Aurothic Suites by Vexa IT Privacy Policy

1. Who we are

The Services are provided by VEXA Group of Companies LLC, a Texas limited liability company, doing business as Vexa IT ("Vexa IT", "we", "us"). Questions or requests: info@getvexa.co.

2. What we collect

• Account email. If you sign in, we collect your email address and use it to send sign-in codes or links and account notices.
• Workspace data you enter. Sites, racks, ports, labels, photos, notes, and other records you save. These are stored on our servers and are private to your account or workspace. If you add names or desk locations of people in your organization, only add people you're authorized to document.
• Usage and security logs. Limited technical logs used for security, abuse prevention, and troubleshooting, kept for up to 30 days. For access requests and trials, we store a hashed (one-way) version of your IP address to prevent abuse. Hashed IPs are deleted within 30 days.
• Trial and access requests. The iOS app creates a random trial ID (not your advertising ID) to track your trial. If you request access, we store that ID plus any email, role, and note you choose to give us. Access requests are deleted within 12 months.
• Launch updates and waitlist. If you sign up, we store your email, the optional company name you give us, and when and where you signed up. We use it only to send updates about the Services.
• Payments. Web payments are currently closed. When they open, Stripe will process them. Stripe collects your card details directly, and we never see or store your full card number. We keep only your Stripe customer and subscription IDs, plan, status, and renewal date. iOS subscriptions are processed by Apple, and we only receive your subscription status.
• Robotics project uploads (Aurothic Workflow Studio). Files are processed to convert them and deleted within 1 hour. We don't keep them.
• Guest mode. If you use the web or Windows app without signing in, your chat history and records are stored only in your browser on that device.
• Aurothic Network Site Maps. Site locations you pin on Aurothic Network Site Maps are stored in your browser on that device and aren't sent to us. Pin sites only, never people. The app uses your device's location only when you tap the button to drop a pin. Map images come from OpenStreetMap's public tile servers, so your browser asks the OpenStreetMap Foundation for the map area you view, which shares your IP address and that area with them under their own privacy policy. If you search for an address, your browser sends the text you typed to OpenStreetMap's Nominatim search service when you press Search, and the address you pick is stored with the pin in your browser. Search for site addresses only, never a person's home address.

We don't use advertising or tracking cookies.

Our home page embeds TikTok videos. When you play or load one, TikTok may set cookies and collect data under its own privacy policy (https://www.tiktok.com/legal/privacy-policy).

3. AI processing (Ask Aurothic)

When you use Ask Aurothic, your typed question is sent to our AI model provider, Google (Gemini API), to generate a reply. Workspace and business data is removed from typed text before it is sent. If you attach an image, or use voice in the iPhone app, the image or audio is sent to Google as-is and can't be masked, so don't include sensitive or confidential information in them.

• Before text is sent, the Services automatically swap network details (IP addresses, subnets, MAC addresses, hostnames, domain names, serial numbers) for placeholders. Masking may not catch everything.
• AI replies can be wrong. Check important answers before you act on them.
• We don't use your content to train our own models.
• Google may use content sent to the Gemini API to improve its products, and people at Google may review it.
• Don't enter sensitive or confidential information in Ask Aurothic. That includes passwords, secrets, and personal, health, or financial information.

4. Windows app

The Services' Windows app is a window around getvexa.co. It loads the same web app, so this same policy applies. Console passwords and keys stay on your device (Windows Credential Manager or your browser) and aren't sent to the Services.

5. Service providers

We use these providers to run the Services. They process data on our behalf under contract:

When you use Aurothic Network Site Maps, your browser loads map images directly from the OpenStreetMap Foundation, which acts under its own terms, not on our behalf.

Apple handles App Store payments as an independent company under its own terms. The current list is at getvexa.co/subprocessors. We may also disclose information if the law requires it.

6. Retention

• Account and workspace data: until you delete it or your account. You can export or delete both in Settings.
• Robotics project uploads (Aurothic Workflow Studio): Files are processed to convert them and deleted within 1 hour. We don't keep them.
• Technical logs: up to 30 days.
• Hashed IPs: deleted within 30 days. Access requests: deleted within 12 months.
• Web SSH relay connection records (who connected to which host, and when): 90 days. We never keep credentials or session content.
• Waitlist and launch-update emails: until you unsubscribe or ask us to delete them.
• Billing records: as long as tax and accounting laws require.

7. Security

We encrypt data in transit (HTTPS/TLS), and we limit access to data with access controls, including database row-level security and service-only access for sensitive tables. Our database provider encrypts stored data at rest. No method is 100% secure.

8. Your choices and rights

• Access, correction, deletion. Email info@getvexa.co. You can also export or delete your data and account in Settings.
• Texas and other US states. Depending on where you live (including Texas under the Texas Data Privacy and Security Act), you may have the right to confirm, access, correct, delete, or get a copy of your personal data, to opt out of certain processing, and to appeal our decision on your request. To appeal, reply to our decision at info@getvexa.co. We won't discriminate against you for using these rights.
• We don't sell your personal data, and we don't share it for targeted advertising.
• Marketing emails. You can unsubscribe at any time.

9. Age requirement

The Services are a workplace tool for people 18 or older. We don't knowingly collect personal data from anyone under 18. If you think someone under 18 has given us information, contact info@getvexa.co and we'll delete it.

10. Changes

We may update this policy. We'll change the effective date above, and if a change is significant we'll give notice on the site or by email. We'll update the subprocessor list at least 30 days before adding a new subprocessor.

11. Contact

VEXA Group of Companies LLC, doing business as Vexa IT · info@getvexa.co