Privacy policy · Apex Reach

Who we are

Apex Reach is a results dashboard run by Apex Agency (ABN 78 485 026 863), a marketing agency on the Gold Coast, Queensland. It shows the trades and service businesses we work with (our clients) which marketing brought in enquiries, which of those enquiries became booked jobs, and what those jobs earned.

In this policy, "we" and "us" means Apex Agency. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Whose information we handle

People who use the dashboard: staff of our client businesses, and the Apex team.
People who contact our clients: customers and potential customers who send an enquiry through a client's website, or whose job is recorded in the client's job management system (ServiceM8).

For the second group, we act on behalf of the client business you contacted. That business decides why your details are collected, and its own privacy policy also applies. We only use your details to provide this service to that business.

What we collect

Dashboard users

Your email address, and your name if it is given to us.
Which business you can see and your role there.
When you were invited and when you last signed in.
Ratings you give to enquiries and your answers to suggestions from Apex.

People who send an enquiry through a client's website

What you enter in the form, such as your name, phone number, email, suburb, the service you need and your message.
How you found the website: the page you landed on, the site that referred you, campaign tags in the web address (UTM tags), and advertising click IDs from Google or Meta (gclid, gbraid, wbraid, fbclid).
A random visitor ID stored in a cookie called apx_reach on the client's website for 90 days, so a later enquiry can be linked to how you first found the business.
A scrambled (one-way hashed) version of your internet address and your browser type, used only to spot spam and abuse. We do not store your internet address itself.

We do not collect passwords, payment card details or bank details, and the form script skips any field that looks like one.

Job records from ServiceM8

When a client connects ServiceM8, we read (and never change) their jobs, job contacts, customer details and payments. That can include a customer's name, phone number, email, address or suburb, the job status, and invoiced and paid amounts.

How we use it

To show each client how many enquiries came in, where they came from, which became booked or paid jobs, and what the marketing cost.
To match an enquiry to the job it became, using a reference number, phone number, email, or name and suburb.
To merge repeat enquiries from the same phone number within 7 days, and to flag spam.
To sign people in to the dashboard and decide what each person can see.
To improve the marketing Apex runs for that client.

We do not sell personal information, and we do not use one client's customer information for another client. We do not currently send customer details to advertising platforms. If that changes, it will only be with the client's agreement, using scrambled (hashed) contact details, and we will update this policy first.

Who can see it

People at a client business only see that business's information.
The Apex team can see every client's information so we can run and support their marketing.
The services that run Reach for us, which store or process information on our behalf: Supabase (database and sign-in), Vercel (hosting), Resend (sign-in emails), ServiceM8 (the job records a client chooses to connect) and Google (web fonts used by the dashboard).

We may also share information if the law requires it.

Where it is stored

The Reach database is hosted in Sydney, Australia. Some of the services above process information overseas, mainly in the United States: Vercel runs the dashboard's servers there, Resend sends sign-in emails from there, and Google serves the fonts. We choose providers that protect information to a standard similar to the Australian Privacy Principles.

How we protect it

All connections are encrypted.
The database enforces who can see which business, on every request.
Access to connected systems such as ServiceM8 is read-only, and the access keys are kept in an encrypted vault.
Dashboard sign-in uses one-time email links, so there are no passwords to steal or reuse.

How long we keep it

We keep information while the business is an Apex client and Reach is part of our work for them. When a client stops using Reach, we delete their information within 90 days unless the law requires us to keep it longer. A client can ask us to delete an individual customer's details at any time.

Cookies and similar storage

apx_reach, on client websites: remembers how a visitor found the site, for 90 days.
Sign-in cookies on the dashboard: keep you signed in.
reach_client, on the dashboard for the Apex team: remembers which business was last opened.
Your browser also remembers whether you chose the light or dark theme.

Client websites may use other tools, such as Google Analytics, under their own privacy policies.

Your choices and rights

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. If you contacted one of our clients, you can also ask that business directly. You can block or clear cookies in your browser; enquiries you send will still reach the business.

To ask, or to make a complaint, email dylan@apexagency.com.au. We will reply within 30 days. If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will update this page when the way we handle information changes. The date at the top shows when it last changed.