Privacy Policy

This is a courtesy translation. The Portuguese version, at vexor.app/privacy, is the one that prevails.

Last updated: October 26, 2026

This policy explains which personal data we process, what we use it for, who we share it with, how long we keep it and how you exercise the rights that Law 13.709/2018, the LGPD, guarantees.

Who processes the data

Vexor is operated by Kahue Moraes de Morais, CNPJ (Brazilian company registry) 60.987.970/0001-54, responsible for the service and controller of the data described below. Contact: +1 711 766 8394 (opens in a new tab).

The data protection officer (LGPD, art. 41) is Kahue Moraes de Morais. The officer's channel is Sabrina's WhatsApp, +1 711 766 8394 (opens in a new tab). The reply comes from Sabrina, Vexor's virtual assistant: an automated assistant, powered by artificial intelligence, that answers questions. Requests to exercise a right go to the officer, who decides and replies.

The role of each party depends on the data. For the data you provide in this site contact form, Vexor is the controller. For the data of the contacts and conversations of a client business's support, the controller is the business, and Vexor acts as a processor: it handles that data only on the business's instructions and to deliver the service, and it helps the business respond to the data subjects' requests. When you are a customer of a business served by Vexor, your support data is handled by that business, and it is to them that you address requests about that data.

The channel to talk about privacy, request information or exercise a right is +1 711 766 8394 (opens in a new tab).

Which data we process

It depends on where you appear in the operation. On the sales site you are reading we do not ask for registration or a password. Whoever hires the service signs in to the client panel, where we create an account with an email and a password and, if the person wants it, a second factor through an app.

data you provide in the site contact form: name, WhatsApp and e-mail, stored in a database on our cloud account;
the account data in the client panel: name, e-mail, login, second factor and access records;
the subscription and payment data: plan, amount, status and billing identifiers. The card is typed directly into Stripe and does not pass through us;
the support tickets you open: subject, text and author;
when you refer clients as a partner: name, e-mail, percentages and amounts paid out;
the content of the service conversations on WhatsApp, including audio, image and document you send;
booking information, such as service, professional, date and time;
what the assistant stores to personalise the work, such as preferences, routines, vocabulary and the documents you send for it to consult;
when the assistant is hired with access to files, only the files of the folders you authorised in writing, and the record of the command executed.
technical records of access to the site, in aggregated form and without a behavior profile.

What we use it for, and on what legal basis

to serve, answer and book, in the performance of the contract, art. 7, V of the LGPD;
to answer the contact you requested in the form, in preliminary procedures to the contract, art. 7, V of the LGPD;
to operate, measure and improve the service, on legitimate interest, art. 7, IX;
to comply with a legal or regulatory obligation, such as tax record keeping, art. 7, II;
to send a notice or an offer when there is one, with consent, art. 7, I, which you revoke whenever you want.

Who we share it with

We share only what is necessary for the service to work:

Meta, the owner of WhatsApp, because that is where the conversation happens;
cloud infrastructure and language model providers, which process the message to generate the answer;
ElevenLabs, which turns the audio received into text;
TypeSafe, through OpenCode, which receives the text of the latest messages of the conversation, without phone number and without name, only to suggest the contact's stage on the board; it does not reply to the customer and does not use this text to train the model;
Stripe, which charges the subscription and the setup by card, and NOWPayments, for those who pay in crypto when that option is available;
Cloudflare, which protects the connection of the server where the assistant runs;
public authority, when there is a legal order or a regulatory obligation.

Transfer outside Brazil

Some of these providers process data outside the country, including in the US and the EU. By category: messaging, which is the WhatsApp channel; language model; audio transcription; database; site hosting; and the server where the operation runs. The audio sent to ElevenLabs to be turned into text is also processed outside the country. The transfer is limited to what the purpose requires.

The destination is the US and the EU, and the purpose is only to deliver the service. The data stays outside the country while the service lasts and for the periods in the section on how long we keep data. The legal basis is art. 33 of the LGPD: performance of the contract with the contracting business and, where applicable, the ANPD standard clauses (Resolution CD/ANPD 19/2024) or another mechanism that article provides. You can ask the data protection officer for the full text of the clauses used, subject to trade and industrial secrecy. The rights described in this policy also apply to this data.

How long we keep it

Client account data: for as long as the contract lasts and then 5 years, for legal obligation and defense. Access records: 6 months (Brazilian Internet Civil Framework). Conversation messages: for the retention period the client chooses (section Conversation retention) and, if none is chosen, for as long as the account exists. Owner criteria: for as long as the profile exists. Original feedback text: 90 days. After these periods, the data is deleted or anonymised.

At the end of the contract, the contracting business can ask on WhatsApp for a copy of its data, such as conversations, contacts and calendar, and can ask for the rest to be deleted. We do what it chooses and tell it when we are done.

Conversation retention

The conversation retention period is chosen by the client in the account, from 1 to 36 months. Until the client chooses, nothing is deleted. When the period ends, older messages are deleted automatically. We notify in the panel and by email 30 days and 7 days before, with the option to export the conversations as CSV. If a client shortens the period, the change applies only at the next billing cycle, and nothing is deleted before then.

The client can also ask for conversations to be deleted, all of them or one contact, from the panel. We delete within 7 days, send a receipt with the date and the number deleted, and keep only a record without the message content. Backups expire within 30 days. On cancellation, data stays for the contracted period plus 30 days and is then deleted entirely.

The legal basis is contract performance and legitimate interest in improving service. Vexor acts as the operator of the business conversation data.

Sensitive data

Businesses such as clinics may receive health data in conversations, which the LGPD treats as sensitive personal data (art. 11). That data belongs to the contracting business, which decides what it is for. We process it as an operator, only on its instruction and only to deliver the service and scheduling, with no use of our own and no sale. We do not use this data to train models.

If you are in California (CCPA and CPRA)

For California residents, we do not sell personal information and do not share it for cross-context behavioral advertising. For the conversation data of a contracting business, Vexor acts as a service provider and uses the data only to deliver the service. You can ask to know, correct or delete your personal information, and we will not treat you differently for doing so. To do this, use the contact at the end of this page.

Your rights

The LGPD guarantees you, among others, confirmation of processing, access, correction, anonymisation, blocking or elimination of unnecessary or excessive data, portability, information about sharing and revocation of consent. To exercise any of them, talk on WhatsApp: +1 711 766 8394 (opens in a new tab). We answer within the legal term and ask only what is necessary to confirm who you are.

Security

Access to the data is restricted by individual credential, the automatic service runs with a consumption ceiling and a usage record, and the environment is monitored. If an incident with relevant risk happens, we notify the ANPD and the affected people, as art. 48 determines.

When the assistant is hired with access to files, it reads and changes only the folders authorised in writing, every sensitive command goes through your approval before running, and the record of what was executed remains. You can revoke that access at any time, and the operation is adjusted on the same day.

Cookies and measurement

This site uses Google Analytics to measure how the site is used: which pages are visited, where visits come from and where people leave. Google Analytics sets cookies in your browser and is loaded only after you click Accept in the cookie notice. Before that, and if you decline, the site makes no request to Google Analytics. The legal basis is your consent (LGPD, art. 7, I).

We do not use this data for personalized advertising, we do not turn on Google's advertising features and we do not build an individual behavior profile: we look at numbers for visits as a whole. The data is processed by Google, on servers that may be outside Brazil.

To decline, click Decline in the notice. To change your mind, click Cookie preferences in the footer of any page and choose again, whenever you like. Declining removes no function of the site. Your choice is stored only in your browser; if you clear the site data, the notice comes back. You can also delete cookies in your browser.

The site also sets a lang cookie, only to remember the chosen language. In the client panel, after sign-in, we set strictly necessary cookies: the session cookie, which keeps you signed in and cannot be read by scripts on the page, and the language cookie. The panel does not work without them, so they do not depend on the cookie notice. The only visit measurement on the site is Google Analytics, described above, which only starts after you click Accept.

When the data belongs to a person in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also applies. The legal bases are: the performance of the contract, to run the service you hired (art. 6(1)(b)); your consent, for Google Analytics (art. 6(1)(a)), which you can withdraw at any time; legal obligations, for tax and accounting records (art. 6(1)(c)); and legitimate interests, for security and fraud prevention (art. 6(1)(f)).

We keep the data for the periods in the section How long we keep it. Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to lodge a complaint with the data protection authority of your country. To exercise them, use the contact at the end of this page.

The data is processed in Brazil and by the providers listed above, which may be outside the European Union. When the destination country has no adequacy decision from the European Commission, the transfer relies on the safeguards of art. 46 of the GDPR, such as the standard contractual clauses.

Children and adolescents

The service is intended for businesses and for people over 18. When a service involves data of a minor, it depends on consent from the guardian.

Changes to this policy

If the policy changes, the date at the top changes with it. A change that affects a right takes effect with notice on the site or in the conversation.

Contact

A question about this policy: +1 711 766 8394 (opens in a new tab).