Vexael is operated by Shahuwais Hossenbaccus, trading as Vexael, in Mauritius (“Vexael”, “we”, “us”, or “our”).
This Privacy Policy explains how we collect, use, store and share personal information when you use the Vexael website, application and related services.
For privacy questions or requests, contact support@vexael.app.
Information we collect
When you create an account, we collect your email address and authentication credentials. If you sign in with Google, we may receive basic account information made available through Google OAuth, such as your email address and account identifier.
When you use Vexael, you may choose to provide information through product features including tasks, habits, goals, projects, notes, planning information, progress information, financial entries and uploaded books or documents.
Vexael may also process technical and usage information required to operate the service, including authentication/session information, subscription status and AI usage information.
For AI usage, Vexael records limited metering information such as the workflow used, model, outcome, token counts, latency and timestamp. Vexael does not permanently store the full text of your AI prompts or AI responses as conversation history.
If you explicitly confirm a memory for Vexael AI to remember, that confirmed information may be stored as a Vexael memory until you remove it, supersede it or delete your account.
How we use information
We process information to provide and maintain Vexael, authenticate users, store and synchronise your Vexael data, provide AI functionality, process subscriptions, enforce plan limits, secure the service, troubleshoot problems, respond to support requests, comply with law and improve the reliability of the product.
We do not currently use your personal information for third-party advertising.
We do not currently send marketing newsletters.
We do not intentionally collect precise location data, government identification documents or health information as dedicated Vexael data categories.
Because Vexael contains free-form features such as Notes, Money and AI, you may nevertheless choose to enter information that is sensitive. You should avoid entering highly sensitive information that is not necessary to use the service.
Vexael AI
When you use Vexael AI, relevant information may be processed to answer your request.
For core AI generation, Vexael uses Anthropic. Depending on the requested action, Vexael may send relevant Vexael context together with your prompt to Anthropic.
Vexael’s current AI context system intentionally excludes certain information from core AI prompts, including email addresses, authentication tokens, signed URLs, raw uploaded file bytes, Money data, Notes and Library content unless a separate supported workflow specifically requires processing that information.
Vexael also uses OpenAI for embeddings and knowledge functionality. When content such as supported notes or book text is indexed, the text required to create the embedding may be sent to OpenAI.
Vexael does not use your content to train its own AI models.
At the time of this policy, OpenAI and Anthropic state that data submitted through their commercial/API products is not used for model training by default unless the customer opts into such use. Their services may nevertheless retain or process information for security, abuse prevention, legal compliance and service operation in accordance with their own policies.
Vexael AI may propose changes to your system. A proposal is not saved merely because the AI generated it. Where the interface asks you to apply or confirm a proposed change, ordinary Vexael data is saved only after you choose to apply it.
AI output can be inaccurate. You should review AI-generated information before relying on or applying it.
Service providers
Vexael relies on service providers to operate the product.
Supabase provides authentication, database and storage infrastructure.
Anthropic provides core AI generation.
OpenAI provides embeddings and related knowledge-processing functionality.
Lemon Squeezy handles subscriptions and payment processing and acts as merchant of record. Vexael does not receive or store your raw payment-card details.
Our hosting and infrastructure providers may also process technical information necessary to deliver and secure the service.
These providers process information under their own terms and privacy obligations.
Payments
Paid subscriptions are processed by Lemon Squeezy.
Vexael may receive information about your subscription, such as your plan, subscription status, transaction identifiers and billing status, but we do not intentionally receive or store your full payment-card number.
Lemon Squeezy may retain transaction and billing records where required for tax, accounting, fraud-prevention or other legal purposes.
Cookies and similar technologies
Vexael currently uses cookies or similar storage primarily where necessary for authentication, sessions, security and core service functionality.
We do not currently use marketing or behavioural-advertising cookies.
If we later introduce non-essential analytics or advertising technologies, we will update this policy and implement any consent mechanisms required by applicable law.
Data retention
We retain account and product information while your account is active and for as long as reasonably necessary to provide Vexael, comply with legal obligations, resolve disputes and protect the service.
AI prompts and AI responses are not stored by Vexael as permanent conversation history.
AI usage metering records may remain associated with your account while the account exists.
When you delete your Vexael account, Vexael first attempts to deal with any active chargeable subscription. If that process fails, account deletion may be stopped to avoid leaving an active paid subscription without an account.
Once deletion proceeds, Vexael removes associated Vexael Storage files, deletes the authentication account and removes related application data through database deletion rules.
Some information may remain temporarily in infrastructure backups until those backups expire according to our service providers’ normal retention schedules. Transaction or billing records held by Lemon Squeezy may remain where required by law or legitimate accounting obligations.
An in-product Reset operation is different from deleting your account. A Reset may clear product information and memories while retaining limited AI usage-metering records. Full account deletion removes those account-linked usage records.
International processing
Some of our service providers operate infrastructure outside Mauritius.
As a result, personal information may be processed in countries other than your own.
Where required, Vexael will take appropriate steps regarding international transfers of personal data in accordance with applicable data-protection law.
Security
We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse or alteration.
No online service can guarantee absolute security.
You are responsible for keeping your account credentials secure and should notify us if you believe your account has been compromised.
Your rights
Depending on applicable law, you may have rights to obtain information about whether and how we process your personal data, request access to your data, request correction of inaccurate information, request deletion, request restriction of certain processing and object to certain processing.
Mauritius’ Data Protection Office specifically recognises rights of access, rectification, erasure, restriction and objection under the Data Protection Act 2017.
To exercise a privacy right, email support@vexael.app.
We may need to verify your identity before fulfilling a request.
You may also have the right to complain to the Data Protection Commissioner of Mauritius.
Account deletion
You may delete your Vexael account using the deletion functionality provided by the service where available.
Deleting an account is intended to permanently remove the account and associated Vexael data, subject to limited retention required by infrastructure backups, billing records, legal obligations, fraud prevention or the establishment or defence of legal claims.
Uploaded content
You are responsible for information and files that you upload to Vexael.
If you upload books, documents or other copyrighted material, you must have the rights or lawful authority necessary to upload and process that material.
Vexael does not acquire ownership of your uploaded content merely because you use the service.
Adults only
Vexael is intended only for people who are 18 years of age or older.
We do not knowingly offer Vexael to children.
If we learn that an ineligible minor has created an account, we may take steps to close the account and delete associated information.
Changes to this policy
We may update this Privacy Policy as Vexael changes or as legal requirements change.
If a change is material, we will take reasonable steps to notify users where appropriate.
The effective date at the top of this page indicates when the current version took effect.
Contact
For privacy questions, data-rights requests or other privacy concerns: