Privacy Policy

Account data: your email, name if you give one, password (hashed, never stored in plain text), and billing status. Payments are handled by Stripe — we never see or store full card numbers.

Product data: your searches, saved leads, outreach drafts and send history, generated sites and agents, and settings such as your offer description and business address (used in your email footer).

Usage data: pages viewed, features used, device and browser type, IP address, and similar analytics, plus error reports. Marketing attribution (utm parameters and ad click IDs) is stored in a first-party cookie for 90 days and written to your account at checkout.

Legal acceptances: when you check the boxes at checkout we store what you accepted, the version, your IP address, browser, and the time — that record protects both of us.

If you connect your own email-sending account, the key is stored encrypted in Supabase Vault (encryption at rest with keys we do not hold in application code), is never written to logs, and is never returned to your browser after you save it — the app shows only the last four characters. Deleting the connection deletes the stored key.

To run the product, bill you, prevent abuse, comply with law, and improve the service. AI generation requests are sent to our model provider with the business data needed to write the output — never with your password or API keys. We do not sell your personal information.

The businesses shown in search results are compiled from Google’s Places API and from those businesses’ own public websites. This is business contact information about companies, handled under Google’s terms (including freshness rules — cached copies are refreshed or deleted on a schedule). If your business appears and you want your contact details suppressed from a customer’s account, use the report link on any demo page or email support@vexaengine.com.

Companies that process data to run the service:

• Supabase — database, authentication, file storage, key vault
• Vercel — application hosting
• Stripe — payments and billing
• Anthropic — AI text generation
• Google (Places API) — business search data
• Resend — email delivery (platform email, and your connected account)
• Vapi — voice agent calls
• Firecrawl — website reading for agent building
• Inngest — background job processing
• Upstash — rate limiting
• Sentry — error reporting (API keys and email bodies are scrubbed)
• PostHog — product analytics
• Cloudflare — bot protection on public forms
• Meta and TikTok — ad conversion measurement (hashed email and click IDs only)

Your data is kept while your account is active. If your subscription ends, your workspace data is retained for 90 days (so you can come back), then deleted on a rolling schedule. Legal acceptance records, invoices, and records we must keep for tax or dispute purposes are kept as the law requires. To request deletion sooner, email support@vexaengine.com from your account address — we verify, then delete within 30 days, and confirm.

Depending on where you live you may have rights to access, correct, export, or delete your personal information, and to object to certain processing. Email support@vexaengine.com and we’ll honor them. We don’t discriminate for exercising them.

Traffic is encrypted in transit; data is encrypted at rest; access to production is limited and logged. No system is perfectly secure — if a breach affects your data we will notify you without unreasonable delay, as the law requires.

If this policy changes materially we’ll notify you by email or in the app before the change takes effect. Contact: Vexa Automations LLC dba Vexa Engine, Oklahoma, USA — support@vexaengine.com.