How we handle what you tell us
Privacy Policy
Bad Boss Clinic is a service of Apex Advisory. Apex Advisory is the data controller for everything described below. We only collect what the service needs, we never sell it, and you can have it deleted at any time.
Last updated 23 September 2026
Who we are
- —Apex Advisory, trading as Bad Boss Clinic.
- —Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa
- —Company registration: Apex Advisory
- —VAT number: EE102743977
- —Data protection contact: info@apexadvice.com
What we collect
- —Booking details — your name, email address, chosen session, timezone and the notes you add.
- —Pre-session assessment — the Big Five and Dark Triad answers you submit before a session, and your written description of the situation.
- —Client portal — your account email, a hashed password (or a Google sign-in identifier), assessment scores, the incidents you log, your conversations with the AI advisor and the reports generated from them.
- —Payment metadata — the amount, currency, status and Stripe identifiers of a payment. Card numbers are entered on Stripe's own checkout and never reach our servers.
- —Attribution and usage — the campaign or link that brought you here, the pages you visited and the actions you took, stored first-party in our own database.
Why we are allowed to hold it
- —Performance of a contract — to run the session or subscription you paid for.
- —Consent — for marketing emails and for contributing an anonymised version of your case to our research base. Both can be withdrawn at any time.
- —Legitimate interest — to keep the service secure, to understand which campaigns work, and to improve the clinic's methods.
- —Legal obligation — to keep invoices and tax records for the period the law requires.
AI processing
- —The AI advisor, the report writer and the session recap drafts run on Anthropic and OpenAI models through a processor agreement. Your text is sent to them to produce your answer and is not used to train their models.
- —Nothing you write is reviewed by a human outside the clinic, and reports are never shared without a link you create yourself.
Research contributions
- —The clinic maintains an anonymous research base of leadership cases. If you do not opt out, a numbers-only version of your case is added: coded behaviours, trait ratings, country, occupation, age band and leader gender.
- —No name, email, employer or free text is ever included, and your reference is a one-way hash. You can switch this off, or withdraw everything you have contributed, from the portal dashboard at any time.
Who else sees your data
- —Stripe (payments), Google Workspace (email and calendar), Anthropic and OpenAI (AI processing), Resend (backup email delivery) and our hosting provider. Each acts as a processor under contract.
- —We never sell personal data and we do not share it with advertisers.
How long we keep it
- —Portal accounts and reports: until you delete your account, or after three years of inactivity.
- —Booking and payment records: seven years, because tax law requires it.
- —Marketing and attribution events: 24 months.
Your rights
- —You can ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format.
- —Email info@apexadvice.com and we will answer within 30 days.
- —If you are in the EU or UK and you are not happy with our answer, you can complain to your national data protection authority.
Cookies and local storage
- —We use your browser's local storage to keep you signed in and to remember which campaign brought you here. Analytics are first-party and stored in our own database.
- —We do not set third-party advertising cookies on this site.
International transfers
- —Some processors are based outside the EEA. Those transfers rely on the European Commission's standard contractual clauses.
Apex Advisory · Harju maakond, Tallinn, Lasnamäe linnaosa · Apex Advisory · VAT EE102743977 · info@apexadvice.com