Privacy Policy

VexraAI ("we", "us") operates the AI video creation platform at vexraai.com. For the personal data described in this policy we act as the data controller. You can reach us about any privacy matter at support@vexraai.com.

• Account data — email address, name and avatar if you sign in with Google, password hash (never the password itself), and account creation date.
• Content you provide — scripts, prompts, uploaded photos, documents used for presentation-to-video, project titles, and the videos rendered from them.
• Usage and quota data — number of renders, plan tier, tool usage, and timestamps needed to enforce monthly limits.
• Billing data — plan, billing interval, subscription status, renewal dates, and identifiers from our payment provider. Card details are handled by Paddle and never reach our servers.
• Support and feedback — messages you send us through the feedback form or by email.
• Technical data — IP address, browser and device type, and error logs captured for security and debugging.
• Referral data — a first-touch referral identifier stored for up to 60 days if you arrive through an affiliate link.

• To provide the Service (create accounts, render videos, store projects) — performance of our contract with you.
• To take payment and manage subscriptions — performance of a contract and legal obligation (tax and accounting records).
• To keep the platform secure and prevent abuse, fraud, and quota circumvention — our legitimate interests.
• To support you and answer feedback — legitimate interests / contract.
• To improve the product using aggregated, non-identifying usage patterns — legitimate interests.
• To send service emails (render finished, billing, security) — contract. Marketing emails, if we ever send them, are sent only with your consent and you can unsubscribe at any time.

We never sell or rent your personal data or your content, and we do not use your uploaded content or generated videos to train AI models.

We share data only with providers who process it on our behalf under contract:

• Supabase — database, authentication, and file storage for your account and projects.
• Paddle — payments and subscription management (merchant of record).
• JSON2Video — video rendering of the scripts and media you submit.
• AI model providers — text, voice, and image generation for the prompts you send.
• Pexels — stock media search when you use that feature.
• Hosting and CDN providers — serving the application.

Some of our processors are located outside the European Economic Area, including in the United States. Where data leaves the EEA or UK, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, together with appropriate technical safeguards such as encryption in transit.

• Account data — for as long as your account exists, then deleted within 30 days of account deletion.
• Projects, uploads, and rendered videos — until you delete them, or up to 30 days after account closure.
• Billing records — up to 7 years, as required by tax law.
• Security and error logs — typically 90 days.
• Referral cookie — 60 days.

We use strictly necessary cookies and browser storage to keep you signed in, remember your preferences, support offline use of the installed app, and attribute affiliate referrals for 60 days. We do not run advertising or cross-site tracking cookies. You can clear this data at any time in your browser settings, though signing in will then be required again.

If you are in the EEA or UK (and, in substance, wherever you are) you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to certain processing, including profiling;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with your local data protection authority.

Email support@vexraai.com to exercise any of these rights. We respond within 30 days and never charge for a first request.

Data is encrypted in transit with TLS and stored on managed infrastructure with row-level security so that each account can reach only its own records. Passwords are hashed, privileged operations run server-side, and administrative access is limited to accounts that need it. No system is perfectly secure, so please use a strong, unique password.

VexraAI is not intended for children under 16. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will delete it.

We will update this page when our practices change and revise the "last updated" date. Material changes will be announced by email or in the app before they take effect.