in our records before responding.

We disclose personal information to service providers (hosting, email delivery, scheduling) under written contracts limiting their use of it to providing services to us.

Our website and services are intended for businesses. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, email us and we will delete it.

We may update this policy. Material changes will be reflected by a new effective date on this page, and where required we will obtain fresh consent.

If you have questions about this Privacy Policy, want a data-processing addendum, or wish to exercise a privacy right, contact us at hello@aplosystems.co. Aplo Systems acts as the data controller for the sales and website data described in this policy.