Privacy Policy

This Privacy Policy explains exactly how VexaDoc collects, processes, and secures data. We operate with complete transparency. Because we serve B2B digital agencies, we treat your commercial data and your clients' privacy with absolute seriousness.

1 Data We Collect About You (The Agency)

When you create an account and use VexaDoc as an agency user, we collect the minimum data necessary to run the service:

• Identity & Login Data: Your name and email address.
• Authentication Provider: All sign-ups, secure logins, and active user sessions are handled exclusively by Supabase. VexaDoc never handles, sees, or stores your raw passwords.
• Usage Metadata: Information about the number of proposals you upload, links generated, and dashboard activity to keep the platform running efficiently.

2 Data We Process on Your Behalf (Your Proposal Recipients)

When you send a VexaDoc link to a prospective client, you act as the Data Controller, and VexaDoc acts as the Data Processor.

The Built-In Notification: To ensure your agency complies with UK GDPR, VexaDoc automatically displays a clear consent / privacy notice to the recipient before they can view your proposal.

What We Track: Once the recipient proceeds, we track anonymous interaction data: timestamps of opens, total time spent on the document, and scroll / heatmap engagement across specific sections or pages.

What We DO NOT Do: We do not harvest unauthorized personal information, track your recipients across the web, or sell their behavioral data. We never contact your clients or leads under any circumstances.

3 Data Storage & Infrastructure (Supabase)

Secure Hosting: All platform data, including your uploaded PDFs, agency metadata, and recipient analytics, is stored securely within databases managed by Supabase.

Security Standards: Supabase provides enterprise-grade encryption both in transit (when data is being sent) and at rest (when data is stored).

4 Third-Party Service Providers

We do not sell, trade, or rent your data to third parties. We only share data with essential infrastructure sub-processors required to deliver the service:

• Supabase, Inc. — For database storage, backend infrastructure, and secure user authentication.

5 Data Retention & Deletion

Your Control: You own your data. If you decide to stop using VexaDoc and delete your account, all your profile information, uploaded PDFs, and tracking analytics will be permanently wiped from our Supabase production databases.

Analytics Retention: Recipient tracking data is kept only as long as your account remains active or until you manually delete the specific proposal link from your dashboard.

6 Your Rights Under UK GDPR

Because we operate under UK GDPR standards, you and your recipients have the right to:

• Access the personal data we hold about you.
• Request the correction of inaccurate data.
• Request the absolute deletion of your data from our systems.

7 Contact Us

If you have any questions or requests regarding how your data or your clients' data is handled, contact us directly at lukasz@getvexadoc.com.