Privacy Policy

1. Scope

This Privacy Policy applies when AddApex determines the purposes and means of processing personal information, including when you:

• visit an AddApex website;
• create or use an AddApex account;
• interact with us as a customer, prospective customer, supplier or partner;
• communicate with our sales or support teams;
• receive our marketing communications;
• use AddApex features; or
• otherwise interact directly with VMG Digital in connection with AddApex.

Customer-controlled data

Our business customers may submit information or connect services to AddApex.

Where AddApex processes personal information solely on a Customer's instructions, we generally act as a processor or service provider on behalf of that Customer.

In those circumstances:

• the Customer determines why the information is processed;
• the Customer's privacy notice governs its relationship with the individuals concerned; and
• our processing may be governed by a Data Processing Addendum.

2. Information We Collect

2.1 Account information

We may collect:

• name;
• work email address;
• organisation;
• job title;
• user identifier;
• profile information;
• authentication information;
• workspace memberships;
• account roles; and
• permissions.

2.2 Customer and billing information

We may process:

• company and organisation information;
• billing contacts;
• billing addresses;
• subscription information;
• plan information;
• transaction records;
• invoices;
• payment status; and
• related commercial records.

Payment-card information may be processed directly by our payment provider and may not be stored by AddApex.

2.3 Customer-provided information

Depending on how AddApex is used, Customers may provide:

• advertising creative;
• campaign information;
• advertising-performance information;
• brand information;
• product information;
• competitor information;
• client information;
• images and video;
• documents;
• URLs;
• briefs;
• instructions;
• prompts;
• comments;
• feedback; and
• other business information.

Some of this information may contain personal information.

2.4 Information from integrations

If a Customer connects another service to AddApex, we may receive information made available through that integration according to the permissions granted.

This may include:

• advertising accounts;
• campaigns;
• creative;
• performance metrics;
• account or organisation information; and
• other authorised data.

2.5 Technical and usage information

We may automatically collect:

• IP address;
• browser and device type;
• operating system;
• timestamps;
• approximate location inferred from IP address;
• pages and features used;
• referring pages;
• session information;
• authentication events;
• usage events;
• diagnostic information;
• system logs;
• error information; and
• similar technical data.

2.6 Communications

When you contact us, we may process your contact information and the contents of the communication.

3. Public and Third-Party Advertising Information

A core part of AddApex is analysing advertising and creative activity obtained from public and third-party sources.

We may collect or receive information from:

• publicly accessible websites;
• advertising libraries;
• social and advertising platforms;
• APIs;
• data providers;
• automated data-collection providers;
• customer-authorised integrations; and
• other publicly accessible or commercially available sources.

This information may include:

• advertisements;
• images;
• video;
• advertising copy;
• advertiser and brand names;
• public advertising-page information;
• public page or account identifiers;
• destination URLs;
• calls to action;
• advertising-library identifiers;
• publication dates;
• advertising start and end dates;
• placement and platform information;
• whether an advertisement appears active;
• other advertising metadata; and
• information derived from analysis of those materials.

We use this information primarily to provide:

• creative intelligence;
• competitive advertising analysis;
• historical advertising analysis;
• creative comparisons;
• pattern identification;
• recommendations;
• research; and
• related product functionality.

4. Public Information Relating to Individuals

AddApex focuses on businesses, brands, advertising and creative rather than individual consumers.

However, advertisements and other public material may sometimes contain information relating to identifiable individuals, including:

• creators;
• actors;
• spokespeople;
• founders;
• business owners;
• employees; or
• other people appearing in advertising.

Where such information is personal information under applicable law, we process it in accordance with this Privacy Policy.

We do not intentionally use public advertising-library data to create sensitive consumer profiles or make decisions concerning individual consumers.

5. How We Use Information

We may use personal information for the following purposes.

Providing AddApex

Including to:

• create and manage accounts;
• authenticate users;
• operate organisations and workspaces;
• provide requested features;
• retrieve advertising information;
• organise and analyse creative;
• analyse campaign and performance information;
• generate recommendations and briefs;
• provide integrations;
• maintain account history; and
• respond to user requests.

Operating and improving the Service

Including to:

• diagnose technical issues;
• monitor reliability;
• understand feature usage;
• improve workflows;
• evaluate analysis quality;
• develop new features;
• improve recommendations;
• conduct internal research; and
• protect the security and integrity of AddApex.

Artificial intelligence

AddApex uses artificial-intelligence technologies to analyse information and create Outputs.

Information submitted to AddApex may therefore be processed by external AI infrastructure providers acting on our behalf or otherwise under commercial terms applicable to those services.

We do not intentionally use confidential Customer creative, confidential campaign-performance data or other confidential Customer Data to train general-purpose models made available to unrelated AddApex customers unless the Customer expressly agrees otherwise.

Where our commercial relationship with an AI provider permits us to prohibit provider training on Customer content, we use configurations or terms intended to prevent such training.

Communications

We may use contact information to:

• provide account and transactional messages;
• send product announcements;
• answer support requests;
• send educational content;
• communicate with prospective customers;
• send marketing emails; and
• communicate security or legal notices.

You may unsubscribe from non-essential marketing communications.

Security

We may use information to:

• authenticate users;
• detect suspicious activity;
• prevent fraud and abuse;
• investigate incidents;
• maintain logs; and
• enforce our agreements.

Legal purposes

We may process information to:

• comply with legal obligations;
• respond to lawful requests;
• establish, exercise or defend legal claims;
• enforce contracts; and
• protect the rights, property and safety of VMG Digital, our users and others.

6. Legal Bases

The legal basis applicable to a particular activity depends on your location and the context.

New Zealand

We process personal information in accordance with the Privacy Act 2020 and applicable information privacy principles.

EEA and United Kingdom

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:

Contract: where processing is necessary to provide requested services.

Legitimate interests: where processing is reasonably necessary for legitimate business purposes, including:

• operating a B2B creative-intelligence platform;
• analysing publicly available commercial advertising activity;
• improving AddApex;
• securing the Service;
• providing customer support; and
• developing our business.

When relying on legitimate interests, we consider the nature of the information, individuals' reasonable expectations, potential impact and available safeguards.

Consent: where consent is required, including for certain cookies or marketing activities.

Legal obligation: where processing is necessary to comply with applicable law.

Other applicable privacy laws may provide equivalent or additional bases.

7. Public and Third-Party Data Retention

Advertising history is an important part of AddApex functionality.

We may therefore retain publicly available or Third-Party advertising information indefinitely, including information concerning advertisements that later stop running or disappear from the originating platform.

We may use historical information for:

• longitudinal analysis;
• comparisons;
• research;
• evidence and provenance;
• identifying advertising trends;
• product functionality; and
• improving AddApex.

Where retained material includes personal information, applicable privacy rights continue to apply.

We may remove, restrict or suppress material in response to a valid legal, privacy or rights request.

8. Customer Data Retention and Deletion

We retain Customer Data for as long as reasonably necessary to provide the Service and fulfil the purposes described in this Policy.

Customers may request deletion of Customer Data or personal information by contacting:

legal@vmgdigital.com

We will process verified requests in accordance with applicable law.

Deletion may not immediately remove every copy from:

• backups;
• security logs;
• fraud-prevention records;
• accounting records; or
• systems where temporary retention is technically necessary.

Such residual copies are retained only for appropriate operational, security or legal purposes and are removed or overwritten in the ordinary operation of those systems.

We may retain information where required to:

• comply with law;
• resolve disputes;
• enforce agreements;
• maintain financial records;
• prevent fraud; or
• establish or defend legal claims.

Deletion of Customer-provided data does not necessarily require deletion of independently obtained public information concerning the same brand, company or advertisement.

9. Artificial Intelligence and Model Training

AddApex may process Customer Data and Third-Party Data using external AI systems.

Our default policy is that Customer's confidential creative and confidential advertising-performance information is used to provide and improve the Customer's AddApex experience, not to train a general-purpose model for unrelated customers.

We may use:

• de-identified information;
• aggregated information;
• evaluations;
• usage statistics;
• system-performance information; and
• feedback

to improve AddApex, provided doing so does not reasonably disclose Customer's confidential information or identify an individual.

10. Aggregated and De-identified Data

We may create aggregated or de-identified information that does not reasonably identify an individual, Customer or specific Customer client.

We may use such information for:

• product analytics;
• benchmarking;
• industry analysis;
• research;
• creative trend analysis;
• model evaluation;
• product improvement; and
• development of new products and features.

We may make aggregated insights available to customers or publicly where they do not reasonably reveal identifiable Customer confidential information.

11. How We Share Information

We may disclose information to the following categories of recipients.

Infrastructure and service providers

We use service providers for activities such as:

• cloud hosting;
• databases;
• authentication;
• artificial intelligence;
• automated data collection;
• analytics;
• error monitoring;
• email;
• customer communications;
• payment processing;
• security;
• file storage; and
• other infrastructure.

A current subprocessor list may be maintained separately.

Data providers

To provide creative-intelligence features, we may send search terms, brand names, URLs, identifiers or other requests to providers that retrieve, supply or process public or third-party data.

Customer-authorised integrations

We share information with external services when a Customer directs us to connect to or transmit information to that service.

Your organisation

Information in a workspace may be accessible to authorised members and administrators of that organisation.

Professional advisers

We may disclose information to lawyers, auditors, accountants, insurers and other professional advisers.

Business transactions

Information may be disclosed as part of financing, due diligence, merger, acquisition, restructuring, asset sale or similar corporate transaction.

Legal and safety purposes

We may disclose information where reasonably necessary to:

• comply with law or legal process;
• enforce our agreements;
• investigate fraud or abuse;
• protect our rights; or
• protect the security or safety of AddApex, users or others.

12. We Do Not Sell Customer Lists

We do not sell customer or prospect contact lists.

We do not provide Customer contact information to unrelated third parties for those third parties to independently market their products to you.

We may use service providers to send our own marketing communications on our behalf.

13. Analytics, Cookies and Similar Technologies

We may use cookies, local storage, pixels and similar technologies for:

• authentication;
• maintaining sessions;
• security;
• saving preferences;
• understanding product usage;
• product analytics;
• measuring website performance;
• error monitoring;
• attribution; and
• improving AddApex.

We may use product analytics and similar service providers for these purposes.

We may also use commonly available analytics or attribution tools in the future, provided they are used consistently with this Privacy Policy and applicable consent requirements.

Where required by law, non-essential analytics, advertising or marketing technologies will be activated only after appropriate consent.

We may provide cookie controls or a consent-management mechanism where required.

14. Marketing

We may send business-to-business marketing communications concerning:

• AddApex;
• new features;
• creative-intelligence research;
• educational materials;
• events;
• offers; and
• related VMG Digital services.

You can opt out of marketing emails using the unsubscribe link in the message or by contacting us.

Opting out of marketing does not prevent us from sending necessary account, security, billing or transactional communications.

15. International Processing

VMG Digital is based in New Zealand, while AddApex infrastructure and service providers may process information in other countries.

Our primary application infrastructure may include systems hosted in Sydney, Australia.

Other service providers may process information in Australia, New Zealand, the United States, Europe or other jurisdictions.

Where required by applicable law, we use appropriate safeguards for international transfers or disclosures.

These may include:

• contractual protections;
• standard contractual clauses;
• data-processing agreements;
• adequacy mechanisms;
• contractual commitments to comparable safeguards; and
• other lawful transfer mechanisms.

16. New Zealand Overseas Disclosures

Where the New Zealand Privacy Act 2020 applies to a qualifying disclosure of personal information outside New Zealand, we take reasonable steps to ensure that the recipient is subject to appropriate privacy protections or that another permitted basis for the disclosure applies.

17. Security

We maintain reasonable technical and organisational measures designed to protect information against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• destruction; and
• unauthorised disclosure.

Measures may include:

• authentication;
• access controls;
• tenant and organisation separation;
• database access policies;
• encryption;
• logging;
• backups;
• infrastructure security; and
• administrative controls.

No system can guarantee absolute security.

18. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• request access to personal information;
• request correction;
• request deletion;
• object to certain processing;
• request restriction of processing;
• obtain certain information in portable form;
• withdraw consent;
• opt out of marketing;
• opt out of certain forms of targeted advertising or profiling;
• appeal certain decisions; and
• complain to a privacy regulator.

These rights may be subject to legal exceptions.

To exercise a right, contact:

legal@vmgdigital.com

We may request information reasonably necessary to verify your identity and request.

19. Customer-Controlled Personal Information

If your request concerns information that AddApex processes solely on behalf of one of our Customers, you should generally contact that Customer directly.

Where legally required, we will assist Customers with valid requests relating to information processed on their behalf.

20. Requests Concerning Public Advertising Information

If publicly sourced material concerning you appears within AddApex and you believe it should be corrected, removed or restricted, contact:

legal@vmgdigital.com

Please include, where possible:

• your name;
• the relevant advertisement, URL or identifier;
• enough information for us to identify the material;
• the nature of your concern; and
• any information reasonably necessary to verify the request.

Depending on the circumstances, we may:

• correct information;
• remove it;
• suppress it from results;
• restrict further processing; or
• decline the request where we have a lawful basis to retain the information.

Removal from AddApex does not remove information from the original third-party source.

21. EEA and UK Rights

Where the GDPR or UK GDPR applies, individuals may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent; and
• lodging a complaint with a supervisory authority.

Where we rely on legitimate interests to process publicly available advertising information, you may object to that processing based on circumstances relating to you.

22. New Zealand Rights

Individuals covered by the New Zealand Privacy Act 2020 may have rights including access to and correction of personal information held about them.

You may also make a complaint to the New Zealand Office of the Privacy Commissioner.

23. Australia

Where Australian privacy law applies, individuals may contact us to request access to or correction of personal information and to raise privacy concerns.

Where required, complaints will be handled in accordance with applicable Australian privacy obligations.

24. United States Privacy Rights

Residents of certain U.S. states may have additional privacy rights, which can include rights to:

• know what personal information is processed;
• access information;
• correct information;
• delete information;
• receive certain information in portable form;
• opt out of sale;
• opt out of certain sharing;
• opt out of targeted advertising;
• opt out of qualifying profiling; and
• appeal certain privacy decisions.

AddApex does not sell customer or prospect contact lists.

If future advertising or analytics practices constitute "sale", "sharing" or "targeted advertising" under an applicable state law, we will provide any controls required by that law.

25. Children

AddApex is a B2B service and is not directed to children.

Users must be at least 18 years old.

We do not knowingly provide AddApex accounts to children.

If you believe a child has provided personal information directly to AddApex, contact legal@vmgdigital.com.

26. Automated Decisions

AddApex uses automated systems and artificial intelligence to analyse advertising and business information.

The Service is not intended to make decisions producing legal or similarly significant effects concerning individual consumers.

27. Business Transfers

If AddApex or VMG Digital is involved in a merger, acquisition, restructuring, financing or sale of assets, information may be transferred as part of that transaction subject to applicable privacy law.

28. Changes to This Privacy Policy

We may update this Privacy Policy as AddApex evolves.

We will update the effective date when changes are made.

Where a change materially affects how personal information is processed, we will provide additional notice where required.

29. Contact

For privacy questions, rights requests or complaints: