Privacy Notice

1. Introduction

Vexaro provides the Service: the Vexaro Desk, Vexaro Security, and Vexaro Development products, and Vexaro Mesh once it is available (it is in development), together with the related software, Vexaro Agent, APIs, websites, and Documentation. Anyone may use the Service for business, commercial, or personal purposes.

This Notice describes how we handle Personal Data in connection with the Service: the categories of information involved, the purposes for which we use it, the limited circumstances in which we share it, how long we keep it, and the rights and choices available to you. It applies to visitors to our websites, to Customers and their Authorized Users, and, in the limited respects described below, to End Users whose data is processed through the Service under a Customer’s control.

This Notice does not change the commercial terms of your relationship with us, which are set out in the Terms of Service, the applicable Product Supplement, and your Order Form. We operate a privacy and security program designed for business use across multiple regions; this Notice explains how that program applies to your data.

2. Role of Vexaro: Controller and Processor

The role Vexaro plays depends on the type of data, because the Service involves two distinct categories of processing.

2.1 Vexaro as an independent controller

For data Vexaro needs to run its own business and to make the Service available, Vexaro acts as an independent controller, which means that Vexaro determines the purposes and means of that processing. This category includes:

• account and identity data (registration details, profile details, Authorized User records, authentication data);
• invitation-programme records (Section 3.7);
• billing and payment-metadata records;
• product, device, and connection metadata generated through operation of the Service (except connection and session data that specifically identifies the Customer’s End Users, which is handled as processor data on the Customer’s behalf, as set out in the Data Processing Addendum);
• security, fraud-prevention, audit, and abuse-handling data;
• communications between you and Vexaro (support requests, notices, and, where you opt in, product communications).

For this category, Vexaro is responsible for the processing described in this Notice and is the point of contact for the privacy rights set out in Section 10.

2.2 Vexaro as a processor

For Customer Content (the data and material the Customer or its users provide to, create in, transmit through, or generate via the Service), Vexaro acts as a processor (a service provider acting on the Customer’s behalf). The Customer is the controller of that Customer Content and determines what is transmitted, who may access it, and how it is configured, retained, and used.

Where Vexaro processes Customer Content as a processor, it does so on the Customer’s documented instructions and as described in the Terms of Service and the Data Processing Addendum, which governs that processing and prevails over this Notice for Customer Content. Subprocessors engaged for this purpose are listed in the Subprocessor List.

2.3 What this means in practice

When you interact with Vexaro about your own account, billing, or security, Vexaro is answering as a controller. When the question concerns the content of a Customer’s sessions, files, Recordings, or network data, that content belongs to the relevant Customer; Vexaro will direct such requests to the Customer, who controls the data, and will support the Customer in responding as required under the Data Processing Addendum.

3. Information We Collect

We collect the following categories of information. Not every category applies to every user; what is collected depends on the Products you use and how you configure them.

3.1 Account and identity data

When an account is created, we collect registration details such as name, email address, organisation name, and authentication credentials. When you sign up on our website, we send a confirmation link to your email address; we store only a hash of the link’s code, and the link works once, for 48 hours. Your profile holds your first and last name and your country, both required, and an optional job title. You can edit your profile yourself. Where Vexaro stores a password, it is kept only in hashed form using industry-standard techniques, never in plain text; where you use single sign-on or directory provisioning, Vexaro may not hold a password at all. We also collect the records needed to manage Authorized Users, roles and permissions (RBAC), and, where the Customer uses it, directory-provisioning data via SCIM.

For each sign-in to a Vexaro app or to the web account we keep a sign-in record: the kind of app (desktop, mobile, web, or console), the app’s name and version, the device name and platform the app reports, when the sign-in started and was last used, and the IP address it last used. You can see your sign-ins in your web account and end any of them there, and an owner or administrator of your organisation can see and end the sign-ins of its members. A desktop or mobile sign-in ends after 90 days without use; a browser sign-in ends after 7 days without use and in any case 30 days after it started.

3.2 Device data

The Vexaro Agent and the Service collect technical information about the devices used to access the Service, such as operating-system type and version, hostname, hardware or device identifiers used to recognise and manage enrolled devices, and Agent version. This data supports authentication, device management, and the policy engine.

Every computer that runs the Vexaro app has a Vexaro ID. So that the ID stays with that computer, we keep the ID with a one-way hash of a secret that only the app on that computer holds, and when the computer was last online. We also keep, for each day a computer is online, its Vexaro ID, operating system, app version, and kind of installation (installed or portable), and, when a computer is given a new Vexaro ID, the date, the same details, and whether the new ID replaced one the computer could not get back. These records contain no computer name, no account, and no IP address. We use them to keep IDs stable, to count active computers and new installations, and to plan capacity.

3.3 Connection metadata

To establish and maintain sessions and connectivity, we process connection metadata, including connection timestamps (start and end), session duration, round-trip-time (RTT) and connection-quality metrics, the IP addresses of the participating endpoints, and the relay path used (direct P2P or relay). This metadata describes the connection; it is not the content carried over it. The session history keeps, for each Desk session, the Vexaro IDs and names of the computers, the accounts involved, the start and end times, the relay used, and why the session ended, and, for each file transferred in a session, its name and size. On the Free plan, the Vexaro app and the browser viewer show a small “Vexaro Free” badge in a corner of the session. The viewer draws the badge on its own screen as a plain label for the plan. It involves no data about you, the other computer, or the session, and nothing is collected because of it.

3.4 Payment metadata

Where you purchase a Paid Plan, payment is processed either by Vexaro directly (with our payment processor handling the card) or by an authorised reseller acting as Merchant of Record, depending on your checkout method. Where an authorised reseller acts as Merchant of Record, that provider’s buyer terms also apply to the payment, tax, and refund of that purchase. In either case, we receive only payment metadata: payment-provider customer and subscription references, the plan, amounts, and payment status. We do not collect, receive, or store full payment-card numbers or equivalent full card data; that data is handled by the payment processor or Merchant of Record for the checkout. Payment paths and providers are described in the Billing Terms.

3.5 Support and communications data

When you contact us, we collect the information you provide, such as the content of support requests, correspondence, and the metadata of those communications, so that we can respond and keep a record. If you opt in to product communications, we keep the preferences needed to send and honour those choices. When you report a problem from a Vexaro app, the report can also include diagnostic logs, the crash details of the app, and a screenshot, if you choose to attach them, and we delete those logs, crash details and screenshots 90 days after we receive them. Crash details are the memory snapshot Windows saves when the app closes unexpectedly; they can contain fragments of what the app was handling at that moment, such as text being copied.

3.6 Categories of Customer Content

Through the Products, the Customer may transmit, create, or generate Customer Content. The categories include:

• Screen streams: live screen capture transmitted during a Desk session;
• Files: files transferred between participating devices in a Desk session;
• Clipboard data: clipboard content synchronised between devices in a Desk session;
• Recordings: captures of Desk sessions, made only when the Customer turns session recording on (Section 6). The screen video (without audio) is kept as a file on the Customer’s computers, never by Vexaro; Vexaro keeps the Recording’s details and a timeline of events on the host: keyboard shortcuts pressed with Ctrl, Alt, or the Windows key, the title of the host’s foreground window each time it changes, files received by the host and failed file transfers, and whether the Vexaro app on the host runs with elevated rights. Window titles can contain personal data, such as document names or email subjects;
• Mesh traffic metadata: once Vexaro Mesh is available, routing, connection, and configuration metadata associated with Mesh networking, controlled by the Customer.

As described in Section 2.2, Customer Content is processed by Vexaro as a processor on the Customer’s behalf. Live session media (screen streams, clipboard, and file transfer) is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. Section 6 describes session recording, whose files stay on the Customer’s computers.

3.7 Invitation programme

Vexaro runs an invitation programme. A participating user has a personal invitation link, and a person who signs up through that link counts as invited by the owner of the link. When you sign up from an invitation link, the sign-up form sends the invitation with your registration. If you have allowed optional cookies, the registration page also remembers the invitation in a cookie for 30 days, so that it can still be credited when you sign up later (see the Cookie Notice). The programme is separate from our partner referral programme. For the invitation programme we process:

• Who invited whom. The invitation link you signed up through, kept with your account and with the account of the person who shared it.
• Online days, for invited people only. For a person who signed up through an invitation, and for no one else, we record the days on which that person was online during their first 20 days after sign-up. A day counts when the person signed in, or renewed their sign-in, in any Vexaro app or in the console on that day (UTC). The record is only the date; it says nothing about what the person did. We use these days only to decide whether the invitation earns a reward, and we delete them as soon as that decision is made.
• The decision, points, and months. When the first 20 days have passed, we record the decision on the invitation and its date. For the person who invited, we keep the points earned and the months of a plan granted as a reward, with their dates.

On their Invite page, the person who invited you can see your name with part of it hidden, how many online days have counted so far, whether your profile is complete, and, once it has been made, the date of the decision. We use this information to credit invitations and to check that an invited account is in real use before a reward is granted.

3.8 Websites and downloads

When you visit our websites or a Vexaro app calls our API, our servers log each request: the time, your IP address, the page or address requested without its query part, the response, the referring page without its query part, and your browser’s or app’s user agent. We use these logs to keep the Service secure and working and to count visits; the visit counts we keep longer hold numbers only, nothing per visitor. Our websites load their pages, fonts, and images from Vexaro’s own servers, and use no third-party trackers.

When you download a Vexaro app, we record the version, platform, time, your IP address, and your browser’s user agent, and, when an installed app downloads an update, its Vexaro ID. We use these records to count downloads and installations and to detect abuse of the download service.

3.9 Records of what you accept

When you accept our terms or confirm a step that has legal weight, we keep a record of it. Each record holds who accepted (the account and its organisation, or, for a computer, its Vexaro ID), what was accepted and the versions of the documents in force at that moment, the words shown and their language, where it happened (our website, the web account, the Vexaro app, or the payment page), the time, and the IP address and the browser’s or app’s user agent of the request.

We keep such a record when an account is created, including through Google or an invitation; when an updated version of a document is accepted; when a paid plan is bought with the terms box ticked on the payment page; when an owner or administrator turns session recording on and confirms that the people concerned have been told (Section 6); and when a computer lets a remote session in: which computer and the account signed in there, if any, which Vexaro ID and account connected, in which mode, and the address of the computer’s request.

The records cannot be changed. You can see the records of your account in your web account, under Profile, and they are part of the copy of your data you can ask for (Section 10). When Vexaro personnel read these records, for example to answer a request, a dispute, or a legal claim, that is written to our audit log.

4. How We Use Information

We use information for the following purposes.

4.1 Service operation

To authenticate users; to establish, route, and maintain sessions and connectivity (including signaling and, where direct P2P is not possible, encrypted relay); to deliver Product features such as remote control, clipboard sync, file transfer, device management, and the policy engine; and to provide, maintain, and support the Service in accordance with your plan or Order Form.

4.2 Analytics and service improvement

To monitor performance and connection quality, diagnose and resolve technical issues, understand how the Service is used, and improve our Products and infrastructure. For these purposes we rely on aggregated, de-identified metrics that are not used to identify an individual. Aggregated, de-identified analytics may be retained as described in Section 9.

4.3 Account and billing administration

To manage accounts, Authorized Users, subscriptions, and entitlements; to administer trials (a new account gets a Team trial of one month, 30 days, once its email address is confirmed), plan changes, invoicing, and the collection of fees; to run the invitation programme described in Section 3.7; and to maintain the billing and payment-metadata records described in Section 3.4.

4.4 Security and fraud prevention

To detect, investigate, and prevent unauthorised access, abuse, fraud, and denial-of-service or other attacks; to maintain audit logs; to enforce the Terms of Service and the Acceptable Use Policy; and to protect the rights, safety, and security of Vexaro, our Customers, and others.

4.5 Communications

To send transactional communications that are necessary to operate the Service, such as account verification, security and policy notices, service and billing notices, and support responses. With your consent where required, we may also send optional communications such as product updates and announcements; you may opt out of optional communications at any time without affecting transactional ones.

4.6 Legal and contractual purposes

To comply with our legal and regulatory obligations, to respond to lawful and properly scoped requests, to keep records required under applicable financial-record and tax rules, to keep the records of what was accepted (Section 3.9) so that we can show what was agreed, when, and by whom, and to establish, exercise, or defend legal claims and enforce our agreements.

4.7 Our grounds for processing

Where Vexaro acts as a controller (Section 2.1), we process Personal Data because it is necessary to provide and administer the Service and perform our agreement with you; to pursue our legitimate interests in securing, improving, and protecting the Service; to comply with our legal obligations (including financial-record and tax purposes); and, for optional communications, on the basis of your consent where required. We keep the records of what was accepted (Section 3.9) because they are necessary to perform our agreement with you and for our legitimate interest in establishing, exercising, and defending legal claims. We do not make decisions producing legal or similarly significant effects about individuals based solely on automated processing without human involvement; where any automated checks are used (for example, for security or fraud prevention), they are subject to human review. Where applicable rules require a specific lawful basis, we rely on the basis permitted for that purpose.

5. Customer-Controlled Data and End-User Notice

A significant part of what flows through the Service is configured and controlled by the Customer, not by Vexaro.

The Customer determines how the Products are deployed and used, including:

• Desk: the plan it uses and which of its devices run the Vexaro app signed in to its account (the plan decides whether recording can be turned on; see Section 6), what files and clipboard data are transferred, and who in its organisation holds the owner, administrator, and auditor roles that give access to Recordings;
• Mesh: once Vexaro Mesh is available, the routes, DNS, gateways, keys, and other configuration, and the associated Mesh traffic metadata.

For all such Customer Content and Customer-controlled processing, Vexaro acts as a processor (Section 2.2) and follows the Customer’s instructions and configuration. The Customer, as controller, is responsible for the lawfulness of that processing.

In particular, the Customer is responsible for notifying its End Users about, and having a lawful basis for, the Customer’s use of the Service, including remote access to devices and sessions, monitoring, logging, and the recording of sessions on plans that include it. Where local rules require consent, notice, or other steps before an individual’s device, session, or network is accessed or recorded, the Customer is responsible for meeting those requirements with respect to its End Users. Vexaro provides features (such as on-screen consent for attended access, audit logging, and access controls on Recordings) to help, but the obligation to inform and obtain any necessary basis from End Users rests with the Customer.

If you are an End User with questions about how your device, session, or network is accessed, monitored, logged, or recorded, please contact the organisation that operates the relevant account; that organisation controls those settings and that data.

6. Recording

Live session media is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. A browser-viewed session is opened by a Vexaro server component (the browser bridge) to deliver it to the browser, without being stored. Vexaro does not store or inspect the content of live sessions in the ordinary course.

Recording is off unless the Customer turns it on. Session recording is off unless the Customer turns it on. On the Team, Business, and Enterprise plans (including the one-month Team trial), an owner or administrator of the Customer’s organisation can turn recording on in the administrative console and choose where the recording files are kept: on the computer that is accessed, on the operator’s computer, or on both. Before recording is turned on, the owner or administrator confirms in the administrative console that the people whose computers will be recorded have been told and that the organisation has a lawful basis to record them; that confirmation is kept as a record (Section 3.9) and appears in the organisation’s audit log. The operator’s computer keeps a copy only when the operator connects with the Vexaro Windows app and is a member of the Customer’s organisation; otherwise the computer that is accessed keeps the file. The files are written on those computers by the Vexaro Windows app (version 0.2.15 or later; older versions do not record) and are never uploaded to Vexaro. Vexaro stores only each Recording’s details (the session, the time, which computer keeps the file and where on it, its size and duration) and its event timeline, retained for the recording-retention period of the Customer’s plan; each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there. A Recording is Customer Content, and its details are accessible to the owners, administrators, and auditors of the Customer’s organisation. How recording works is described in the Recording & Monitoring Notice.

Accordingly, Vexaro does not store or inspect the content of live sessions, and it never receives the video of a Recording. Vexaro personnel do not access the details or timelines of Recordings in the ordinary course; where access is needed to provide or support the Service (for example, to resolve a support request you raise or to operate storage and backup), it is limited to the personnel who need it. When Vexaro personnel act in the Service as a user of the Customer’s organisation, that is recorded in the organisation’s audit log; access at the server level is not recorded in the audit log.

As noted in Section 5, the Customer is responsible for notifying its End Users about monitoring and recording and for having a lawful basis to do so. For the full description of how recording and monitoring work and the responsibilities involved, see the Recording & Monitoring Notice.

7. Sharing and Subprocessors

We do not sell Personal Data, and we do not share it with third parties for their own marketing.

We share Personal Data only as needed to operate the Service and as described in this Notice:

• With Subprocessors: third parties we engage to provide the Service (for example, server and relay hosting, edge delivery, payment processing, and email). Each Subprocessor is engaged under terms that require it to protect Personal Data and to process it only as needed to provide its service to us. The current Subprocessors are listed in the Subprocessor List.
• Within a Customer’s organisation: Customer Content and Customer-controlled data are made available to the people the Customer authorises in its organisation; the details of Recordings (which computer keeps each file and where) are shown to users with the owner, administrator, or auditor role.
• With the person who invited you: only the limited details listed in Section 3.7.
• For legal and protective reasons: where we believe in good faith that disclosure is necessary to comply with a legal obligation or a lawful and properly scoped request, to enforce our agreements, or to protect the rights, safety, and security of Vexaro, our Customers, or others.
• In a business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this Notice and applicable rules.

We do not list self-hosted Vexaro components as Subprocessors, because they are operated by Vexaro (or, in a Self-Hosted Deployment, by the Customer) rather than being third parties.

8. International Processing

Vexaro, LLC is established in the United States. Vexaro keeps the data it stores for the Service (accounts, device records, session history, audit logs, the details and timelines of Recordings, and backups) in one location, on servers that Vexaro operates at a hosting provider named in the Subprocessor List.

When two devices cannot connect directly, a session passes through a relay server that Vexaro runs at a hosting provider. Relays may be located in any region. A relay does not store session content; it keeps only technical logs, which it overwrites as they grow. As Section 6 explains, a relay forwards data it cannot read when both devices run version 0.2.13 or later of the Vexaro app; where one of them runs an older version, the relay and the provider that hosts it can technically access the content of a relayed session. A session viewed in a web browser is decrypted by Vexaro’s servers and by our edge provider, Cloudflare.

Personal Data is therefore processed outside the European Economic Area (EEA), the United Kingdom, and Switzerland, including in countries that are not covered by an adequacy decision. Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to such a transfer, we rely on an adequacy decision where one exists, including the EU-US Data Privacy Framework for recipients certified under it. Otherwise we rely on:

• the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 for the transfer of Personal Data to third countries, incorporated into our agreements with the relevant Subprocessors and, where applicable, with Customers under the Data Processing Addendum;
• for transfers subject to United Kingdom data-protection law, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018 (version B1.0, in force from 21 March 2022); and
• for transfers subject to Swiss data-protection law, the Standard Contractual Clauses as adapted for Switzerland under the Swiss Federal Act on Data Protection.

These safeguards are applied together with the technical and organisational measures described in Section 11. The providers that process Personal Data for us are named in the Subprocessor List. You can ask our Privacy Contact at [email protected] for a copy of the safeguards and for the countries in which your Personal Data is processed. Transfers of Customer Content, for which Vexaro acts as a processor, are governed by the international-transfer provisions of the Data Processing Addendum.

9. Data Retention

We keep Personal Data only for as long as needed for the purposes described in this Notice, after which it is deleted or de-identified. The principal retention model is:

• Session history (Section 3.3) is deleted 13 months after the session. The history of a session that has a Recording is kept for as long as the Recording’s details.
• Sign-in records (Section 3.1) are deleted 30 days after the sign-in ends.
• Computer records (Section 3.2): the hold of a Vexaro ID is deleted after the computer has been offline for 90 days, and the ID can then be given to another computer; the daily records and the records of new IDs are deleted after 400 days.
• Request logs of our websites and API (Section 3.8) are deleted after 30 days.
• Download records (Section 3.8): the IP address and user agent are erased 90 days after the download; the rest of the record stays for counting.
• Records of what was accepted (Section 3.9) are kept while the account they belong to exists and are deleted 6 years after it is erased, or 6 years after they were made when they belong to no account (for example, a computer used without signing in). The IP address and user agent in a record are erased 3 years after it was made. The records of an unconfirmed sign-up are deleted with it.
• Account data is retained while the account is active and then removed from active systems under our standard account-closure process, with residual copies removed from backups as they expire in the ordinary backup lifecycle.
• Audit logs are retained according to the Customer’s plan, configuration, and Order Form.
• Unconfirmed sign-ups (an account whose email address was never confirmed) are deleted 7 days after sign-up, together with the workspace created for them. Confirmation links expire after 48 hours.
• Invitation records (who invited whom, the decision on an invitation, and the points and months granted to the person who invited) are kept as account data. The online days of an invited person are deleted when the decision on the invitation is made.
• Recording details and timelines are retained for the recording-retention period of the Customer’s plan and are then deleted: 30 days on Team (including the Team trial), 90 days on Business, and without a fixed limit on Enterprise unless an Order Form sets one. Each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there; a copy the Customer makes elsewhere is the Customer’s to manage. The Customer’s owners and administrators may delete a Recording’s details earlier. Deleted details and timelines can remain in encrypted database backups until those backups expire in the ordinary backup lifecycle.
• Payment records are kept for the period required for financial-record, tax, chargeback, fraud-prevention, and accounting purposes.
• Aggregated or de-identified analytics may be kept where it cannot reasonably be used to identify an individual.

Where a Customer controls the data (for example, Recordings and other Customer Content), retention follows the Customer’s plan and configuration and the Data Processing Addendum, and may differ from the periods above. We may also retain Personal Data for longer where required to meet a legal obligation or to establish, exercise, or defend legal claims.

10. Your Privacy Rights

Depending on your location, you may have rights over your Personal Data, and you may have additional privacy choices. Subject to applicable rules, these can include the rights to:

• access a copy of the Personal Data we hold about you;
• correct Personal Data that is inaccurate or incomplete;
• delete Personal Data, where there is no overriding reason to keep it;
• restrict processing in certain circumstances;
• obtain your Personal Data in a portable format (portability);
• object to certain processing; and
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.

To exercise any of these rights for data where Vexaro acts as a controller (Section 2.1), contact the Privacy Contact at [email protected]. We may need to verify your identity before acting on a request. We will respond within the time required for your request type and location, and in any case within a commercially reasonable period. Exercising these rights will not lead to any discriminatory treatment.

Depending on your location, you may also have the right to lodge a complaint with the data-protection authority competent for you. We ask that you contact our Privacy Contact first so we can try to resolve your concern.

Where your request concerns Customer Content or other Customer-controlled data (Section 2.2), Vexaro acts as a processor; we will, without undue delay, forward your request to the relevant Customer, who controls that data and is responsible for responding, and will coordinate with that Customer as reasonably required.

11. Security

We operate an information-security program designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks, applied to business use across multiple regions. Measures include encryption in transit, encryption at rest of sensitive account fields and of backups, protected media channels, role-based access control, multi-factor authentication where supported or required by internal policy, least-privilege access, logging, monitoring, security review practices, and a vulnerability-disclosure channel.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. For a fuller description of our controls, see the Security Overview.

12. Self-Hosted Mode

In a Self-Hosted Deployment, the Customer installs and operates Vexaro components on its own infrastructure. In that mode, Customer Content, session metadata, audit logs, Recordings, and (once Vexaro Mesh is available) Mesh configuration remain on the Customer’s infrastructure and under the Customer’s control; Vexaro does not receive them in the ordinary course of operating such a deployment.

Personal Data may reach Vexaro from a Self-Hosted Deployment only where the Customer enables a feature that sends it, such as licensing validation, update checks, or optional telemetry or error reporting. Where that occurs, this Notice applies to the data so received, and the Customer remains responsible for the data that stays on its own infrastructure. What stays on the Customer side and what may reach Vexaro is described further in the Self-Hosted Responsibility Matrix.

13. Children

The Service may be used for business, commercial, and personal purposes, and it is not directed to children. We do not knowingly collect Personal Data from a child where such collection would require additional consent or safeguards that have not been provided. If you believe a child has provided us with Personal Data, contact the Privacy Contact at [email protected], and we will take steps to delete it. Authorized Users must be at least 18, or have the capacity to contract.

14. Cookies

Our websites and the Service use a limited set of cookies and similar technologies, including strictly necessary session and security cookies, preference cookies, and, only after you allow them in the cookie banner, optional cookies. How they work and how to manage them is described in the Cookie Notice.

15. Changes

We may update this Notice from time to time to reflect changes in our practices, technology, or legal requirements. A change takes effect when we publish it, and we update the “Last updated” date above. When we make a material change, we tell you about it by email to the address associated with your account, by a notice in the Service, or on our website. If you do not accept a change, you may stop using the Service. The current version always applies. We encourage you to review this Notice periodically.

16. Contact

For questions about this Notice or to exercise a privacy right where Vexaro acts as a controller, contact our Privacy Contact:

• Privacy / data-protection contact: [email protected]

For other matters, write to:

• Legal and contracting: [email protected]
• Security reports and vulnerability disclosure: [email protected]
• Abuse reports: [email protected]
• Support: [email protected]

Data controller. For Personal Data where Vexaro acts as an independent controller (Section 2.1), the controller is Vexaro, LLC, a limited liability company organized under the laws of the State of Delaware, USA, with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA (registered agent: Legalinc Corporate Services Inc.), unless a different Vexaro contracting entity is identified in your Order Form, invoice, or account record. Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.