Privacy Policy

Last updated September 18, 2026. This replaces any earlier version.

This explains what J Paris Media LLC collects through Aptsmith, why, who else touches it, and what you can do about it. It is written to be read, so it says what the software does rather than what a template says software does.

The short version. We collect what running the platform needs and nothing for advertising. We do not sell your data, we do not track you across other websites, and there is no analytics script on this site. We do measure whether our own emails get opened, and section 7 says exactly how. Your business records are yours, downloadable in full at any time, and deletable. Card numbers never reach us. An AI you connect sees your account and no one else's. A mailbox you connect is yours alone: nobody else on your account can read it.

1. Who this covers

There are three kinds of people here, and the difference matters.

Visitors. Anyone reading this site or taking the quiz. We decide what happens to that information, and this policy is our promise about it.
Account owners and their team members. Our customers. Same as above.
An account owner's own clients. Someone who books an appointment on a business's page, fills in one of its forms, or pays it. That information belongs to that business. It decides what is collected and why; we hold it on its instructions and do not use it for our own purposes. If you are one of those clients, talk to the business you dealt with. Their privacy notice governs, not ours, and we will help them answer you.

2. What we collect

When you make an account

Your name, email address and password. The password is hashed; we never see it.
Your business name, your logo and the color you choose, if you add them.
The address your public pages answer on, for example yourbusiness.aptsmith.com.
Who is on your team, and what each person's role is.

Your assessment results

The platform arranges itself around an assessment you take. We store the numbers you enter and the four settings they produce. They describe how you prefer to work. They are not a performance rating, we do not share them, and they are not used for anything outside arranging your own screens.

What you do in the platform

The records your modules keep. See section 3, because most of this is about your clients rather than about you.
How you use email we send you: whether a message was opened, and whether a link in it was clicked. Section 7 says how that works.
Which layout a screen offered you and which one you chose instead. Section 4a says why, and how to turn it off.
Which modules you installed and what you have switched on. If you rate a module, only the average is published: which business gave which rating is never shown, because that would say what you use.
Notifications we raised for you, and whether you read them.
Sign-in activity and error logs, so we can keep the account secure and fix faults. We do not store your IP address. It is used for a few seconds in memory to rate limit a request and is never written down.

Billing

Your subscription status, invoices and receipts, and the events Stripe sends us about them. Card numbers never reach our servers. They go directly to Stripe, who hold them.

If you take the quiz or join the waitlist

Your answers, your result, and your email address if you gave it. Joining the waitlist is a choice you make with a checkbox; it is never assumed from having taken the quiz, and every waitlist email carries a one-click unsubscribe.

The quiz writes you a paragraph, and that is done by Anthropic. What we send is your pattern and what you typed about what you wanted the software for. Your name and email address are not sent with it. We also keep our own research notes in Airtable: what people said about the tools they had given up on, and, where you gave it, your contact details so we can follow up. If you are on our mailing list, your name, address and which of our forms you filled in are copied there too, so we can see who a message is for before we write it. Unsubscribing changes it there as well.

Messages

Messages you send through Connections, messages you send to support, and any files attached to either.

3. Your clients' information

When someone books you, fills in your form or pays you, a module stores what that interaction needs. Depending on the module and on what you ask for, that can include a name, an email address, a phone number, an address, appointment times, form answers, payment status, and any notes you write about the person.

We store it so your tools work. We do not mine it, sell it, or use it to market anything to your clients. Because it is yours:

You control what is collected, by choosing what your forms and services ask.
You can export or delete it at any time.
You should have your own privacy notice telling your clients what you collect and why, and you need a lawful reason for collecting it.

Every table is scoped to one account by the database itself, so no other business can read your clients even by mistake.

Your tools seeing each other's records. One of your tools can see another's records, for example your mail tool seeing your booking tool's services, open times and a client's appointments, only after you allow it in Settings, Connections between your tools. You can stop it at any time. It stays inside your account: the records are not copied to the other tool's developer. A tool can see appointments only for one person or for a range of dates, never everyone at once. We record what each tool looked at and asked for, so you can see it on the same screen.

4. Why we use it

To run the platform and the modules you installed.
To take your subscription payment and send receipts.
To send the messages you or your modules ask us to send.
To answer you when you contact support.
To keep the platform secure, spot abuse, and fix faults.
To tell you things you need to know: a change to these documents, a failed payment, a security matter.
To meet legal and accounting obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not build profiles of you, and there is no advertising network anywhere in this product.

4a. Learning whether the setup is right

Aptsmith arranges itself around your assessment results. Whether that actually helps is a fair question, and the honest answer is that nobody has published evidence either way. So rather than assert it, we watch.

When a screen offers you a layout and you switch to the other one, or you change a setting in your interface preferences, we record that. Over enough accounts it tells us which of our rules are right and which are wrong, and the wrong ones get fixed.

What this records: that a named screen was shown one way and you chose another. What it does not record: anything that was on the screen. Not your clients, not your campaigns, not what you typed. A record reads “the subscribers screen was shown as a board and she switched to the list”, and that is the whole of it.

It is on by default because the product gets better for everyone when it is, and you can turn it off in your settings at any time without losing anything else. We publish what we learn as aggregates across accounts, never as anything about one business.

We use a small number of companies to run the platform. Each gets only what its job needs.

Supabase. Hosts the database, sign-in and uploaded files.
Vercel. Hosts and serves the application.
Stripe. Takes your subscription payment, and separately handles payments from your clients into your own Stripe account.
Resend. Delivers email we send.
Anthropic. Writes the paragraph at the end of the quiz, and drafts text inside a module where one offers to. Only the request itself is sent.
Airtable. Holds our own research notes from the quiz, a copy of our mailing list so we can plan what to send it, and the pool of assessment coupons.

Gmail, Outlook, Google Calendar and the rest of the marketplace apps are not on this list, because nothing reaches them unless you connect them yourself. See section 10.

We also share where we must: with a regulator or a court where the law requires it, with professional advisers under a duty of confidence, and with a buyer if the business is ever sold, in which case we would tell you first.

Anything else that touches your data got there because you connected it. See section 10.

6. Payments

Your subscription. You pay us $49 a month through Stripe. We receive the fact of the payment, the last four digits and the card brand, and whether it succeeded. Nothing more.

Your clients paying you. Money goes directly into the Stripe account you connected. It does not pass through us and we take no cut. We record that a payment happened and what it was for, so the booking can be confirmed and so your records are right. Your client's card details go to Stripe, never to us, and Stripe's own privacy policy covers what it does with them.

7. Email

Email from the platform is of two kinds. Transactional messages are the ones the software owes you or your client: a receipt, a booking confirmation, a password reset, a notice that somebody messaged you. You cannot unsubscribe from these while you have an account, because they are the account working. Marketing messages are the ones you asked for, and every one carries an unsubscribe link that works immediately.

Whether a message was opened

We record delivery for every message: that it was accepted, bounced, or reported as spam. We also measure how our own email performs, which means recording whether a message we sent was opened and whether a link in it was clicked. That is done with a small image and with links that pass through us on the way to where they say they are going. It records that this address opened this message at a time. It does not follow you anywhere else, and it is not shared or sold.

Most email programs let you stop it by blocking remote images, and blocking them does not affect the message reaching you or any link in it working.

If you are the client of a business that uses Aptsmith, that business may be able to see that you opened its message or clicked a link in it. That is its record rather than ours, kept for its own purposes. Ask the business that emailed you.

We keep a suppression list. When an address permanently bounces or somebody reports a message as spam, that address goes on it and we will not send to it again, from any account. That list exists to protect the people receiving mail, so an address stays on it until the person asks to come off.

If you connect your own mailbox, mail a tool sends for you goes out from your own address through your own mail host, never from ours. Section 10a says what that involves.

8. Text messages

The platform does not send text messages today. When a module does, this is how it will work, and we are writing it down now so the rule exists before the feature:

A phone number is used to message somebody only where they agreed to be messaged, and the business that collected it is responsible for that consent.
Every marketing message will say who it is from and how to stop. STOP works immediately and permanently, and goes on the same suppression list.
Numbers are not sold, rented or shared with anybody except the carrier and messaging provider needed to deliver the message.
We will name the messaging provider here before the first message is sent.

9. AI connections

You can connect an AI you already pay for, such as Claude or ChatGPT, and work with your account through it. Two separate things happen, and it is worth keeping them apart.

When you connect your own AI

The connection reaches one account: yours. It cannot see another business, it cannot reach billing, and a team member's connection is narrower than an owner's.
Whatever you ask it about is sent to your AI provider, on your plan, under their privacy policy. We are not in that conversation and do not store it.
Every action it takes in your account is logged, so you can see what was done and when.
Anything destructive stops and asks you first. Deleted items can be restored for 30 days.
Access tokens for the connection are encrypted at rest. One click disconnects it and access ends at once.

When a tool drafts something for you

Some tools offer AI help: drafting a reply, summarizing a long message, finding a meeting to add to your calendar. It is off until the account owner turns it on, and then only for the tools they allow. It runs on your account's own Anthropic key, within a monthly budget the owner sets.

Only what that one request needs is sent to Anthropic, and each kind of request has a fixed list of what it may include, with a size limit. A tool cannot send your whole mailbox, or anything the request does not need.
What you wrote in your Business profile is added so drafts sound like your business. It is the only information about you or your business AI receives: your name, contact details, team, billing and records are never sent. Tools never see the Business profile either.
Every request is recorded, so you can see exactly what was sent and what came back, in Settings, AI for your tools. You can delete any of them. After 30 days only an outline is kept: which tool, what kind of request, when, and its size and cost, without the text.
What comes back is a draft or a suggestion shown to you. Nothing is sent, filed or deleted until you press the button.

Your data is not used to train anyone's model by us. We do not send your records anywhere for training, and we do not train models of our own on them.

10. Apps you connect

You can connect services you already use, for example Stripe, Google or Microsoft. You authorize each one yourself, and we ask for the narrowest permission the feature needs. The access keys are encrypted before they are stored, and the columns holding them cannot be read by the app's ordinary queries at all.

Disconnecting an app from your apps settings removes our access immediately. What that company already holds is governed by its own privacy policy, not ours.

Zoom. If you connect Zoom, a booking tool can create a meeting on your Zoom account for each video booking, and move or cancel it with the booking. When Zoom finishes a meeting's AI summary or cloud recording, Zoom sends it to us and we keep the summary, the next steps, and the recording's share link and passcode with that appointment, in your account. Recording and summaries are switched on in your Zoom settings, not ours, and you should tell your clients when a session is recorded. Nothing is sent to a client unless you send it.

10a. Mailboxes you connect

A mail tool can read and send email from a mailbox you already have, on your own domain. You connect it yourself, by giving the tool your address and a password for that mailbox. Nothing about your mail moves: there is no forwarding, no new address and no change to your DNS.

What is processed

The connection. Your address, your mail server's name and ports, and the password. The password is checked with your mail host before anything is saved, then encrypted before it is stored, and it is never shown again.
Your mail, when a tool asks for it. To show your inbox a tool reads, from your mail host, who each message is from and to, its subject, its date, a short preview, and its folder and flags. The full message is fetched when you open it. What the tool keeps is stored in your account's own records, with everything else you keep in Aptsmith.
New mail notices. While you have Aptsmith open and a mail tool installed, the platform checks your inbox every couple of minutes for mail that arrived since the last check, and puts a notice in your bell with the sender and subject. Only you see your notices. We keep where the last check got to and which messages were announced, so none is announced twice.
The people who write to you. Your mail contains other people's names, addresses and words. Like your clients' information in section 3, that is yours, held on your instructions and for no purpose of ours.
What you send. A message you send goes to your mail host, which delivers it, and a copy is saved in your own Sent folder the way your phone does it.

Who can see it

You, and only you. A mailbox belongs to the person who connected it. Nobody else on your account can read it through Aptsmith, the account owner included. Each person on a team connects their own.
Only the tools that need it. A tool reaches a mailbox only if it declared that it works with mail. Every other tool you install cannot.
Not us, as a rule. Nobody at J Paris Media LLC reads your mail. The exceptions are narrow: you ask us to look at a specific problem, we are investigating abuse or a security incident, or the law requires it.

What we never do with it

We use mail data only to provide the features you use it for. We do not use it for advertising, we do not sell it, we do not share it with anyone except as this policy describes, and we do not use it to train any AI model, ours or anybody else's. We do not send anything from your mailbox that you, or a tool acting on something you set up, did not ask to send.

Who else is involved

The connection runs from our servers (Vercel, section 5) directly to your own mail host, such as SiteGround, Fastmail or iCloud, over an encrypted connection. If you connect a Microsoft mailbox, Microsoft is involved too, under its own privacy policy. No other company touches your mail on its way through.

If you use AI help with your mail

When AI help is switched on and you ask for it, the text of the message you asked about (and, for a reply, up to three earlier messages in the thread) is sent to Anthropic to answer that request, on your account's own key. It is used for that request only and is not used to train any model. Section 9 says how requests are recorded, limited and trimmed after 30 days.

Stopping it

Disconnect the mailbox from your apps settings and the saved password is deleted at once, so no tool can reach the mailbox again. Changing the password at your mail host, or revoking an app password there, has the same effect. What a tool already kept stays in your records until you delete it, and can be exported or deleted like anything else (sections 14 and 15).

11. Connections and support

Connections lets account owners message each other. There is no directory: a connection only exists because somebody shared a code and the other person accepted. Either side can end it.

We do not read those messages to profile you, to train anything, or out of curiosity. We access them only where we have to: investigating a report of abuse, fixing a fault you asked us to fix, or where the law requires it.

Messages to support reach us and are kept so we can help you and so we remember what was said last time.

12. Cookies

We use cookies only to make the software work. There is no analytics, no advertising pixel, and no third-party tracker on this site or in the app, which is why you have not been asked to accept anything.

Sign-in cookies. Set by Supabase so you stay signed in. Removing them signs you out.
A signed-in hint. A small cookie that records only that somebody is signed in, so a link from the public site can say “Dashboard” rather than “Sign in”. It carries no name and no identifier.
A layout cookie. Remembers whether you collapsed the sidebar, so the page does not jump when it loads.
Your browser's own storage. Small preferences that never leave your device: light or dark, which view of the homepage you chose, how you like the marketplace laid out, the clocks on your dashboard.

13. How it is protected

Everything travels over HTTPS.
Every table is locked to one account by the database itself, not by application code that could forget.
Access keys and AI tokens are encrypted before they are written, with the key held outside the database.
Module code runs in your browser and never sees the platform's own credentials. It reaches records through an interface that checks every request against the account making it.
A content security policy restricts what a page may load or run.
Requests are rate limited, so a runaway or hostile client cannot sweep data.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you, and we will tell you what we know rather than the least we can get away with saying.

14. How long we keep it

While your account is open, we keep your records so the software works.
Deleted items can be restored for 30 days, then go for good.
When you delete your account, it goes immediately. There is no grace period and no hidden copy: your accounts, your records and your uploaded files are removed, and so is your sign-in. Export first, because we cannot undo it.
Canceling is not deleting. A canceled or paused account keeps everything until you delete it.
Billing records are kept as long as tax and accounting rules require, typically seven years.
Suppression list entries are kept indefinitely, because forgetting that somebody unsubscribed would mean emailing them again.
Security logs are kept for a limited period and then discarded.

15. Your rights

Whatever law applies where you live, these are available to you, and most of them without asking us:

See it and take it. Download your records and your uploaded files in one go, from your settings. No request, no waiting.
Correct it. Edit anything in the platform directly.
Delete it. Delete your account from your settings. It is not reversible once the 30 days pass.
Object or restrict. Tell us and we will stop, or explain why we cannot.
Complain. To us first, please. You can also complain to your data protection authority or attorney general.

We will not treat you differently for exercising any of this. If you ask us to do something rather than doing it yourself, we will verify that the request is really yours before we act on it.

16. Children

Aptsmith is for businesses and is not directed at children. You must be 18 to have an account. We do not knowingly collect information from a child under 13. If you believe a child's information reached us, tell us and we will delete it.

17. Where it is processed

We are in the United States and the platform is run from there. If you use Aptsmith from elsewhere, your information is processed in the United States under this policy.

18. Changes

We will change this as the platform changes. The date at the top always says when. If a change matters to you, we will email you before it takes effect rather than quietly editing the page.

19. How to reach us

Ask us anything about this, including questions this page does not answer. A real person reads it.

J Paris Media LLC, which runs Aptsmith.

Email: support@aptsmith.com
Post: 30 N. Gould St. #56459, Sheridan, WY 82801
Signed in, the quickest route is the chat button in the corner of any page. It reaches the same people.

We answer support ourselves. There is no ticket queue and no outsourced first line.