Privacy policy.

1. Who we are, and our two roles

StudentFlow LLC ("Aptus", "we") runs aptuscollect.com and the Aptus service. We handle personal data in two roles:

• For our own business, meaning website visitors, prospects and the staff of businesses that use Aptus. Here we decide how the data is used, and this policy explains how.
• For our customers. Businesses use Aptus to send reminders to their customers and take payments from them. For that data we act as a service provider (processor). We follow the business's instructions, and the business's own privacy notice applies too. If you have a question about your account or your data, the business is your first stop, and we'll help them answer.

2. What we collect

When you visit this website. We use PostHog to understand how people use the site: which pages they visit, how they found us, and their browser, device and approximate location. It sets cookies to do this. We don't use ad trackers, and we don't sell or share this data for advertising. You can block or delete cookies in your browser settings. Our host keeps standard server logs, such as IP address, browser type, the page requested and the time. They're used for security and to keep the site running, and they're deleted on the host's normal schedule.

When you contact us or become a customer. Your name, work email, phone number, organization, role, what you write to us, and billing details for the business. Card details for Aptus's own invoices are handled by Stripe.

When a business uses Aptus to contact you (you're a "recipient"):

• Contact details the business gives us: name, mobile number, email.
• Account details: invoice numbers, amounts, due dates, balance and payment status. For schools, this may include a student's name and grade as shown on the invoice.
• Messages: each reminder we send, its delivery status, and any reply you send, including STOP and HELP.
• Pay page activity: whether you opened the link, whether you paid, started a plan or asked for a call, your payment-plan authorization, and device and IP information for security and fraud prevention.
• Payments: Stripe processes card and bank details. We receive only the payment result, the amount, and the card brand and last four digits.

We don't collect Social Security numbers, health information or biometric data. We don't knowingly collect information directly from children.

3. How we use it

• To send the reminders and follow-ups the business has approved, and to stop them when you pay, start a plan, ask for a call or opt out.
• To run the pay page and payment plans.
• To match payments to invoices and show the business its accounts.
• To keep the service secure, prevent fraud, and fix problems.
• To respond to you, and to meet legal duties such as keeping records of opt-outs.
• To improve Aptus, using aggregated, de-identified data only.

We don't sell personal data, share it for cross-context behavioral advertising, use recipient data to market Aptus or anything else, or use customer data to train third-party AI models. Where we use AI to draft messages or suggest next steps, it runs within our service providers under contracts that bar them from using the data for their own purposes.

4. Legal bases (where they apply)

We rely on contract (running the service a business signed up for), legitimate interests (security and improving the service), consent (where the law requires it, such as for automated texts, which the business obtains), and legal obligation (such as keeping records).

5. Who we share it with

Only these:

• The business that holds your account.
• Service providers that help us run Aptus, under contracts that limit them to our instructions:

• The law. When required by law, subpoena or court order, or to protect someone's safety or rights.
• A business transfer. If Aptus is merged or sold, subject to this policy.

6. Text messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent aren't shared with any third party, except the service providers that deliver messages for us. Reply STOP to any text to opt out, and HELP for help. Message and data rates may apply. Frequency varies with your account. More in the Terms, section 13.

7. How long we keep it

• Customer data, meaning recipient and account data, is kept for as long as the business uses Aptus. After that the business has 30 days to export it, and we delete it within 90 days after that.
• Opt-out records are kept as long as needed so we never text or email you again against your wishes.
• Billing and payment records are kept as long as tax and accounting law requires.
• Prospect emails are kept for as long as the conversation is useful, and deleted on request.

8. Security

Encryption in transit (TLS) and at rest. Access limited to staff who need it, with multi-factor sign-in. Customer accounts are isolated from each other. Logs of who accessed what. Regular backups. No system is perfectly secure. If a breach affects your data, we'll tell the business, and you where the law requires, as quickly as the law requires.

9. Student records

When a school uses Aptus, we act as a "school official" under FERPA, under the school's direct control. We use education records only to provide the service to that school, and we don't re-disclose them except as FERPA allows. Where a state student-privacy law applies, such as the Illinois Student Online Personal Protection Act (SOPPA), we follow it and the school's data-privacy agreement. That includes notifying the school of any breach within the time the law sets. Parents should direct requests about student records to the school.

10. Your choices and rights

• Stop messages: reply STOP to texts, or use the unsubscribe link in emails.
• Access, correction, deletion: if a business contacted you through Aptus, ask the business. We'll help them respond. For data we hold for our own business, email czapata@studentflow.io.
• State privacy rights. Depending on where you live (California, Colorado, Virginia and others), you may have rights to know, access, correct, delete, or opt out of the sale or sharing of your personal data. We don't sell or share it. We won't treat you differently for using these rights. An authorized agent may make a request for you. We'll verify requests before acting and reply within the time the law requires.

11. Where your data is

Aptus serves US businesses. Data is stored and processed in the United States.

12. Children

Aptus isn't directed to children. We don't knowingly collect personal data from anyone under 13. Student information reaches us only from a school, as described in §9.

13. Changes

We'll post updates here and change the date at the top. If a change is material, we'll tell customers before it takes effect.

14. Contact

StudentFlow LLC · czapata@studentflow.io