← Back to HeyVexa

HEYVEXA PRIVACY POLICY

Effective date: October 11, 2026. Controller: DATASMART TECHNOLOGY (https://www.datasmart.agency). Contact for privacy: admin@heyvexa.com.

This policy covers the HeyVexa service. It is written to meet Quebec's Law 25, applicable US state privacy laws (for example California) and the GDPR.

1. What we collect

  • Account data: name, email, profile picture and sign-in provider identifiers.
  • Your content: photos (stored as private files), logos, text, links you paste, and the videos and images we generate.
  • Credits and payments: balance and transactions. Card data is handled by our payment provider and is not stored by us.
  • Connected accounts: for each account you connect we store the access and refresh tokens, encrypted by our application, and the public name or identifier of the account.
  • eBay (if you connect it): the connection token (encrypted), your public eBay user id and name. We use them only to read your listings at your request and to erase your connection when eBay tells us that your eBay account was closed or deleted, or when you disconnect or delete your account.
  • Vehicle identification numbers (VIN) you type are sent to a public decoder to read the factory specification and are not stored by us. (No separate notice required by the lawyer.)
  • Usage and technical data: logs, device and browser data, and, where you accept them, analytics and campaign-measurement cookies.

2. How we use it

To provide and secure the service; to create, store and publish your videos; to process payments and credits; to prevent abuse; to answer you; to measure how the service is used (analytics, with consent where required); to meet legal duties. We do not sell your personal information.

3. Who processes it

Our service providers process data on our behalf, only to run the features you use (facts from `PRIVACY_FACTS.md`, read in code and consoles on 2026-10-10):

  • Hosting, database, authentication and file storage: Vercel (web application, United States) and Supabase (database, sign-in and private file storage, United States, Oregon region). Our video-rendering worker runs on Google Cloud (United States, Northern Virginia).
  • Artificial intelligence and speech: Google (Gemini for text and photo analysis and, in AI Photo Lab, photo editing; Google text-to-speech and place and address lookup where you use those features) and ElevenLabs (voice-over; and, only if you use the own-voice feature, your recorded voice sample to create your voice). Some optional features may use further providers; they receive only what the feature needs and are listed on request.
  • Payments: Stripe (your email and the plan you choose; your card details are typed on Stripe's page, never on ours).
  • Measurement: Google Analytics and our campaign tag (see 4).
  • Stores you read: when you connect a store or paste a store link, we read its public product catalogue once and keep it in your account so you do not have to import it again. You can refresh it from the store or remove it at any time; it is deleted when you delete your account.
  • Networks and marketplaces you connect: TikTok, Meta (Instagram, Facebook), YouTube, Pinterest, Shopify and eBay receive only what you choose to publish or sync, under your authorisation.

Your photos are sent to these providers to perform the features you request (for example to Google for analysis or editing, and to our rendering worker). All the infrastructure we use for storing and processing data is in the United States, so your data is processed outside your country, including outside Canada and the EU.

4. Cookies and analytics

Outside the United States (including the EU, UK and Canada), we ask for your consent before loading analytics and campaign-measurement cookies, and you can change your choice at any time from the link in the page footer. In the United States we describe them here: Google Analytics (visit measurement) and a first-party campaign tag (kept up to 30 days to label which campaign brought you; copied once to your account at sign-up and deleted with it).

5. Retention

Generated videos and render records are deleted after 7 days. Photos, account data, credit history and connection records are kept while your account exists and are erased when you delete your account. Disconnecting a social account discards our stored tokens.

6. Your rights

Depending on where you live (Quebec, the EU/UK, California and other US states) you may ask to access, correct, delete or export your data, to withdraw consent, and to object to certain uses. Write to admin@heyvexa.com from your account email; we answer within 30 days. You can delete your account in the app, which also deletes your stored photos and render records. Deleting your account does not revoke HeyVexa's access inside TikTok, Meta, YouTube or eBay: revoke it in each service's settings. You may complain to your data protection authority.

7. Security

We use industry-standard protections: encrypted connections, access controls, and encryption of the access tokens for the accounts you connect. Our hosting providers also protect stored data under their own security programmes. No system is perfectly secure.

8. Children

HeyVexa is not directed to children under 16.

9. Changes and contact

We will post updates with a new date and, for important changes, tell you in the app or by email. Contact: admin@heyvexa.com.