Privacy Policy

1. Who this covers

This Privacy Policy explains how Vexora ("Vexora", "we", "us") handles information when you visit vexoracrm.com, sign up an agency, or use an agency's Vexora workspace as an owner, manager or agent. It applies alongside our Terms of Service.

Two roles matter here. For the information an agency and its users put into Vexora ("Agency Data"), the agency is the controller and Vexora is its processor: we act on the agency's instructions. For account, billing and website information, Vexora is the controller.

2. What we collect

• Account information. Name, email, mobile number, password (stored only as a one-way hash), agency name, web address, industry, role and level.
• Billing information. Plan, agent count and invoices. Card details go directly to Stripe; we never see or store full card numbers.
• Agency Data. Whatever an agency's users enter: clients and customers, policies or installs, deals, commissions, leads, recruits, licenses, notes and uploaded files such as logos.
• Usage and device information. Log-ins, pages used, approximate location from IP address, browser and device type, and error logs, used to keep the service working and secure.
• Communications. Emails and texts sent through Vexora (invites, password resets, notifications) and messages you send to support. If an agency uses the dialer, call metadata and any recordings the agency chooses to make.

3. How we use it

• To provide the service: sign-in, calculating commissions, leaderboards, lead distribution, dialing, branding, and sending the emails and texts the agency triggers.
• To bill the agency and keep the agent count in sync with billing.
• To keep Vexora secure, prevent abuse, and fix problems.
• To answer support requests and send service notices (outage, billing, security, changes to these terms).
• To improve Vexora using aggregated, de-identified usage information that does not identify any agency, agent or client.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use Agency Data to train AI models or to market to an agency's clients, leads or agents.

4. Who we share it with

We share information only with providers that help us run Vexora, each under contract to use it solely for that purpose:

• Supabase (database, authentication and file storage) and Netlify (hosting and serverless functions).
• Stripe (payments and subscriptions).
• Resend (transactional email) and Twilio (text messages, phone numbers and voice calls).

We may also disclose information when the law requires it, to protect the rights and safety of Vexora, our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply.

Inside an agency. Agency owners and managers can see the agents, deals, leads and performance within their own agency. Agents see their own book of business and whatever the agency chooses to show on leaderboards. Agencies are kept separate from one another.

5. Calling, texting and recording

Agencies that use the dialer or texting features are responsible for complying with the TCPA, state telemarketing laws, Do-Not-Call rules and call-recording consent laws in their and their contacts' states. Vexora provides tools (consent flags, DNC marking, opt-out handling) but the agency decides who is contacted and whether calls are recorded.

6. Cookies and local storage

Vexora uses only the cookies and browser storage needed to keep you signed in and remember settings such as your last page or filters. We do not use advertising or cross-site tracking cookies. Stripe sets its own cookies on checkout for fraud prevention.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to each agency's data is enforced at the database level with row-level security, so one agency can never read another's records. Passwords are hashed. Access to production systems is limited to the people who need it. No system is perfectly secure; if we learn of a breach affecting your information we will notify affected agencies without undue delay and as the law requires.

8. Retention and deletion

• Agency Data is kept while the agency's account is active.
• After cancellation or suspension, the agency can request an export for 30 days. After that we may delete the data, except for records we must keep by law (such as invoices) and copies that remain in encrypted backups for a limited period.
• An agent whose account is removed by their agency no longer has access; their historical deals remain part of the agency's records because the agency owns them.

9. Your choices and rights

Depending on where you live (including under the CCPA/CPRA and similar state laws), you may have the right to know what personal information we hold about you, to correct it, to delete it, to get a copy of it, and to not be discriminated against for exercising those rights. Email support@vexoracrm.com and we will respond within the time the law allows, after verifying who you are.

If your information is in an agency's workspace as a client, lead or agent, the agency controls it. We will pass your request to the agency and help them respond.

You can opt out of texts by replying STOP, and out of non-essential emails with the link in the email. Service notices (billing, security, password resets) still go out while you have an account.

10. Children

Vexora is a business tool for adults. We do not knowingly collect information from anyone under 18. If you believe a minor's information has been entered, contact us and we will remove it.

11. Where data lives

Vexora is operated from the United States and data is stored on servers in the United States. If you use Vexora from elsewhere, you are sending your information to the U.S.

12. Changes

When we change this policy we will update the effective date above and, for material changes, notify agency owners by email or a notice inside Vexora before the change takes effect.

13. Contact

Privacy questions or requests: support@vexoracrm.com