Privacy Policy

1. Information We Collect

Account and profile information: When you register, we collect your name, email address, company name, and role. If you are a key person on a license application, we may collect additional identifying information required by state gaming regulators (e.g., date of birth, address, prior regulatory history).

Business information: To provide filing and compliance services, we collect information about your business activities, licenses held, ownership and control structure, jurisdictions of operation, and other regulatory details required to prepare and submit filings on your behalf.

Documents you upload: We store documents you upload (business plans, financial statements, existing licenses, organizational charts, identification documents, etc.) to assist with activity classification and filing preparation.

Payment information: Payment card data is collected and processed by our third-party payment processor (Stripe). We do not store full card numbers on our servers. We retain records of transaction amounts, dates, and service identifiers for billing and compliance purposes.

Portal and key-person session data: Individuals invited to complete a key-person compliance portal may provide identification documents, background information, and other regulatory disclosures through a dedicated session. That data is associated with the relevant organization's compliance record.

Compliance API usage data: For customers using our Compliance API, we log API request metadata (endpoint, timestamp, response code, token consumption) for billing, rate limiting, and service quality purposes. We do not log the contents of API queries in a manner that identifies end-users of your application without your consent.

On-chain identifiers: For customers using loyalty and rewards program services, we may process blockchain wallet addresses and on-chain transaction references provided by you or your users in connection with those programs. We do not collect private keys.

Usage data: We automatically collect log data including IP address, browser type, pages visited, timestamps, and referring URLs. We use this for security monitoring, abuse prevention, and service improvement.

Communications: If you contact us by email or through our forms, we retain those communications to respond to your inquiry and improve our services. We may retain correspondence with regulatory authorities conducted on your behalf as part of your compliance record.

2. How We Use Your Information

• Service delivery: To prepare and submit regulatory filings, deliver legal opinions, monitor compliance deadlines, process API requests, facilitate operator-sponsor introductions, and provide all other services you have engaged us for.
• Regulatory compliance management: To track filing deadlines, renewal obligations, and changes in regulatory requirements that may affect your compliance status.
• Account management: To manage your account, authenticate you, and provide customer support.
• Billing and metering: To calculate subscription fees, usage-based charges (including API usage and per-transaction fees), and to issue invoices.
• Communications: To send service notifications, invoices, deadline alerts, and (with your consent) marketing communications about new services or regulatory developments. Newsletter subscribers may manage their preferences at any time.
• Security and fraud prevention: To detect abuse, enforce our Terms of Service, and protect against unauthorized access.
• Legal compliance: To comply with applicable laws, respond to legal process, and protect our legal rights.
• Service improvement: To analyze usage patterns and improve our platform. We may use anonymized and aggregated data to improve our compliance services. We do not use identifiable client matter information to train our systems without your consent.

3. How We Share Your Information

We do not sell your personal information. We share information only as follows:

• Regulatory authorities: We submit information to gaming commissions, the NFA, CFTC, state secretaries of state, tribal gaming authorities, and other regulatory bodies as part of the services you have engaged us to perform. You are responsible for the accuracy of information you provide for submission.
• Service providers: We use third-party vendors for infrastructure, payment processing, email delivery, and analytics. These vendors process data on our behalf under data processing agreements and are not permitted to use your data for their own purposes.
• Affiliated attorneys: When your engagement involves attorney work product, relevant information is shared with the licensed attorney providing that service, subject to professional confidentiality obligations.
• Operator-sponsor matching: If you use our Operator Sponsor Matching service, we share limited profile information with potential counterparties only to the extent necessary to facilitate the introduction, and only with your prior authorization.
• White-label partners: If you access our services through a white-label partner (e.g., a law firm), the partner may have visibility into your engagement status as set forth in that platform's terms. We do not share your information with white-label partners beyond what is necessary to deliver the service.
• Legal requirements: We may disclose information if required by law, court order, or to protect our rights, property, or the safety of our users or the public.
• Business transfers: If Apparently is acquired, merges, or sells assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership.

4. Data Retention

We retain your account and service data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Regulatory filing records may be retained for extended periods given applicable recordkeeping requirements under gaming regulations and federal law.

Documents you upload are retained for the duration of your engagement and for a reasonable period after. You may request deletion of specific documents at any time, subject to our obligations to retain records for pending or completed regulatory submissions and any applicable legal hold.

API usage logs are retained for billing and audit purposes for a minimum of 12 months. Anonymized aggregate usage statistics may be retained indefinitely.

5. Cookies and Tracking

We use cookies and similar technologies to authenticate sessions, remember preferences, and collect analytics data. We do not use advertising trackers or sell data to ad networks.

We use session cookies (deleted when you close your browser) and persistent cookies (stored for a defined period) for authentication and preferences. Most browsers allow you to refuse cookies; note that some features may not function without them.

6. Security

We implement industry-standard security measures including TLS encryption in transit, access controls, and regular security reviews. Our API endpoints are protected by rate limiting and authentication controls. Sensitive operations require multi-factor authentication where supported.

No system is perfectly secure. If we become aware of a security breach affecting your data, we will notify you as required by applicable law.

7. Your Rights

Depending on your jurisdiction, you may have rights including:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your data, subject to legal retention requirements and pending regulatory obligations.
• Portability: Request a machine-readable export of your data.
• Objection: Object to certain processing, including direct marketing.
• Restriction: Request that we limit processing in certain circumstances.

To exercise any of these rights, contact us at privacy@apparently.com. We will respond within 30 days. We may require verification of your identity before processing certain requests. Note that deletion requests cannot be honored for information that has already been submitted to a regulatory authority or that we are required by law to retain.

8. International Users

Apparently is based in the United States. If you access our services from outside the U.S., your information will be transferred to and processed in the United States. For users in the European Economic Area, United Kingdom, or other jurisdictions with data transfer restrictions, we rely on standard contractual clauses or other appropriate transfer mechanisms.

If you are located in the EEA or UK, you have additional rights under the GDPR / UK GDPR, including the right to lodge a complaint with your local supervisory authority.

9. Children

Our services are intended for business users and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last updated" date. For material changes, we will provide additional notice (e.g., by email).

11. Contact

Questions or concerns about this Privacy Policy? Contact our privacy team at privacy@apparently.com.