1. Who We Are

ApeiroCraft is proposal, invoicing and client-management software for agencies and freelancers. We're based in Kathmandu, Nepal.

2. What We Collect

From you, when you use ApeiroCraft:

Your name and email, from the sign-in provider (Kinde)
What you put in your workspace: proposals, invoices, clients and contacts, tasks, notes, templates and files
Billing details: your plan, and the payment, refund and chargeback records our payment provider sends us. Card details go to DodoPayments and never reach our servers.
If you arrived through a partner's link: which partner, and when you clicked it

Collected automatically:

IP address and browser type, in security and error logs
Which features you use, so we can see what's working
Aggregate page-view and performance numbers from Vercel Web Analytics and Speed Insights, which do not use cookies
If you accept cookies: Google Analytics and Google Ads measurement, and the campaign or partner link that brought you here (see Cookies)

3. How We Use Your Data

To run the product and keep each workspace's data to its own members
To send the emails the product sends: proposals, invoices, notifications
To bill you, and to pay referral partners the commission they are owed
To answer support requests and fix bugs
With your consent, to measure which marketing brings people who stay
Only if you turn it on, to send product updates and the newsletter (see below)

We do not sell your data or use it to train AI models.

Product updates and newsletter. Off by default. You can turn it on or off at any time in Settings → Email preferences; we record when and from where you changed it (date, IP address and browser), because that is how consent has to be evidenced. Legal basis: your consent. Turning it off also stops our occasional reminder emails (such as a draft you haven't sent). Emails the service depends on — a client opening, signing or replying to a proposal, invoices you send, trial and billing notices — are not marketing and are sent regardless.

The “send me the comparison” form. If you enter your email on a comparison page, we store it and send you that one email with a link to the page. We don't add you to a list or email you again from that form. Legal basis: your request. To have the address deleted, email us.

4. Your Clients' Data

When you send a proposal or invoice, the client details you entered are stored in your workspace. For those details you decide what is collected and why; we process them on your behalf.

When your client opens a proposal, we record that it was opened, when, and from which IP address, so you can see it was read.
When your client signs, we record the name and email they type, their signature, the time, their IP address and browser, and a fingerprint of the exact document they signed.
Pages your clients open (proposals, invoices, shared notes) never load Google Analytics, Google Ads or any other advertising tag.

Your client's data is deleted when you delete it, the workspace, or your account — except proposals they signed, which are kept so they keep access to their agreement.

5. Storage & Security

Data is stored with Supabase on AWS in Singapore (ap-southeast-1) and served through Vercel. It is encrypted in transit and at rest. Every request is checked against your workspace membership before any data is read or changed, and live updates (notifications, collaborative notes) are only delivered to current members of the workspace.

7. Cookies

Always set, because the product needs them:

Sign-in session cookies (Kinde): keep you signed in
cookie_consent (1 year): remembers whether you accepted or declined

Only if you click Accept on the cookie banner:

referral_attribution (75 days): which partner's link you followed and when, so the partner is credited if you subscribe
ac_attrib (90 days): the campaign, ad click or site that first brought you here
Google Analytics and Google Ads cookies, on our own pages only

If you decline or ignore the banner, none of the second group is set, and a partner link you followed will not be credited. Your theme preference is kept in your browser's local storage, not in a cookie.

8. Your Rights

Export: download everything we hold about your account as a JSON file, from Settings → Your data.
Delete: delete your account from Settings → Your data. What is removed and what is kept is described below.
Correct, restrict or object: email us and we will act on it.
Withdraw consent: clear the cookie_consent cookie to see the banner again; turn off product updates in Settings → Email preferences; or, if you don't have an account, email us and we'll delete your address.

For anything else, email founder@apeirocraft.tech. We aim to reply within 7 business days, and always within 30 days.

9. Retention & Deletion

We keep your data while your account is open. When you delete your account:

Deleted immediately: every workspace you own alone and everything in it (proposals, invoices, clients, tasks, notes, files), your memberships of other workspaces, notifications, feedback and usage records.
Kept, with your name and email removed: payment, refund and chargeback records, for as long as tax and accounting law requires, and referral commission records, which a partner is owed under their agreement.
Kept: proposals your clients signed, with the signature and its evidence, because the client is a party to that agreement and must keep access to it. The same applies when you delete a single workspace.
Kept: security and consent logs, as a record of what was done and agreed to.

You can't delete an account while a paid subscription is active (cancel it first, so the card isn't charged again), or while other people are still in a workspace you own alone (transfer it or remove them first, so their work isn't deleted with yours). Your Kinde sign-in is not removed automatically: the account can no longer be used, and if you want the sign-in itself erased, email us and we will remove it.

10. Contact

For any questions: founder@apeirocraft.tech