Privacy
Privacy notice
What we collect when you visit our website, ask for early access, or use VEXEN, and what happens to it. In plain words.
Last updated 27 October 2026
VEXEN · 4633 Coit Rd Ste 340, Frisco, TX 75035, USA · hello@vexenhq.com
In this notice, “VEXEN”, “we” and “us” mean the business that runs VEXEN, at the address above.
Two roles
VEXEN handles two kinds of information, and our responsibility is different for each:
- About you, our customer: the people who sign up, log in and pay. For this we decide how it's used, as described on this page.
- Your business's own data inside VEXEN: your records, contacts, chats with your website visitors, your client portal and files. That belongs to your company. We store and process it only to run VEXEN for you and on your instructions; your company decides what goes in and who sees it.
Our website and the early-access form
When you send the early-access form, we receive what you typed in it (name, work email, company, website, industry, team size, the tools you use and your message), which page you sent it from, any ad-campaign tags in the page address (utm_source and similar, cut to 200 characters each), your IP address for spam protection, and the date and time. A hidden field that people never see catches spam bots; anything that arrives with it filled in is thrown away.
We use these details to reply to you and arrange a demo, to see which pages and campaigns bring in requests, and to keep the form free of abuse. The website sets no cookies. It loads fonts from Google Fonts, so your browser connects to Google's servers to download them.
Your VEXEN account
- Name and email
- To create your account, sign you in and send you codes, invites and notices.
- Password
- Stored only as a one-way scrambled form (a hash), never readable, not even by us.
- Two-step sign-in
- The secret your authenticator app uses, so we can check your codes.
- Sign-in records
- When and from which IP address and browser you signed in, and security events such as failed codes. Used to keep your account safe.
- Billing
- Your plan and whether it's paid. Card details go straight to Stripe; VEXEN never sees or stores them.
- Activity in your company
- A history of changes (who changed which record, and when), shown to your team.
VEXEN uses a cookie to keep you signed in, and the client portal uses its own cookie to keep a business's clients signed in to their portal. Both are needed for the app to work, so there's no setting to turn them off. We don't use advertising or tracking cookies in the app.
Your customers' data
When you use VEXEN, it stores what you and your team put in, and what your own customers send through the tools you switch on:
- Records and contacts: names, companies, emails, phone numbers, values, notes and costs.
- Website chat: messages from visitors to your website, the page they were on, and a name and email if they give them. Their browser keeps a random token so they see their own conversation; we store only a scrambled form of it, and their IP address for spam protection.
- Client portal: your clients' email addresses, sign-in codes (scrambled, valid 15 minutes), their messages and approvals.
- Files: documents and images you or your clients share, stored with Cloudflare.
We process this only to provide VEXEN to your company. We don't use it for our own marketing, we don't sell it, and we don't look at it except when you ask us to help, or when needed to keep the service secure or meet the law. If you use VEXEN to collect information from your own customers, you're responsible for telling them, for example in your own privacy notice.
Who processes it for us
We use these providers to run VEXEN. Each may use the information only to provide its service to us:
- Supabase
- Database: where your account and your company's data are stored.
- Railway
- Hosting: runs the VEXEN app.
- Cloudflare
- Hosts this website, delivers our email address, and stores shared files.
- Resend
- Sends our emails (codes, invites, notifications).
- Stripe
- Takes payments and handles subscriptions and invoices. Depending on where you are, Stripe may act as the seller and handle sales tax.
- Google Fonts
- Delivers the fonts on our pages.
Some of these providers store information in the United States. We never sell your details, and we don't share them with advertisers.
How long we keep it
- Early-access requests: while we're talking to you; if you don't become a customer, deleted automatically 12 months after our last contact.
- Your account and your company's data: for as long as your company uses VEXEN. When an owner closes the company, its data and stored files are deleted, and its billing details are removed from Stripe (database backups roll over within 30 days; Stripe keeps payment records the law requires).
- Sign-in sessions and codes: deleted when they expire.
- Security and change history: up to 12 months.
- Billing records: kept by Stripe and by us as long as tax and accounting law requires.
How we protect it
All connections are encrypted. Owners and admins must use two-step sign-in. Each company's data is kept apart from every other company's, and people inside a company see only what their role allows. Passwords and codes are stored scrambled. Shared files can only be opened through short-lived links.
Your rights
You can ask us for a copy of the information we hold about you, to correct it, or to delete it. Email hello@vexenhq.com from the address you use with VEXEN and tell us what you'd like; we'll reply within 30 days. Company owners can also download their company's data from VEXEN (Settings → Company data).
If you're a customer of a business that uses VEXEN (for example, you chatted on their website or use their client portal), please contact that business first: they decide what happens to your information, and we'll help them.
If something here isn't clear, or you think we've got something wrong, write to the same address.
Changes to this notice
If we change how we use information, we'll update this page and the date at the top, and tell account owners by email about any important change.