Privacy

Last updated 14 October 2026 · Australia

1. Who we are

Apex SMS Gateway (“Apex”, “we”) lets a business send and receive SMS from a nominated Android phone through getapexsms.com and our Android app. It is operated by Apex Commercial Group.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Some small businesses are exempt from parts of that Act. We apply this policy anyway.

Questions and requests go to [email protected] or the contact form. See also our Terms.

2. What information we collect

Information you give us:

• Account details: name, email address, organisation name, and a password. The password is stored only as a hash. We cannot read it back.
• Contact messages: your name, email, topic, optional company name, and what you write to us.
• Message content and numbers you send or receive through the service, so we can show conversations in Messages, deliver Business email↔SMS where enabled, and operate the gateway.
• Device metadata for phones you pair: identifiers needed to recognise the gateway handset, online status, and revoke access.
• Billing details for paid plans: plan status and Stripe customer or subscription references. Card numbers are handled by Stripe. We do not store full card numbers on Apex servers.

Information created by using the service:

• A sign-in cookie that keeps you logged in. It is httpOnly, which means page scripts cannot read it. It is not an advertising cookie.
• Technical logs needed to run and protect the site, such as sign-in results, error reports, send outcomes, and the IP address used to limit repeated signup, login, and contact attempts.

3. How we use personal information

We use this information to:

• create and protect your organisation’s account, including email confirmation and password reset;
• run Messages, device pairing, and (on Business) the email bridge and planner integration key;
• count plan allowances and process subscription billing through Stripe;
• reply when you contact us;
• keep the service secure, investigate misuse, and fix faults;
• meet a legal obligation if one applies.

We do not sell personal information or contact lists. We do not use the people you text to advertise Apex to them. Account email is limited to running the account (for example confirmation, password reset, and billing notices).

4. Your phone and the mobile network

Texts leave through the Android phone and SIM you nominate. Apex is not a carriage service provider. Delivery depends on that phone staying online and on the mobile network of the SIM. Message content travels through our systems so the product can work, and through your phone’s radio when it is sent or received.

5. Who else sees it

People in your organisation see message history and settings for that organisation according to their login. We see information only as needed to operate, support, and protect the service.

We use service providers to run Apex, including Stripe for billing, an email provider for transactional and contact mail, and Cloudflare to deliver and protect the public site. Those providers process information only as needed for their role. Some processing may occur outside Australia.

We may disclose information if the law requires it, or if it is reasonably necessary to prevent a serious threat.

6. Cookies and similar technology

We use a session cookie for sign-in as described above. We do not use advertising cookies on the public site. Your browser may also store preferences such as theme for the signed-in app.

7. How long we keep it

We keep account, message, and device information while the organisation uses Apex, and for a limited backup period after that so we can restore the service or meet a legal duty. Contact messages are kept as long as we need them to handle the enquiry and keep a record of it. Billing records may be kept longer where tax or payment rules require it. When information is no longer needed, we delete it or de-identify it.

8. Security

We use access controls, hashed passwords, and a sign-in cookie that scripts on the page cannot read. No method of storage or transmission is perfectly secure. If we become aware of a breach that is likely to result in serious harm, we will notify the people affected and the Australian Information Commissioner where the law requires it.

9. Access, correction, and deletion

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete your account and the information we hold for it. Write to [email protected] or use Write to us with topic “Privacy or data”. We will delete it, or tell you what we are required to keep and why. There is no charge for a reasonable request. We may need to confirm you are the account holder before we act.

10. Overseas disclosure

Some providers we use (for example payment, email, or hosting and edge protection) may process personal information outside Australia. We use them to provide Apex, not to sell your data. Where we disclose information overseas, we take steps that are reasonable in the circumstances to ensure it is handled consistently with this policy and Australian law.

11. Children

Apex is a business tool. It is not directed at children, and we do not knowingly create accounts for people under 18.

12. Changes to this policy

If we change this policy, we will update this page and the date at the top. If a change materially affects how we handle information we already hold, we will also tell account holders by email or in the product where practical. The current version is the one on this page.

13. Complaints or questions

Write to [email protected] first and tell us what happened. We will look into it and reply. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.