Privacy Policy

Last updated: December 17, 2025

Introduction

VCXOS Management and Technologies LLP ("VCXOS," "we," "us," or "our") operates the VCXOS Hub platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

Information We Collect

Personal Information You Provide

We collect information that you voluntarily provide when using the Service:

  • Account Information: Name, email address, and profile picture (when signing in with Google OAuth)
  • Organization Information: Company name, GSTIN (optional), industry, team size, and state/location
  • Financial Data: Transactions, income, expenses, bank statements, and related financial information you upload or enter
  • Compliance Information: Compliance tasks, deadlines, and related documentation
  • Communications: Support tickets, feedback, and correspondence with us

Information Collected Automatically

When you access the Service, we automatically collect certain information:

  • Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns
  • Device Information: Browser type, operating system, device type, and screen resolution
  • Log Data: IP address, access times, and referring URLs
  • Cookies: Session cookies for authentication and preference cookies for user settings

How We Use Your Information

We use the collected information for the following purposes:

  • Provide the Service: Process transactions, calculate KPIs, generate reports, and manage compliance tasks
  • Account Management: Create and manage your account, authenticate users, and process invitations
  • Communications: Send notifications, compliance reminders, weekly digests, and support responses
  • Improvements: Analyze usage patterns, fix bugs, and enhance features based on user behavior
  • Security: Detect and prevent fraud, unauthorized access, and other security issues
  • Legal Compliance: Comply with applicable laws, regulations, and legal processes

Data Storage and Security

Where We Store Your Data

Your data is stored on secure servers provided by Supabase (our database provider) and Vercel (our hosting provider). Our primary data centers are located in Mumbai, India (BOM1), ensuring compliance with Indian data localization requirements where applicable.

Security Measures

We implement industry-standard security measures including:

  • TLS/SSL encryption for all data in transit
  • Encryption at rest for stored data
  • Row Level Security (RLS) ensuring data isolation between organizations
  • Regular security audits and vulnerability assessments
  • Rate limiting and protection against common attacks
  • Automated daily backups with point-in-time recovery

Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Financial and compliance data is retained for a minimum of 8 years to comply with Indian statutory requirements. You may request deletion of your account and personal data at any time, subject to legal retention requirements.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party service providers who assist in operating the Service (Supabase for database, Vercel for hosting, Resend for email delivery, Sentry for error tracking)
  • Within Your Organization: With other members of your organization based on their assigned roles and permissions
  • Legal Requirements: When required by law, subpoena, or other legal process, or to protect our rights, privacy, safety, or property
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections
  • With Your Consent: For any other purpose with your explicit consent

Your Rights and Choices

You have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information, subject to legal retention requirements
  • Export: Export your data in a machine-readable format (CSV/PDF)
  • Opt-out: Unsubscribe from marketing communications and weekly digests
  • Withdraw Consent: Withdraw consent for data processing where consent is the legal basis

To exercise any of these rights, please contact us at privacy@thevcxos.com.

Cookies and Tracking Technologies

We use the following types of cookies:

  • Essential Cookies: Required for authentication and basic functionality of the Service
  • Preference Cookies: Remember your settings such as theme preference (light/dark mode)
  • Analytics Cookies: Help us understand how users interact with the Service (via Vercel Analytics)

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the Service.

Third-Party Services

Our Service integrates with the following third-party services:

Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@thevcxos.com.

International Users

The Service is primarily designed for users in India. If you access the Service from outside India, please be aware that your information may be transferred to, stored, and processed in India where our servers are located and our central database is operated.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the Service.

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Grievance Officer

In accordance with the Information Technology Act 2000 and rules made thereunder, the name and contact details of the Grievance Officer are provided below:

The Grievance Officer shall acknowledge receipt of any complaint within 24 hours and address it within 15 days of receipt.

Back to top