Privacy Policy

1. Scope

This Policy governs personal information handled in operating the Website, legislative-report subscriptions, custom alerts, impact memoranda, customer support, marketing, and public-accountability reporting. Stripe operates its own services under its own policies. This Policy does not authorize a subscriber to use reports for employment, credit, insurance, housing, or other personal-eligibility decisions. The company is based in Florida and has no employees, contractors, affiliates, or other place of business outside Florida.

2. Information and sources

When you use the Contact form, Seller collects your name, email address, organization, plan interest or inquiry type, an optional note, the time of submission, the IP address supplied by Cloudflare, and the user-agent string (truncated to 300 characters). Those records are stored in Seller's Cloudflare D1 database. Email addresses are unique in that database.

When you start checkout, the Website sends only the selected plan and billing interval to Seller's systems. Payment is completed on Stripe-hosted Checkout. Stripe collects at least your email address and payment method, and may collect a billing address if Stripe requires it. After payment, the confirmation page may send the Checkout session identifier to Seller's systems solely so Seller can open Stripe's customer billing portal for that customer. Seller does not write Stripe customer, card, or subscription records into its own database.

Card data never enters Seller's systems. Checkout is created by Seller's website and completed on Stripe-hosted Checkout. Seller stores a Stripe secret as a protected Worker secret in order to create checkout and billing-portal sessions, and does not store payment methods. The site does not load a card form or Stripe's browser payment library on Seller's pages.

Editorial research uses legislative records obtained through the LegiScan public API and other primary public records, including bill text, staff analyses or fiscal notes, statutes, disclosure filings, corporate records, campaign-finance records, official proceedings, and audits. Secondary sources are used only when no primary record exists, and are disclosed as such. No purchased personal-data service is used. Reports may identify officials, businesses, and, only when the person appears in a public official filing tied to the bill, a relevant adult family-member relationship. Seller shall distinguish a filed statement from an independently established fact, verify identities, and limit personal details to matters with a documented public-interest connection. Reports shall not include minors and shall not publish a private person's home address. Official district or office addresses are used for legislators.

3. Purposes

Seller uses information to establish and secure access, deliver the selected reports and alerts, process and reconcile subscription charges, calculate applicable taxes, record consent, provide renewal notices, process cancellations and refunds, answer inquiries, investigate misuse, maintain publication provenance, correct errors, and comply with legal obligations. Marketing communications shall be separately identified and shall honor applicable opt-out rights. Seller does not use personal information for automated profiling or personalized advertising, and does not use it for other purposes beyond those stated in this Policy.

4. Recipients and disclosures

Stripe receives the information needed to process payments, manage subscriptions, and operate the customer billing portal.

Seller may disclose information to the following service providers, and only for the authorized purposes described here:

• Cloudflare, which hosts the Website, stores Contact-form records in a D1 database, and provides observability, traces, and Network Error Logging. Cloudflare processes data on its edge network; no single region is pinned. Signup fields described above are stored in D1 and may appear in traces or logs as configured.
• Stripe, which provides hosted checkout, customer, subscription, and billing-portal services and card processing, as described above.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which may see the visitor's IP address and referring page when fonts are loaded. Seller does not use Google Fonts to set advertising cookies.
• Google Gmail, which hosts the company's operating mailbox at american.apex.associates@gmail.com and therefore processes support, legal-notice, and (when sent) outreach email.
• LegiScan, which supplies public legislative bill data used in reporting. Customer account data is not sent to LegiScan.

Reports may be drafted with the assistance of artificial-intelligence tools operated for the company. Those tools process the research materials and draft text needed to prepare a report. Their processing locations and contract terms were not independently documented in the company's files when this Policy took effect.

Seller shall not disclose a private subscriber list to a sponsor or other subscriber without a lawful basis and appropriate notice.

Editorial publication discloses the verified, relevant information contained in the published report, including through authorized white-label recipients. Seller may disclose information as required by valid legal process, to protect lawful rights or safety, or as part of a legally permitted business transfer with applicable safeguards. Seller does not sell personal information, share it for cross-context advertising, share it with affiliates for their marketing, or provide it to data brokers.

5. Cookies, analytics, and external services

The Website does not set first-party cookies and does not use an analytics package, advertising pixels, email-open or click-tracking, iframes, or third-party embeds other than Google Fonts. Site scripts do not use document cookies, localStorage, or sessionStorage. When you subscribe, the browser leaves the Website for Stripe-hosted Checkout at checkout.stripe.com, which is Stripe's page and is subject to Stripe's cookies and policies, not Seller's. Visiting a link to an external public record subjects the visit to that operator's practices.

Seller does not currently read or honor browser privacy signals such as Global Privacy Control or Do Not Track. Privacy requests may be made by email as described in this Policy.

6. Retention and security

Seller shall restrict access by role, use reasonable administrative and technical safeguards, and securely dispose of personal information when no longer retained. No system is guaranteed secure.

Retention:

• Contact-form records and billing records are kept for the life of the relationship plus seven years, then deleted.
• Server logs are kept for 90 days.
• Stripe retains payment records under Stripe's own rules.
• Support correspondence is retained as needed to handle the inquiry and, when it is part of a customer relationship, for the same period as contact-form records.
• Marketing suppression records are retained as long as needed to honor an unsubscribe request.
• Editorial source materials are retained as needed to support published reports and corrections.
• After a record is deleted, residual backup copies are removed in the ordinary backup-rotation cycle.

Legal holds and binding legal obligations may require longer retention.

Implemented safeguards include content-security and related security headers; same-origin checks on form, checkout, and billing-portal requests; honeypot fields on the Contact form; request-size and input-length limits and email-format checks; a token-gated administrative read path for form submissions; storage of the Stripe secret and administrative token as Worker secrets rather than in site source; keeping card data on Stripe; and blocking framing of the Website. The company's authorized member owns incident response at american.apex.associates@gmail.com, including when Cloudflare, Stripe, or Google reports a breach. Seller shall assess any suspected incident promptly and provide legally required notices. Florida's reasonable-security and breach-notice law applies according to its terms; Stripe processing does not discharge Seller's own duties.

7. Choices, requests, and editorial corrections

Subscriptions are offered to purchasers in the United States only, beginning with Florida. Other states may be added after tax treatment for those states has been confirmed.

A person may email american.apex.associates@gmail.com to request access, correction, deletion, or other rights available under applicable law, or to question handling of personal information. Seller shall verify requests proportionately, shall not demand unnecessary sensitive identification, and shall apply the rights, exceptions, and response periods required in the requester's jurisdiction. The company, through its authorized member, responds to requests and will provide deletion or a written explanation within 45 days, or sooner if applicable law requires. Appeals may be sent to the same email address and are decided by the company's authorized member. Editorial correction requests shall identify the statement and supporting record and may also be submitted at https://americanapexassociates.com/corrections. A correction request is not a right to purchase suppression or advance editorial review. Lawful public-interest reporting, legal holds, accounting duties, and other applicable exceptions may limit deletion; no blanket exemption from privacy law is asserted.

Commercial emails shall provide a functioning unsubscribe method. An unsubscribe from marketing does not itself cancel a paid subscription or required account notices; subscription cancellation is available at https://americanapexassociates.com/account/billing or by emailing american.apex.associates@gmail.com. Marketing opt-outs shall be honored within the applicable deadline. Outreach email, when sent, is sent from american.apex.associates@gmail.com as American Apex Associates LLC, without open-tracking or click-tracking pixels, and includes the Middleburg mailing address and a working unsubscribe. Suppressed addresses are not re-mailed.

8. Minors and sensitive details

Accounts are offered only to adults age 18 or older. Seller shall not knowingly solicit children's account information or publish minors' identifying details. Research shall exclude unnecessary home addresses, personal telephone numbers, precise location, credentials, financial account numbers, and protected personal details. A family member may be mentioned in a report only when that person appears in a public official filing tied to the bill. Public availability alone shall not establish necessity or permission to republish. Address protections for officials and their families shall be reviewed before any identifying detail is used.

9. Changes

Seller shall post an updated Policy and effective date and provide additional notice or obtain consent when required by law. Materially different uses shall not be justified solely by retroactive replacement of this Policy.