Privacy Policy
Apex US Regulatory Events Feed by Apex. Effective: 4 November 2026
This policy explains what personal data we collect when you buy or use our data Feed, why, who we share it with, how long we keep it, and your rights. It's short because we collect very little.
1. Who is responsible (the "controller")
Apex, trading name of Anas SABBAHI, an individual business in Morocco.
Address: No. 71, Lot Loued Lahmer, Errachidia 52000, Morocco. Email: anassabbahi.tech@gmail.com
CNDP declaration: in preparation
EU representative (GDPR art. 27): none appointed
2. Which laws apply
2.1 Morocco: Law 09-08 and the CNDP
We are established in Morocco, so Law 09-08 on the protection of individuals with regard to the processing of personal data applies to us. It's supervised by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). Law text: https://www.cndp.ma/loi-09-08/
- Declaration: processing customer data has to be notified to the CNDP. CNDP Délibération n° 32-2015 offers a simplified "type declaration" for customer management (contracts, orders, invoicing, customer accounts). It says: "La mise en place d'un traitement ... pour la gestion des clients doit être notifiée à la CNDP au moyen d'une déclaration type." Source: https://www.cndp.ma/wp-content/uploads/2023/01/deliberation-n-32-2015-13-02-2015.pdf (verified 2026-11-04). We have filed / will file this declaration (receipt number in section 1).
- Transfers abroad: the same deliberation (§9) requires every transfer abroad to be notified to the CNDP first. Under Law 09-08 art. 43, transfers go freely only to countries the CNDP lists as adequate. Délibération 236-2015 lists the EU/EEA countries, the UK, Switzerland and Canada. The USA is not on the list. Source: https://www.cndp.ma/wp-content/uploads/2023/12/deliberation-n-236-2015-18-12-2015.pdf (verified). For other countries the CNDP page lists exceptions, including when the transfer is necessary to perform a contract with you, and your express consent. Source: https://www.cndp.ma/notifier-une-demande-de-transfert-a-letranger/ (verified). We rely on contract necessity for PayPal and Cloudflare (section 7) and notify the CNDP. (Lawyer or CNDP to confirm that this exception, not a full authorization, is enough.)
2.2 EU and UK: GDPR
We're outside the EU. But the GDPR also applies to a non-EU business processing data of people in the EU when the processing relates to "the offering of goods or services" to them (GDPR art. 3(2)(a); https://gdpr-info.eu/art-3-gdpr/, official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj). We sell to EU buyers, so we follow the GDPR for their data. The UK GDPR is similar for UK buyers.
- EU representative: GDPR art. 27 requires a non-EU controller under art. 3(2) to appoint an EU representative. The exception is processing that is "occasional", not large-scale special-category data, and "unlikely to result in a risk" (https://gdpr-info.eu/art-27-gdpr/). Our processing is small and low-risk, but regular sales may not count as "occasional". Data-protection lawyer to confirm whether we need one. See section 1.
3. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, email address, PayPal transaction ID, amount, currency, product, date | PayPal sends it to us when you pay | To deliver access, keep order records, handle refunds |
| Your country (from PayPal, and from you at our checkout) | PayPal / you at checkout | Tax records and VAT rules; EU/UK buyers must buy as a business (Terms section 3) |
| EU and UK buyers only: company name, VAT number, the email of the PayPal account you'll pay with, your confirmation that you buy for your business, and the result of the VAT number check: valid or not, date and time, the registered name and address the registry returns, and the check's consultation reference if one is issued | You at checkout; the European Commission's VIES service (EU numbers) or HMRC (UK numbers, if we use HMRC's service) | To confirm you're buying as a business before payment (Terms section 3), to match your payment to that check, and as tax records |
| A keyed one-way hash of your IP address (not the address itself), kept for 1 hour | Your device, when you use our checkout | To limit how many VAT checks one network can make (abuse prevention) |
| Access token (we store only a one-way hash), activation code (expires), whether access was refunded or revoked | Created by our system | To give you access and switch it off when needed |
| Technical request data: IP address, time, URL requested, browser/client type | Your device, when you use our site or the data endpoint (processed by Cloudflare) | Security, abuse prevention, delivery evidence for disputes |
| Emails you send us, and our replies | You | Support |
| Delivery and open/bounce status of emails we send | Brevo | To check that access emails arrive |
We do not collect card numbers (PayPal handles payment), and we don't use advertising or tracking cookies.
Analytics: we may use Cloudflare Web Analytics, which Cloudflare describes as privacy-first and cookieless (https://www.cloudflare.com/web-analytics/). It counts page views without cookies or cross-site tracking. If we ever add cookies that aren't strictly necessary, we'll ask for consent first.
4. Why we use it (legal bases under GDPR art. 6)
- To perform our contract with you (art. 6(1)(b)): delivering the Feed, managing your subscription, support, refunds.
- To meet legal obligations (art. 6(1)(c)): accounting and tax records, including the VAT number check that shows an EU/UK sale was made to a business.
- To take steps before entering a contract with you (art. 6(1)(b)): checking an EU/UK buyer's VAT number at checkout, because we only sell to businesses there.
- Our legitimate interests (art. 6(1)(f)): protecting our service from abuse (including rate-limiting VAT checks), enforcing the licence (e.g. spotting a shared token), and keeping evidence for PayPal disputes and chargebacks.
- Your consent (art. 6(1)(a)): only for optional marketing emails, if we ever send them. You can withdraw consent at any time. Service emails (receipts, access links, renewal and change notices) aren't marketing.
Under Law 09-08 the same purposes are covered by the CNDP customer-management declaration (Délibération 32-2015 §2).
5. Who we share it with (our providers)
| Provider | Role | What they get | Location | Their privacy information |
|---|---|---|---|---|
| PayPal | Payment processor. PayPal is also an independent controller of the data you give it | Everything you enter at PayPal checkout. It sends us name, email, transaction details | USA / Luxembourg (PayPal group) | https://www.paypal.com/ma/legalhub/paypal/privacy-full (PayPal blocks automated reading. Check the current version in a browser) |
| Cloudflare | Hosting, data delivery, storage (Workers, KV), security, optional cookieless analytics. Processor under its Data Processing Addendum | Order and token records; technical request data | USA, with a global network | Privacy policy: https://www.cloudflare.com/privacypolicy/ · DPA: https://www.cloudflare.com/cloudflare-customer-dpa/ · GDPR: https://www.cloudflare.com/trust-hub/gdpr/ |
| Brevo (Sendinblue SAS) | Sends transactional emails (receipts, access links). Processor under its DPA (Appendix 3 of its terms) | Your name and email, email content and delivery status | France (EU) | Privacy policy: https://www.brevo.com/legal/privacypolicy/ · Terms incl. DPA: https://www.brevo.com/legal/termsofuse/ |
| European Commission (VIES) | Public VAT number validation service. It forwards the check to the tax administration of the country concerned and returns its answer. Recipient, not our processor | Country code and VAT number (EU buyers only) | EU | VIES privacy statement: https://ec.europa.eu/taxation_customs/vies/rest-api/privacy-statement |
| HMRC (only if we switch on HMRC's "Check a UK VAT number" service) | UK tax authority's VAT number check. Recipient, not our processor | UK VAT number (UK buyers only). Until then, UK numbers are checked by format on our side and reviewed by hand | UK | https://www.gov.uk/government/organisations/hm-revenue-customs/about/personal-information-charter |
| Google (Gmail) | Our support mailbox | Emails you send us | USA / global | https://policies.google.com/privacy |
We don't sell or rent your personal data. We may disclose it if Moroccan or other applicable law requires (e.g. to tax authorities or courts).
6. How long we keep it
| Data | Kept for |
|---|---|
| Order and invoice records (name, email, transaction ID, amount, date, country) | 10 years after the sale, for accounting and tax rules (Moroccan retention period for accounting documents; accountant to confirm) |
| VAT check record (company name, VAT number, PayPal email, check result) when you then pay | 10 years, with the order record above |
| VAT check record when no payment follows | 30 days, then deleted automatically |
| Cached VAT check result (so the same number isn't re-checked with VIES on the same day) | 24 hours |
| Hashed IP for the checkout rate limit | 1 hour |
| Access token hash and access status | While your access is active, plus 30 days, then deleted |
| Activation codes | Expire automatically after a short period (hours), then deleted |
| Technical request logs (IP etc.) | Short-term logs only, per Cloudflare's retention (a few days). Any log we keep as dispute evidence is deleted 18 months after your last payment (covers PayPal and card dispute windows) |
| Support emails | 3 years after our last exchange |
| Brevo email logs | Per Brevo's retention settings, and no longer than 12 months |
7. International transfers
- EU/UK buyers → us in Morocco: we collect your data directly as the seller. There is no EU adequacy decision for Morocco (list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). We apply GDPR standards to your data anyway.
- Us → PayPal and Cloudflare (USA): necessary to perform our contract with you (payment and delivery). Cloudflare also offers Standard Contractual Clauses in its DPA. Notified to the CNDP (section 2.1).
- Us → Brevo (France): France is on the CNDP adequacy list. Notified to the CNDP.
- Us → European Commission VIES (EU): EU countries are on the CNDP adequacy list. Necessary to check an EU buyer's VAT number before the contract. Notified to the CNDP.
- Us → HMRC (UK), only if we use HMRC's service: the UK is on the CNDP adequacy list. Notified to the CNDP.
8. Your rights
You can ask us to:
- access your data and get a copy;
- correct it;
- delete it (we'll keep what the law requires us to keep, e.g. invoices);
- restrict or object to processing based on legitimate interests;
- port it (receive it in a machine-readable format);
- withdraw consent for anything based on consent.
Law 09-08 gives you rights of information, access, rectification and opposition (Law 09-08, chapter II; https://www.cndp.ma/loi-09-08/).
How: email anassabbahi.tech@gmail.com. We answer within 30 days (GDPR: one month). We may ask you to confirm your identity, e.g. by writing from the email you bought with.
Complaints: you can complain to:
- CNDP (Morocco): contact@cndp.ma, Angle Boulevard Annakhil et Avenue Mehdi Ben Barka, Immeuble Les Patios, 3ème étage, Hay Riad, Rabat. https://www.cndp.ma
- your EU data protection authority (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en), or the UK ICO (https://ico.org.uk).
9. People named in the Feed itself
The Feed comes from public FDA records about companies and products. We remove named individual contact fields (e.g. 510(k) contact persons and recall contact names and phone numbers). We keep company names and business addresses as published by FDA. If you are named in the Feed (for example as a sole trader) and want a record removed or corrected, email us and we'll handle it as a request under section 8.
10. Security
Payment happens on PayPal. Access uses secret tokens: we store only a hash, links are signed, and tokens are revoked on refund. Our systems run on Cloudflare with access restricted to the owner. If a breach affects your data and is likely to put you at risk, we'll tell you and the competent authority as the law requires.
11. Children
The Feed is for professional use. We don't knowingly sell to or collect data from anyone under 18.
12. Changes
We'll post any update here with a new effective date. If a change is significant, we'll email active subscribers.
13. Contact
Apex, Anas SABBAHI, No. 71, Lot Loued Lahmer, Errachidia 52000, Morocco. anassabbahi.tech@gmail.com
If we later sell through a merchant of record (e.g. Lemon Squeezy): the merchant of record collects your payment and billing data as an independent controller under its own privacy policy, and passes us your name, email and order details.
Section 5 would then list it in place of PayPal (or alongside it), and section 2.1's transfer notice to the CNDP would need updating.