Privacy notice
How A.P. DO IT handles account, business-listing, workspace and support information, and how to make a privacy request.
Version 2026-10-21.2
Who is responsible
Mythos Quill Press LLC d/b/a MythosWebStudio operates A.P. DO IT from Salisbury, Maryland 21801. Contact hello@mythoswebstudio.dev for privacy questions. Our customer pilot serves Maryland businesses. This notice covers this service, not unrelated Mythos products or websites you visit through a listing.
We determine the purposes of account administration, our listing catalog, billing, support and service security. For personal information an organization places in its private workspace, that organization generally determines the purpose and we process it on its instructions under the Data processing addendum. We will identify the appropriate organization when a request concerns its content, without disclosing another tenant’s private data.
Information we handle
You provide account email, business and organization information, memberships, saved searches and prospects, contact details, notes, custom fields and support or privacy requests. We keep service usage, source provenance, dated website findings, role changes and necessary security/audit records. Authentication providers handle password hashes and enrolled factors. We do not ask for passwords or authentication codes in support requests.
Our licensed listing catalog contains business names, categories, published addresses and map coordinates, websites, available business contact channels, operating status, source references and confidence information. It comes from the sources identified on the Data sources page and from submitted corrections. Public availability is not proof that every record is correct or that outreach is permitted.
Stripe collects payment details on its hosted pages. We retain provider references, subscription state, invoice/tax/refund information and the billing acknowledgment and confirmation needed to administer a purchase. We do not receive or store full card numbers or CVCs. Network requests also expose information such as IP address, browser/user-agent, request time and page or resource URL to the relevant service provider.
Do not upload government identifiers, payment-card data, credentials, health or biometric information, sensitive personal characteristics, children’s information or private precise location. The service is for adults acting for businesses. We do not request device geolocation; map positions represent business listings or a location you enter.
Why we use information
We use information to authenticate users, enforce organization access and plan limits, provide discovery and requested checks, maintain private prospect workflows, deliver permitted exports, process payments and cancellations, answer requests, correct or suppress listings, secure the service and meet legal/accounting obligations. We minimize information used for each purpose. We do not use private workspace notes to create a public listing product or train a general-purpose AI model.
We do not run targeted advertising or use scores for credit, housing, employment, insurance, health-care or other consumer eligibility decisions. We do not send prospect campaigns from the app. If we introduce a materially different use requiring consent, we will explain it and obtain that consent first; accepting general service terms is not that consent.
Retention and deletion
We keep active workspace information while needed to provide the requested service. The following schedule governs records we control; deletion is an operator-verified process, not an instant action triggered by submitting a form. A documented legal requirement, unresolved dispute, security investigation or shared-workspace ownership issue can require a limited exception. We will explain a relevant exception and limit retained information to its purpose.
Provider diagnostic and security records follow the applicable provider’s service and legal retention limits; our application schedule does not shorten records a provider must independently keep. Standard managed Pro database backups use a rolling seven-day retention window. Deleted data can remain in a restricted backup until it expires, and approved deletion/suppression decisions must be reapplied before restored data is returned to service. We cannot recall copies another person previously downloaded.
| Record category | Operating retention |
|---|---|
| Closed account/workspace content | Remove or de-identify from active systems within 30 days after verified closure and resolution of shared ownership, except documented legal holds. A cancellation alone does not close an account. |
| Application-managed routine debug logs | Up to 30 days from creation. Provider-hosted diagnostic logs have their own rolling limits; unnecessary sensitive payloads must not be logged. |
| Application security/audit evidence | Up to 180 days from the event, unless a specific investigation, contract or legal hold requires longer. Billing consent evidence follows the financial-record rule. |
| Closed nonfinancial support/privacy cases | Up to 24 months after closure, keeping only information needed to document the request and result. |
| Invoices, tax/refund and billing acknowledgment records | Seven years after the relevant tax year ends, limited to accounting, transaction and legal evidence; longer only when a legal requirement or documented hold applies. |
| Listing suppression markers | Only the minimum identifiers needed, for as long as necessary to prevent prohibited reimport or redisclosure. |
| Manual encrypted recovery copies | Off-device application-data snapshots are removed within seven days of creation; drill copies within seven days after an accepted drill. A documented investigation hold may require longer restricted retention. Recovery keys are stored separately. |
Access, correction, deletion and opt-out requests
Use Contact & privacy requests or email hello@mythoswebstudio.dev. You may request access or a portable copy, correction, deletion/account closure, listing removal, an applicable sale/advertising/profiling opt-out, or withdrawal of optional consent. Include enough information to locate the account or listing and state your request. Do not send identity documents, passwords, authentication codes or full card details. Authorized agents can contact us with appropriate evidence of authority.
We may reasonably verify account ownership or authority before disclosing, correcting or deleting protected information. For an opt-out, we request only information reasonably needed to locate and honor it and do not require account creation or authentication where law does not require it. Withdrawing consent does not make earlier lawful processing unlawful. Where processing depends on consent, we stop that processing as soon as practicable and within 30 days where applicable.
We respond to rights requests within 45 calendar days of receipt. Where applicable law allows and the request’s complexity or number reasonably requires it, we may extend once by up to 45 additional days, explaining why before the initial deadline. We do not silently restart the clock for verification. We explain a refusal and how to appeal. Exercising a right does not cause unlawful discrimination or a fee for ordinary request handling.
Removal can stop future display and reimport of the identified source record; complete deletion may also require action on account data, contact copies, vendors and backups. We will describe what we fulfilled and any justified retention. A request for your own information does not authorize disclosure or deletion of another organization’s records.
Appeals and complaints
If you disagree with a privacy decision, choose Appeal a privacy decision on the public form or email hello@mythoswebstudio.dev with “Privacy appeal,” the request reference and the reason. We review the appeal and give a written explanation within 60 days of receipt. If we deny an appeal, we provide the available Maryland Attorney General complaint mechanism. You may also contact the Attorney General directly without first waiving any right or remedy.
Security, locations and notice changes
We use access controls, organization isolation, protected server credentials, HTTPS and appropriate authentication safeguards. No system can guarantee absolute security. Report suspected exposure privately to hello@mythoswebstudio.dev. We investigate and provide notices required by applicable law; no public security certification or guaranteed recovery time is created by this notice.
Providers may process information in the United States and other locations permitted by their contracts and applicable law. This Maryland business pilot is not offered as an international consumer service. We post a new effective date when this notice changes and notify affected account contacts before materially incompatible processing or when law requires. Contact us to request a copy of the notice that applied to a prior transaction.
Make a request
Email hello@mythoswebstudio.dev or see the Maryland Attorney General’s complaint instructions about a privacy complaint. The Attorney General determines which matters it can handle; ordinary disputes between businesses may fall outside its mediation service.