Privacy Policy

1. Who We Are & Scope

Vexafast (legally operated under Vexafast) is a conversational automation and AI agent platform integrated with the official WhatsApp Business Cloud API. This policy explains what personal information we collect, the purposes of processing, how we safeguard your information, and how you can exercise your data privacy rights.

In our operations, we act in two distinct legal capacities:

• As Data Controller: With respect to our business clients’ account details (names, corporate emails, billing and tax details), as well as visitors navigating this website or reaching out via our contact form.
• As Data Processor: With respect to conversations, phone numbers, and names of the end customers messaging businesses using our platform via WhatsApp. The merchant or business client remains the controller of their WhatsApp Business account and end-customer data; we process such data solely on their behalf and according to their instructions.

2. Data We Process

• Client Account Data: Name, corporate email address, contact phone number, and billing details required to operate the service.
• WhatsApp Messaging Data: Text messages, media attachments, international format phone numbers, and profile names associated with conversations managed via the platform.
• AI Automation Data: When AI-powered agents are enabled, message content is processed by advanced language models (LLMs) solely to generate contextualized responses and execute authorized customer support workflows.

3. Purpose of Processing

We use personal data strictly to deliver and optimize our services:

• Enabling centralized receiving, sending, and routing of WhatsApp messages.
• Executing automated responses and workflows via AI agents.
• Monitoring response quality and generating internal operational analytics.
• Administering client accounts, billing, and providing technical support.

We never sell personal data, create third-party advertising profiles, or share information for unsolicited commercial prospecting.

4. Security, Storage & Retention

We implement industry-standard technical and organizational security measures:

• Data encryption in transit using modern TLS 1.3 protocols, and encryption at rest for databases.
• WhatsApp Cloud API tokens and credentials are encrypted inside secure vault systems and are never exposed to browser runtimes or third parties.
• Strict tenant data isolation and role-based access control (RBAC).

Data is retained only as long as the service relationship remains active. To request deletion of your information, please refer to our data deletion instructions.

5. Authorized Third Parties & Subprocessors

To deliver the platform, we partner with industry-leading infrastructure providers acting as subprocessors under strict data protection addenda:

• Meta Platforms, Inc. (WhatsApp Business Cloud API): Official messaging infrastructure.
• Database & Cloud Hosting Providers (Supabase, Vercel/Cloudflare): Secure data storage, server execution, and SOC 2 audited data centers.
• AI Infrastructure (OpenAI, L.L.C.): Subprocessing of conversation context for automated responses.

6. Artificial Intelligence (AI) Subprocessing (OpenAI)

When intelligent conversational agents are enabled:

• Sole Purpose: Message content is transmitted via API to OpenAI strictly to generate the requested response or perform designated tasks.
• No Public Model Training: Under OpenAI’s commercial API terms, data submitted through the API is not used to train or improve public models.
• Limited Retention: OpenAI retains API data temporarily (typically up to 30 days) for abuse prevention and compliance, after which it is deleted.

7. Your Rights (GDPR / ARCO)

You have the right to access, rectify, delete, or object to the processing of your personal data.

If you are an end customer who messaged a company using our software on WhatsApp, we encourage you to contact that business directly (as the data controller). If you contact us, we will relay your request to the relevant client or handle it in accordance with applicable privacy laws.

To submit a data request, please email hola@example.com or follow the steps outlined on our data deletion page.

8. Contact Information

For any legal or privacy inquiries, contact us at hola@example.com or review our Legal Notice.