Privacy policy

Last updated: 6 July 2026

1. Introduction

Apex Rides Digital Limited ("Apex", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect and use your personal data when you use the Apex app, visit our website at apexrides.com, or otherwise interact with us, and tells you about your privacy rights and how the law protects you.

This policy covers both our website and the Apex mobile app. Where a section applies only to one or the other, we say so.

Our services are not intended for children and we do not knowingly collect data relating to children.

2. Who we are and how to contact us

Apex Rides Digital Limited is the controller responsible for your personal data.

Full name of legal entity: Apex Rides Digital Limited
Company number: 15081041
Registered office: Pavilion, 81-83 Fulham High Street, London, SW6 3JW
Email: hello@apexrides.com

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

3. The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, use, store and transfer the following kinds of personal data:

Identity Data: first name, last name, username or similar identifier.
Contact Data: email address, billing address and telephone number.
Account Data: your login credentials, account settings and preferences.
Subscription and Transaction Data: your subscription plan, subscription status (active, paused, cancelled), payment history, discount codes used, and details of purchases. Payments are processed by our payment providers (see section 7). We do not store full payment card details ourselves.
Workout Data: classes you have taken, workout history, and performance metrics generated during a class such as output, cadence, resistance and speed, including data received from a compatible exercise bike you connect to the app via Bluetooth.
Connected Device Data: information about exercise bikes and sensors you connect to the app, such as device make, model and connection status.
App Usage Data: information about how you use the app, including features used, screens viewed, classes browsed, searches, session length and in-app events.
Technical Data: device type, operating system and version, app version, unique device identifiers, IP address, crash logs and diagnostic information. For the website, this also includes browser type and version, time zone setting and browser plug-in types.
Marketing and Communications Data: your preferences in receiving marketing from us, and your communication preferences.
Support Data: the contents of your communications with our customer support team.

We also collect, use and share Aggregated Data, such as statistical or demographic data. Aggregated Data could be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data), and we do not collect information about criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a subscription). We will notify you if this is the case at the time.

4. How is your personal data collected?

We collect data from and about you through:

Direct interactions. You give us Identity, Contact and Account Data when you create an account, subscribe to our service, contact customer support, sign up to our mailing list, or otherwise correspond with us.
Your use of the app. As you use the Apex app, we automatically collect App Usage Data, Workout Data, Connected Device Data and Technical Data. This includes data generated when you connect a compatible exercise bike to the app.
Your use of the website. As you interact with our website, we automatically collect Technical Data using cookies and similar technologies. See section 8.
Third parties. We receive Subscription and Transaction Data from our payment and subscription providers (Shopify, Skio, Apple and Google), and confirmation of app installs from the app stores and our attribution provider.

5. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will get your consent before sending you direct marketing communications by email where the law requires it, and before processing data for advertising attribution (see section 6). You have the right to withdraw consent at any time by contacting us.

Purposes for which we will use your personal data

Purpose/Activity	Type of data	Lawful basis
To register you as a new customer and administer your account	(a) Identity (b) Contact (c) Account	Performance of a contract with you
To provide the Apex service, including streaming classes, connecting your bike and recording your workouts	(a) Identity (b) Account (c) Workout (d) Connected Device (e) Technical	Performance of a contract with you
To process your subscription and payments, including managing renewals, discounts, refunds, and collecting money owed to us	(a) Identity (b) Contact (c) Subscription and Transaction	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you, including notifying you about changes to our terms or privacy policy, responding to support requests, and asking you to leave a review or take a survey	(a) Identity (b) Contact (c) Account (d) Support (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to understand how customers use our service)
To operate, monitor and improve the Apex app and website, including analysing feature usage, diagnosing issues, understanding customer journeys and improving performance	(a) Account (b) Subscription status (c) Technical (d) App Usage (e) Workout (f) Diagnostic information	Necessary for our legitimate interests (in operating, maintaining and improving our services)
To measure the effectiveness of our advertising, including attributing app installs to marketing campaigns	(a) Technical (b) App Usage	Consent
To administer and protect our business, the app and the website, including troubleshooting, system maintenance, security, fraud prevention and hosting of data	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (running our business, network security, preventing fraud) (b) Necessary to comply with a legal obligation
To send you marketing communications about our classes, features and offers	(a) Identity (b) Contact (c) Marketing and Communications (d) App Usage	Necessary for our legitimate interests (to grow our business), or consent where required by law
To make suggestions and recommendations to you about classes and content that may be of interest to you	(a) Account (b) App Usage (c) Workout	Necessary for our legitimate interests (to develop our service and improve your experience)

6. Product analytics

We use product analytics tools to understand how customers use our website and mobile app, improve features, identify technical issues and enhance the overall user experience. This includes analysing which classes and features are most used, where customers encounter problems, and how customers move through the app.

This processing is based on our legitimate interests in operating, maintaining and improving our services. We have balanced those interests against users' privacy rights and implemented safeguards to minimise the impact on individuals. Analytics data is used only by Apex and our analytics providers acting on our instructions; it is not shared with third parties for their own purposes and is not used for third-party advertising.

Your choices. You can object to analytics processing at any time, free of charge, by contacting us at hello@apexrides.com. If you object, we will stop collecting analytics data from your device.

Advertising attribution. Separately from product analytics, we may use an attribution tool (AppsFlyer) to measure the effectiveness of our advertising, for example to understand which campaign led to an app install. Because this involves advertising measurement, we will only do this with your consent, which you can withdraw at any time in the app's settings. On iOS, this is also subject to Apple's App Tracking Transparency framework.

7. Analytics and service providers

We use a small number of trusted third parties to run our business. They process personal data on our behalf and only on our instructions, except where noted. The main providers are:

PostHog - product analytics for the app and website (see section 6).
AppsFlyer - mobile advertising attribution, used only with your consent (see section 6).
Shopify - our e-commerce platform, which hosts our website and processes orders.
Skio - subscription management for memberships purchased through our website.
Apple App Store and Google Play - process in-app subscription purchases made through the app stores. Apple and Google act as independent controllers for the payment data they process; their own privacy policies apply to those payments.
Klaviyo - email marketing and customer communications.
Gorgias - customer support ticketing.
Cloud hosting and content delivery providers - hosting of the app's backend and streaming of class content.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where they act as our processors, we do not allow them to use your personal data for their own purposes.

8. Cookies and similar technologies

Our website and app use cookies and similar technologies (such as SDKs and local storage).

Strictly necessary technologies are used to make the website and app work, for example to keep you logged in and to process your basket at checkout. These do not require consent.
Analytics technologies are used solely to collect statistical information about how our website and app are used, in order to improve them. Under UK law these do not require consent, but you have the right to object at any time, free of charge, as described in section 6, or through your browser settings on the website.
Advertising and attribution technologies are only used with your consent.

You can set your browser to refuse cookies, but some parts of the website may not function properly if you do.

9. Disclosures of your personal data

We may share your personal data with:

The service providers listed in section 7, for the purposes described in this policy.
Professional advisers, including lawyers, bankers, auditors and insurers, where necessary.
HM Revenue & Customs, regulators and other authorities where required.
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy policy.

10. International transfers

Some of our service providers are based outside the UK, or store data outside the UK. Where we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by using one or more of the following safeguards:

Transfers to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.
Transfers to organisations in the United States that participate in the UK Extension to the EU-US Data Privacy Framework.
The UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

11. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

12. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

Account, subscription and workout data is retained for as long as your account is active. If you close your account, we will delete or anonymise this data within 24 months, except where we need to keep it for the purposes below.
Transaction records are retained for six years after the end of the tax year in which the transaction took place, for tax and accounting purposes.
Analytics data (app events and session data) is retained in identifiable form for 24 months from collection, after which it is deleted or anonymised.
Support correspondence is retained for 24 months after the ticket is closed.

In some circumstances you can ask us to delete your data: see section 13. In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

13. Your legal rights

Under data protection law, you have rights in relation to your personal data, including the right to:

Request access to your personal data (a "data subject access request").
Request correction of the personal data that we hold about you.
Request erasure of your personal data where there is no good reason for us continuing to process it.
Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object. You can object to analytics at any time (see section 6), and you can object to direct marketing at any time using the unsubscribe link in any marketing email.
Request restriction of processing of your personal data in certain circumstances.
Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format.
Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of these rights, please contact us at hello@apexrides.com.

No fee usually required. You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or refuse to comply with your request in these circumstances.

What we may need from you. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated.

Complaints. If you have a complaint about how we handle your personal data, please contact us at hello@apexrides.com and we will respond in accordance with our complaints procedure. You also have the right to complain to the ICO at any time.

14. Changes to this privacy policy

We keep this privacy policy under regular review. We will notify you of significant changes by email or through the app. It is important that the personal data we hold about you is accurate and current, so please keep us informed if your personal data changes during your relationship with us.

15. Third-party links

Our website and app may include links to third-party websites and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements.