Privacy Policy

1. Introduction

VorexAI ("we," "our," or "us") operates https://vorexai.tech and the VorexAI platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, and password when you create an account.
• Business information: business name, address, phone number, business category, hours of operation, and service descriptions.
• Billing information: payment details processed securely by Stripe. We do not store full card numbers.
• Communications: messages you send us via support, email, or contact forms.

2.2 Information We Collect Automatically

• Usage data: pages visited, features used, actions taken, session duration, and referring URLs.
• Device data: IP address, browser type, operating system, and device identifiers.
• Log data: server logs including request times, errors, and performance data.
• Cookies and similar technologies: session cookies for authentication and preference cookies for user settings. See Section 9 for details.

2.3 Information from Third-Party Platforms

When you connect third-party platforms (such as Facebook, Instagram, or Google Business Profile) to our Service, we collect:

• Facebook and Instagram: page name, page ID, access tokens, post content, post performance metrics (impressions, reach, engagement), and profile information necessary to publish content on your behalf. We access only the permissions you explicitly grant during OAuth authorization.
• Google Business Profile: business listing information, review data (reviewer names, ratings, and content), your reply history, and business attributes necessary to display and respond to reviews on your behalf.
• Twilio: phone call logs, call duration, caller ID, and SMS message records associated with your AI Receptionist.

We do not collect third-party platform data beyond what is required to provide the features you have enabled.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and deliver the Service.
• Generate, publish, and schedule content (website pages, social media posts, marketing emails, and SMS messages) on your behalf.
• Operate your AI Receptionist — including answering calls, booking appointments, and sending follow-up SMS messages.
• Publish and manage posts on connected Facebook Pages, Instagram Business Accounts, and Google Business Profile listings.
• Display and help you respond to Google and Yelp reviews.
• Process payments and manage your subscription through Stripe.
• Send transactional emails (account confirmations, password resets, billing receipts).
• Provide customer support and respond to your inquiries.
• Monitor and improve the performance, security, and reliability of the Service.
• Comply with applicable legal obligations.

We do not use your data for advertising purposes, nor do we sell your data to third parties.

4. Facebook and Instagram Data Use

This section specifically addresses our use of data obtained through Facebook and Instagram APIs, in compliance with Meta Platform Terms.

4.1 Permissions We Request

• pages_manage_posts: to create and publish posts to your Facebook Pages.
• pages_read_engagement: to read post performance metrics for your Pages.
• instagram_basic, instagram_content_publish: to publish posts and read basic profile information for connected Instagram Business Accounts.
• pages_show_list: to display the list of Pages you manage so you can select which to connect.

4.2 How We Use Facebook and Instagram Data

• We use Facebook and Instagram data solely to provide the social media scheduling and publishing features of the Service.
• We do not use Facebook or Instagram user data to build profiles for advertising.
• We do not share Facebook or Instagram data with third parties except as required to deliver the Service (e.g., storing post content in our database).
• We do not use Facebook or Instagram data for any purpose prohibited by Meta Platform Terms.

4.3 Data Retention — Facebook and Instagram

We retain data obtained from Facebook and Instagram APIs for as long as your account is active or as needed to provide the Service. Upon account deletion or revocation of permissions, we delete this data within 30 days.

4.4 Revoking Access

You may revoke VorexAI's access to your Facebook or Instagram account at any time by visiting your Facebook Settings → Apps and Websites, or via your Instagram account settings, and removing VorexAI. You can also disconnect platforms within your VorexAI dashboard under Settings.

5. Google Data Use

This section addresses our use of data obtained through Google APIs.

5.1 Google Permissions We Request

• Business Profile API: to read your business listings, retrieve customer reviews, and post replies to reviews on your behalf.

5.2 How We Use Google Data

• Google Business Profile data is used solely to display your reviews within the Service and to post owner replies you approve.
• We do not use Google user data for advertising targeting.
• We do not share Google data with third parties beyond what is required to deliver the Service.
• VorexAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5.3 Revoking Google Access

You may revoke VorexAI's access to your Google account at any time via Google Account Permissions or via your VorexAI dashboard under Settings.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your data in the following limited circumstances:

• Service providers: we share data with trusted vendors who help us deliver the Service, including Supabase (database and authentication), Stripe (payments), Twilio (phone and SMS), Brevo (email delivery), VAPI (AI voice), Anthropic (AI content generation), and Render (hosting). These providers are bound by confidentiality agreements and may not use your data for their own purposes.
• Legal requirements: we may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of VorexAI, our users, or others.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

7. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide the Service. You may request deletion of your account and associated data at any time by contacting us at privacy@vorexai.tech. We will process deletion requests within 30 days, subject to any legal retention obligations.

8. Security

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encrypted storage, and role-based access controls. However, no method of transmission or storage is 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

9. Cookies

We use the following types of cookies:

• Essential cookies: required for authentication and core functionality. Cannot be disabled.
• Preference cookies: remember your settings and preferences.

We do not use advertising or tracking cookies. You may control cookies through your browser settings; disabling essential cookies will affect the functionality of the Service.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data ("right to be forgotten").
• Portability: request your data in a structured, machine-readable format.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• CCPA (California residents): the right to know what personal information is collected, the right to delete, and the right to opt out of sale (we do not sell personal information).

To exercise any of these rights, contact us at privacy@vorexai.tech. We will respond within 30 days.

11. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

12. International Data Transfers

Your data may be processed and stored in the United States and other countries. By using the Service, you consent to the transfer of your data to countries that may have different data protection laws than your country of residence. We ensure appropriate safeguards are in place for such transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us: