Privacy Policy

Effective Date: 7 May 2026 Last Updated: 7 May 2026 Version: v1.1

What changed in v1.1: added explicit Audio Capture & Processing section (Section 1.4) clarifying that Deepgram and Anthropic in the desktop app run on API keys you supply (you are the data controller for those flows, not AP Leads); split the sub-processor list into "Current sub-processors" (Section 3.1) and "User-configured services" (Section 3.2); strengthened two-party-consent operator-responsibility language (Section 9); added Hardware Fingerprint Disclosure (Section 1.5); updated the canonical Sub-processor URL to /sub-processors; added Export Control Acknowledgment (Section 12); added Data Breach Notification Commitment (Section 13). These changes are required by our Apple notarization compliance review and existing customers were re-notified by email on the effective date.

This Privacy Policy explains how APLeads Ltd ("we", "us", "our"), a company registered in England and Wales (company number 16178226), collects, uses, shares, and protects personal data when you use the AP Sales Coach desktop application (the "App"), the apsalescoach.com website (the "Site"), and any related services (the "Service").

We are the data controller of personal data we collect about you as our customer.

If you are using the App to capture audio and process it, you are the data controller of any personal data contained in that audio (including the personal data of third parties whose voice may be captured). We act as a data processor on your behalf for the limited purpose of providing the App's transcription and routing functions. See Section 9.

1. Information we collect

We collect the minimum data necessary to provide the Service. Specifically:

1.1. Information you provide directly

• Email address — when you sign up via magic-link authentication.
• Payment information — collected and stored by Stripe; we receive only payment metadata (e.g. last four digits, billing country, subscription status).
• Support communications — when you contact us via support@apsalescoach.com or in-app feedback.
• Affiliate application data — if you apply for our affiliate program: name, payment details, audience information you choose to share.

1.2. Information collected automatically

• Hardware fingerprint — a one-way SHA-256 hash derived from your Mac's IOPlatformUUID, model, and CPU brand. Used solely to enforce the one-device-per-account license rule. We cannot reverse-engineer this hash to identify your hardware. See Section 1.5 for the full disclosure.
• Device label — your Mac's "Computer Name" (e.g. "Alix's MacBook Pro"). Used to display the bound device in the license-management UI.
• Subscription and license metadata — your tier, billing status, founding-member flag, current subscription period, license bound device.
• Usage events — when you sign in, start a call, complete a call, click upgrade, etc. Used for analytics. We do not capture the content of calls or scripts.
• App version, OS version, error reports — captured only by the desktop app, not by this website. The marketing website ships zero error-tracking telemetry. Desktop crash reports use Sentry with a 5-layer redaction pipeline (emails, phone numbers, IP addresses, form inputs, JWT tokens, Stripe IDs, request bodies, and stack-frame variables are all stripped before any event leaves your Mac).
• IP-derived country — captured at the edge function level for geographic analytics. We do not store full IP addresses.
• Cookies and similar technologies — see Section 7.

1.3. Information we do NOT collect

We do not collect, store, or process:

• Audio recordings. Your microphone audio is streamed directly from your Mac to Deepgram (using your Deepgram API key) and is not retained by AP Leads at any point. We never receive, route, store, or replay audio.
• Transcripts. Transcripts are generated by Deepgram (under your account) and shown to you in the App. Transcripts are stored only on your local device. They never reach AP Leads servers.
• Script content. Your script tree (the prompts you write) is stored on your local device only.
• Call history. Per-call metadata (timestamps, dispositions) is stored on your local device only.
• The content of calls you make. We have no visibility into who you called, what was said, or what happened on the call.

1.4. Audio capture and processing — your API keys, your data flows

When you operate AP Sales Coach during a live call, the desktop application captures audio from your Mac's microphone and (if enabled) system audio output to transcribe what is said. The transcription and AI matching of that audio happen via API keys YOU supply in the app's Settings panel:

• Deepgram — used for real-time speech-to-text. You provide your own Deepgram API key.
• Anthropic — used for matching your prospect's last utterance to the next script node. You provide your own Anthropic API key.

Audio and transcript data flow directly from your Mac to Deepgram and Anthropic under YOUR account credentials. AP Leads Ltd does not see, route, or store any of that traffic. We are not the data controller for these flows — you are. We strongly recommend you review Deepgram's and Anthropic's privacy practices directly when configuring your keys, including any retention or training-data settings on your accounts.

The desktop app's "AI generate script" feature (inside the app) also uses your Anthropic key — the same key you configured for live matching.

The one exception is the website-only Script Builder. When you use the Script Builder at apsalescoach.com/tools/script-builder to convert prose into a script JSON tree, that one feature runs server-side using AP Leads' own Anthropic API key. For that single web-only flow, AP Leads is the data controller and Anthropic is our sub-processor. The desktop app does not use this server-side path.

No raw audio is persisted to AP Sales Coach servers, ever. All transcript text remains local on your Mac in your ~/Library/Application Support/AP Sales Coach/sessions/ folder. We sync only aggregate metrics (call duration, dispositions, match counts) to our servers — never the words spoken.

1.5. License binding via hardware fingerprint

To prevent license sharing between users (a single subscription being used on multiple Macs by different people), AP Sales Coach generates a hardware fingerprint when you activate your license. The fingerprint is composed of stable hardware attributes such as your motherboard UUID and CPU brand string, hashed via SHA-256 before it leaves your machine.

The fingerprint is used solely to bind your purchased license to a single Mac. It is never used for advertising, analytics, cross-application tracking, user profiling, or any purpose other than license enforcement.

You can transfer your license between Macs using the in-app Settings → Subscription → Transfer License feature, which rotates the binding. The fingerprint is not a permanent device identifier in the privacy-tracking sense — it is reset whenever you transfer your license.

By purchasing or activating an AP Sales Coach subscription you consent to this binding. The consent is captured at signup via the Hardware fingerprint binding checkbox on the founding and standard signup forms, and the version of consent you agreed to is logged in our audit trail.

2. How we use your data

We use your personal data only for the following purposes:

We do not use your personal data for automated decision-making with legal or similarly significant effects, and we do not sell your personal data.

3. Data sharing and sub-processors

We share personal data only with carefully selected sub-processors who help us operate the Service. Each sub-processor has signed a data-processing agreement requiring them to handle your data securely and only for the purposes we authorise.

3.1. Current sub-processors

These are services AP Leads Ltd uses on your behalf, where AP Leads is the data controller and the listed company is our processor. The full canonical list — with transfer safeguards and DPA references — is published at apsalescoach.com/sub-processors. We notify you in advance of any new sub-processor that materially changes how your data is handled.

3.2. User-configured services (you are the data controller)

These are services accessed via API keys you supply in the app's Settings panel. AP Leads Ltd is not the data controller for these flows; you are. AP Leads has no DPA covering these flows because we are not a party to them. Review each provider's own privacy practices directly:

If you stop using AP Sales Coach, your data with Deepgram and Anthropic remains with those providers under your account — we cannot delete it on your behalf because we never had access to it. To revoke their processing of your data, log into your Deepgram and Anthropic accounts directly.

3.3. International transfers

Some of our sub-processors are based outside the UK and EU (notably the United States). When we transfer personal data internationally we rely on:

• The European Commission's adequacy decisions (where applicable);
• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office;
• Sub-processor self-certification under the UK-US and EU-US Data Privacy Frameworks where the sub-processor is certified.

You can request copies of our SCCs and other transfer mechanisms by emailing privacy@apsalescoach.com.

3.4. Other disclosures

We may disclose personal data:

• To comply with law — court orders, subpoenas, lawful government requests, regulatory investigations.
• To protect rights and safety — where we have a good-faith belief that disclosure is necessary to protect our rights, your safety, or the safety of others.
• In connection with a corporate transaction — merger, acquisition, sale of assets, or due diligence (with appropriate confidentiality protections).

We do not sell, rent, or share personal data with third parties for advertising purposes.

4. Data retention

We retain personal data for only as long as needed for the purposes described in this Policy, plus any period required by law.

You may request deletion of your account at any time via Section 5.

5. Your rights (UK GDPR / EU GDPR)

If you are in the UK, EU, or EEA, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data (the "right to be forgotten"), subject to our legal obligations to retain certain records (e.g. accounting).
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — request a machine-readable copy of the data you provided to us.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where we rely on consent (e.g. marketing emails), you may withdraw it at any time.
• Complaint — lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local data-protection supervisory authority.

To exercise any of these rights, email privacy@apsalescoach.com. We will respond within one calendar month.

If you are in California, Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive privacy statute, you may have similar rights — contact us at the same address.

6. Security

We take reasonable technical and organisational measures to protect personal data:

• Encryption in transit — all data exchanged between the App, Site, and our servers uses TLS 1.2 or higher.
• Encryption at rest — data stored in Supabase is encrypted at rest. API keys you store in the App are encrypted using your macOS Keychain (safeStorage).
• Access control — only authorised personnel have access to production data, and access is logged.
• Sub-processor due diligence — we vet sub-processors for security posture and compliance.
• Incident response — we maintain procedures to detect, contain, and notify you of any personal-data breach as required by UK GDPR (typically within 72 hours of becoming aware). See Section 13 for the full commitment.

No system is perfectly secure. We cannot guarantee absolute security but we work hard to protect your data and to comply with our legal obligations.

7. Cookies and similar technologies

The Site uses minimal cookies. Specifically:

• Plausible Analytics — privacy-first analytics that does not use cookies, does not collect personal data, and does not require a cookie consent banner under UK and EU rules.
• Stripe Checkout — Stripe sets cookies on its hosted checkout pages for fraud prevention and session management. These are essential to processing your payment.
• Authentication cookies — when you sign in via the Site, Supabase sets a session cookie to keep you logged in.
• Affiliate referral cookies — when you visit a /r/<code> URL, we set a cookie (ap_ref, 60-day expiry) to attribute your subsequent signup to the referrer/affiliate.

The App itself does not use browser cookies.

For full details and our cookie banner choices, see our Cookie Policy at apsalescoach.com/legal/cookies.

8. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@apsalescoach.com and we will delete it.

9. Audio, transcripts, and your role as data controller

This section is critical. Read it carefully.

9.1. We are a tool provider

The App captures audio from your Mac's microphone and (with your own API keys) sends it directly to Deepgram for real-time transcription, then to Anthropic's language model to route prospect utterances to your pre-written script nodes. We do not generate, monitor, store, route, or otherwise control any of that audio or transcript traffic. Those flows are between your Mac and the Deepgram and Anthropic accounts you configured.

9.2. You are the data controller

In the legal sense of UK GDPR and EU GDPR, when you use the App to capture audio that includes the personal data of a third party (for example, a sales prospect's voice), you are the data controller of that personal data. We are merely a tool you use, and a data processor acting on your instructions for the limited purpose of transcription and routing.

9.3. Your responsibility for call consent

AP Sales Coach is a tool you operate during your own outbound calls. You are one party to those calls. The other party — the prospect on the other end of the line — is not a user of our software.

Many jurisdictions require all parties to a phone call to consent to it being recorded or transcribed. You are solely responsible for ensuring that any consent required by the law of your jurisdiction (and the prospect's jurisdiction) has been obtained before initiating a call coached by AP Sales Coach.

The most common two-party-consent jurisdictions in the United States include: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, Vermont, and Washington. The United Kingdom and most EU member states have nuanced rules under PECR/GDPR. AP Sales Coach is not a substitute for legal advice — when in doubt, consult a lawyer or recorded-call disclosure script for your jurisdiction.

The desktop application requires you to acknowledge this responsibility on first launch and to declare your primary jurisdiction. This acknowledgment is logged with timestamp, IP, and user-agent in our audit trail (audit_log action: recording_consent_acknowledged).

9.4. Specific obligations

You must, at your sole responsibility:

• Determine the lawful basis under which you are capturing third-party voice data;
• Obtain all consents required by the law of your jurisdiction and of the jurisdiction of any third party whose voice is captured;
• Comply with all applicable telecommunications, wiretap, eavesdropping, and consumer-protection laws;
• Provide privacy notices to data subjects as required;
• Honour data subject rights requests with respect to data captured using the App;
• Maintain appropriate security for any transcript or call recording you choose to store on your local device.

9.5. We disclaim controllership of call content

We do not see, store, or process the substance of your calls. We have no ability to honour data subject rights with respect to call content because we do not hold it. If a third party contacts us seeking access to or deletion of their personal data, we will direct them to you as the responsible data controller.

9.6. Acceptable Use Policy

Section 7 of our Terms of Service and our standalone Acceptable Use Policy (apsalescoach.com/legal/aup) prohibit using the App to violate consent or recording laws. We reserve the right to terminate accounts that breach these provisions.

10. Changes to this Policy

We may update this Policy from time to time. The "Last Updated" date and version number at the top will reflect the most recent revision. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.

Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Contact

For any questions about this Privacy Policy, your personal data, or to exercise your rights:

APLeads Ltd Privacy contact: privacy@apsalescoach.com Support contact: support@apsalescoach.com Registered office: Unit 22 Ensign Business Centre, Westwood Way, Coventry, CV4 8JA Company number: 16178226

You also have the right to lodge a complaint with the UK Information Commissioner's Office: ICO Helpline: 0303 123 1113 ICO Website: ico.org.uk

12. Export control

AP Sales Coach is subject to United States export control law, including the U.S. Export Administration Regulations (EAR). By downloading, installing, or using the application, you certify that:

• You are not located in, under the control of, or a national or resident of any country to which the United States has embargoed goods or services (currently including Cuba, Iran, North Korea, Syria, the Crimea, Donetsk, and Luhansk regions of Ukraine, and certain regions of Russia under current sanctions);
• You are not on the U.S. Treasury Department's list of Specially Designated Nationals or the U.S. Commerce Department's Denied Persons List;
• You will not export, re-export, or otherwise transfer the application to any of the above countries or persons.

We enforce this certification at the network edge: checkout requests originating from embargoed jurisdictions are blocked with HTTP status 451 ("Unavailable For Legal Reasons") before any payment or personal data is processed.

13. Data breach notification

In the event of a personal data breach affecting your data, we will notify you without undue delay, and in any event within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33 and equivalent regulations. Notifications will be sent to the email address on file with details of:

• the nature of the breach (categories of data affected, approximate number of data subjects affected);
• the likely consequences of the breach;
• the steps we have taken or will take in response, including measures to mitigate possible adverse effects; and
• a contact point at AP Sales Coach for further information.

If a breach is severe enough to require notification to the UK Information Commissioner's Office, we will notify the ICO within the same 72-hour window.

This Privacy Policy is governed by the laws of England and Wales.