Privacy Policy

1.1 The operator. Vectrox (the “Service”) is operated by Novix Technologies, Uttar Pradesh, India (“Vectrox”, “we”, “us”). A business that registers a workspace on the Service is a “Customer”.

1.2 Account Data. “Account Data” is information about the people who sign in to the Service: a Customer’s owner and team members. Vectrox determines the purposes and means of processing Account Data and is, in respect of it, the controller under the EU and UK General Data Protection Regulation (“GDPR”), the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), and a business under the California Consumer Privacy Act as amended (“CCPA”).

1.3 Workspace Data. “Workspace Data” is the information a Customer keeps in its workspace about its own clients and dealings: contacts, deals, quotes, invoices, emails, documents, notes and tasks. The Customer decides what is entered and what it is used for, and is the controller (data fiduciary; business) of it. Vectrox processes Workspace Data only on the Customer’s documented instructions, as its processor within the meaning of Article 28 GDPR, its data processor under the DPDP Act, and its service provider under the CCPA.

1.4 If you are a client of a Customer. If a business that uses the Service holds information about you and you wish to see, correct or delete it, please address that business first. It controls the data; Vectrox will assist it in responding.

2.1 Account Data. Your email address; your password, stored only as a one-way hash by our sign-in provider; your role in the workspace, the person you report to and the squad you are in. When you register a business, the details you enter (your name and work email from the first step, then the company, size, website, location and phone number) are saved as you go, including if you do not finish registering, so that our onboarding team can contact you to help complete your setup. The form says so before anything is saved. Your password is never part of this record.

2.2 Business profile. Company name, a description of the business, company size, country, city, address, phone number, website and currency; and, where the Customer adds them, its headline, logo, tax and registration numbers, and the bank details it prints on its own documents.

2.3 Workspace Data entered or imported. Clients and leads (names, email addresses, phone numbers, status and any custom fields the Customer defines); assets such as policies or contracts with their dates; deals, quotes, invoices, tasks, reminders, notes, logged calls and meetings, pasted meeting notes or transcripts; uploaded documents; saved reports and dashboards.

2.4 Synced client communications. Where a person connects a Gmail or Outlook mailbox, the Service reads messages in that mailbox to find those exchanged with an email address saved as a client’s, and stores those messages (sender, recipients, subject, text, date) on that client’s timeline. Mail that involves no client address is not stored. Mail exchanged only between people in the same workspace or on the Customer’s own email domain is ignored. Mailbox access tokens are stored encrypted.

2.5 Records the Service creates.

• Quote acceptance records: when a client accepts a quote through its link, the name typed, the date and time, the IP address and the browser type, as evidence of the acceptance.
• Audit records: who created, changed or deleted what in a workspace, document downloads, exports, emails sent, and the fact that an AI feature was used.
• Support, enquiries and feedback: the details you provide when you ask for help, send an enquiry through the contact form, or submit feedback or a feature suggestion in the app. For the public contact form a one-way hash of the sender’s IP address is kept, solely to limit abuse.
• Technical data: standard request logs kept by our hosting providers (IP address, browser type, pages requested, time).

2.6 Special categories and biometric data. Vectrox does not collect biometric data and does not seek special categories of personal data. The Service is not designed to hold them. A Customer must not store special-category data (including data revealing health, biometric or genetic characteristics, racial or ethnic origin, religious belief or sexual orientation) or financial account credentials in the Service unless the Customer has its own lawful basis for doing so and accepts sole responsibility for it.

2.7 Sources. Vectrox does not buy personal data from third parties.

3.1 Vectrox processes Account Data on the following bases under Article 6 GDPR, and for the corresponding lawful purposes and legitimate uses under the DPDP Act:

• Contractual necessity (Art. 6(1)(b)): providing the Service: signing you in, showing each person only the records their role allows, sending the reminders and renewal emails a Customer sets up, running workflows, filing email on client timelines.
• Consent (Art. 6(1)(a); DPDP Act s.6): connecting a mailbox, only when its owner chooses to and until they disconnect it. Consent can be withdrawn at any time in Settings → Integrations, as easily as it was given.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure and reliable (audit records, rate limits, abuse prevention, backups), answering support requests, enquiries and feedback, and contacting a business that has started registering to help it complete its setup. You can ask us to stop at any time by writing to mayureshchaturvedi@gmail.com.
• Legal obligation (Art. 6(1)(c)): tax, accounting and lawful requests from authorities.

3.2 Workspace Data is processed on the instructions of the Customer, who is responsible for having a lawful basis for it.

3.3 Vectrox does not sell personal data, does not share it for cross-context behavioural advertising, and does not use it for advertising of any kind. Vectrox does not take decisions about any person by solely automated means that produce legal or similarly significant effects.

4.1 No model training. Vectrox undertakes that it does not use Account Data or Workspace Data to train, retrain, fine-tune or evaluate any artificial intelligence model, whether its own or a third party’s, and that it does not authorise any AI provider to do so. Vectrox engages AI providers only under their terms for business API customers, under which what is sent and what is returned is not used to train the provider’s models.

4.2 What is sent, and when. Nothing is sent to an AI provider unless a person uses an AI feature: the client brief, the AI deal update, the meeting debrief, spreadsheet column mapping, catalog setup, workflows written in plain English, charts, reports and dashboard components described in words, and the in-app assistant, Vectrox Agent. The feature sends only the text it needs to produce its result: for example a client’s timeline (which can include synced emails) for a brief, the notes you paste for a debrief, or your question for Vectrox Agent. Where you ask about how the business is doing, a summary of your workspace’s figures accompanies the question: totals, and short lists naming the clients, deals, people and catalog items concerned, limited to the records your own role can see. Client contact details and the contents of emails and notes are not part of that summary. The report and dashboard assistants are sent your request and the names of your pipeline stages and asset types, and no client records.

4.3 Transient processing. AI processing is transient. Text is sent to produce a single result, and Vectrox keeps no separate copy of what was sent or returned. A result is stored only where a person chooses to save it into the workspace. An AI provider may hold a request for a limited period solely to prevent abuse and to meet its legal obligations, as its business terms allow, and may not use it for any other purpose.

4.4 A person decides. AI output can be wrong. It is a suggestion for a person to check, and nothing an AI feature proposes is saved or sent without a person choosing to.

5.1 Limited Use. Vectrox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Vectrox applies the same restrictions to data received from a connected Microsoft 365 or Outlook mailbox.

5.2 Permitted use. Data from a connected mailbox is used only to provide the email features visible in the Service: filing client conversations on the timeline, and sending email a person composes or automates. It is not used for advertising, it is not sold, it is not transferred to others except as needed to provide those features or as the law requires, and it is not used to develop, improve or train generalised AI models.

5.3 No human inspection. Vectrox personnel do not read mailbox data, except (a) with the affirmative agreement of the mailbox’s owner for specific messages, for example to resolve a support request; (b) where necessary for security purposes, such as investigating abuse; or (c) to comply with applicable law.

5.4 Withdrawal. A mailbox can be disconnected at any time in Settings → Integrations, and access revoked from the Google or Microsoft account’s own security settings. Disconnecting deletes the stored access tokens.

6.1 The Service sets only cookies that are strictly necessary for it to work. There are no advertising cookies, no marketing cookies and no third-party analytics or tracking cookies, so there is nothing to opt in to or out of. On a first visit a short notice says so; choosing “Acknowledge” hides it.

• Session cookies keep you signed in. They hold your sign-in token and are refreshed while you use the Service; signing out removes them.
• Short-lived security cookies protect the sign-in, password-reset and mailbox-connection flows against forgery. They expire within minutes or when the flow completes.

6.2 A few preferences that never leave your device are kept in your browser’s local storage rather than in cookies: your colour theme and light or dark mode, and the fact that you have acknowledged the cookie notice.

7.1 Vectrox uses selected service providers (“sub-processors”) to run the Service. Each handles data only to provide its part of the Service, on Vectrox’s instructions, under a written data-processing agreement that requires appropriate security and confidentiality. They fall into the following categories.

7.2 The functional categories of sub-processor are listed above. An up-to-date register of the specific sub-processor entities in each category is available to active Customers and to prospective enterprise evaluation teams on written request to mayureshchaturvedi@gmail.com. The terms on which Vectrox processes Workspace Data for a Customer are set out in the Data Processing Addendum, and Customers are given at least 14 days’ notice before a new sub-processor begins handling their Workspace Data.

7.3 Vectrox also discloses personal data where the law requires it, to protect the rights and safety of its users or others, and to a successor if the business is reorganised or sold, in which case this policy continues to apply to data collected under it.

7.4 Within a workspace, what one team member can see of another’s records is governed by roles (Owner, Admin, Manager, Member, Viewer) and enforced by the database. One workspace can never see another’s data.

8.1 Workspace Data is stored in access-controlled data centres operated by Vectrox’s cloud infrastructure providers. The region in which a Customer’s workspace is hosted is disclosed to that Customer on request and in its data processing terms. Providers may process data in countries other than your own.

8.2 Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer is made on the basis of the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) incorporated in the relevant data-processing agreements.

8.3 Transfers of personal data from India are made in accordance with the DPDP Act and any restriction notified under it.

9.1 Deletion on user action. Workspace Data is kept for as long as the workspace exists. A record a person deletes is removed from the live database at once; there is no recycle bin, and the deletion cannot be undone. “Delete all clients” in Settings → Data Management permanently removes every client and their history.

9.2 Closure of a workspace. A workspace Owner may request closure of the workspace and every account in it by writing to mayureshchaturvedi@gmail.com, or from inside the app through Vectrox Agent (“Talk to a person”). Vectrox confirms the request with the Owner and then permanently deletes, within 30 days, the sign-in details, the business profile and all Workspace Data: clients, assets, deals, quotes, invoices, tasks, notes, synced emails, uploaded documents, reminders, workflows, reports, dashboards, connected-mailbox tokens and audit records. A team member who is not the Owner may leave a workspace in Settings → Team & roles and ask for their own account to be deleted in the same way. This clause also serves as the account-deletion disclosure for app marketplaces.

9.3 Other periods.

• Backups made by the database provider may hold deleted data for a further limited period until they are overwritten in the provider’s normal cycle. Backups are encrypted and are used for no other purpose.
• Audit records are kept for the life of the workspace, because their purpose is to show what happened.
• Connected-mailbox tokens are deleted when the mailbox is disconnected.
• Support requests, enquiries and feedback are kept for up to 24 months after they are closed, and registration details of a business that did not finish registering for up to 24 months after they were last updated (or until you ask us to delete them).
• Records Vectrox is required by law to keep (for example invoices it issues to a Customer) are kept for the period the law requires.

10.1 Self-serve. Much can be done without writing to anyone: edit the business profile in Settings, export clients from Clients & Leads → Export, export any report to CSV, export the audit log, disconnect a mailbox, and delete records.

10.2 In writing. Wherever you live, you may ask Vectrox what personal data it holds about you, to correct it, and to delete it, by writing to mayureshchaturvedi@gmail.com. Vectrox verifies the request, answers within 30 days (45 days where California law applies, with one extension if needed), and never charges for it or treats you less favourably for making it. A request about Workspace Data is passed to the Customer that controls it.

10.3 European Economic Area, United Kingdom and Switzerland (GDPR). You have the rights of access, rectification, erasure, restriction of processing and data portability; the right to object to processing based on legitimate interests; the right to withdraw consent at any time without affecting earlier processing; and the right to complain to your local data-protection authority.

10.4 California (CCPA / CPRA). You have the right to know what personal information Vectrox collects, uses and discloses (described in this policy: identifiers, commercial and professional information, internet activity, and the contents of email you connect), to delete it, to correct it, and to limit the use of sensitive personal information. Vectrox does not sell or share personal information as those terms are defined, and has not done so in the past twelve months. You may act through an authorised agent, from whom proof of authorisation will be requested.

10.5 India (DPDP Act, 2023). You have the right to access your personal data (a summary of it and of the processing carried out); to have it corrected, completed or updated; to request its erasure; to withdraw consent as easily as you gave it; to nominate another person to exercise your rights in the event of death or incapacity; and to grievance redressal under clause 12.

11.1 Tenant isolation. Every record carries the workspace it belongs to, and row-level security in the database itself refuses any query for another workspace. The rule sits below the application, so an error in a screen cannot expose one Customer’s data to another. Within a workspace, each person can read only what their role allows, and that is enforced in the database and re-checked on the server for every action.

11.2 Encryption. Data is encrypted at rest with AES-256 by our database and storage providers, and in transit with TLS (version 1.2 or higher). Mailbox access tokens are additionally encrypted with AES-256-GCM before they are stored. Passwords are never stored in readable form.

11.3 Audit trail. Changes to records, exports, role changes, bulk deletions and the use of AI features are written to an audit log. A workspace’s Owner and Admins can read and export their own workspace’s log; nobody in a workspace can edit or delete it.

11.4 Verified accounts. A workspace is registered with a company email address. Free and disposable mailboxes are refused, and the address must be confirmed before sign-in.

11.5 Incidents. No system can be guaranteed free of every risk, and access to a workspace also depends on the passwords and roles its Customer manages. If a breach affects your personal data, Vectrox will notify you and the relevant authorities as the law requires.

12.1 Questions, requests and complaints about privacy, including grievances under section 8(9) and section 13 of the DPDP Act, are handled by Vectrox’s Data Governance & Grievance Desk:

• Email: mayureshchaturvedi@gmail.com
• Post: Data Governance & Grievance Desk, Novix Technologies, Uttar Pradesh, India

12.2 The Desk responds to a grievance within 30 days. If you are in India and are not satisfied with the response, you may then complain to the Data Protection Board of India. If you are in the European Economic Area, the United Kingdom or Switzerland, you may complain to your data-protection authority at any time.

12.3 See also our Terms of Service.

The Service is a tool for businesses. It is not directed at anyone under 18, everyone who registers must confirm that they are at least 18 years of age, and Vectrox does not knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will delete it.

If this policy changes, the “last updated” date above changes with it, and where the change is significant Vectrox tells workspace Owners by email or in the app before it takes effect.