Privacy Policy

This policy explains how VectorXS, operated by Rafael Haimov, handles personal information in this application. It describes the current codebase and should be updated whenever data practices change.

Information we collect

• Account information: name, invited email address, company membership, role, account status, and authentication data.
• Workspace content: conversations, files you upload, project membership, governed documents, and memory entries you choose to save.
• Security and operational data: session identifiers, login timestamps, IP addresses recorded with audit events, invitation records, and service-health or error information.
• Web-search queries: when you choose Web, ask to search, or ask a clearly public time-sensitive question, the current question may be sent to the configured external search provider. Private conversation history is not included in that search query. Public URLs you ask to read may be fetched directly.
• Connected apps: when you authorize a connection, encrypted access and refresh credentials, account identifiers, and granted permissions are stored for your account and workspace. Content fetched on demand may appear in your private conversations. Prepared action payloads are encrypted and retained with their status and provider receipts.
• Support: ticket messages, your reply email, category and delivery status are saved and forwarded to VectorXS support when you submit them. Workspace content is not automatically attached. Company-server tickets are transmitted to the VectorXS control service.
• Payments: Stripe processes payment details. VectorXS stores order references, verified payment and subscription status, hosting and setup selections, and credit ledger records; it does not store full card numbers or security codes.

Why we use it

We use this information to authenticate users, provide the requested workspace features, enforce company permissions, retrieve user-requested information, maintain audit records, troubleshoot the service, and protect accounts and tenant boundaries.

Data minimization

For the hosted option, VectorXS runs the application, workspace database and AI processing on its operator-managed computer. Durable original file uploads use private Cloudflare R2 storage. Cloudflare R2 is file storage; it is not the live workspace database or application runtime.

Deployment is chosen by your organization. On a company-controlled workspace host, files, indexes, conversations, memories and connected-app credentials remain with that host or its configured company Google Shared Drive. In a VectorXS-managed deployment, VectorXS operates the workspace and its persistent content storage. Choosing Google Drive for originals does not move the workspace database or its extracted text to Drive.

In both deployments, selected text or pictures needed for AI requests are sent to VectorXS for processing. The separate inference service does not write prompts, images, embeddings or answers to its application database or files; it records company-level token counts. This is not a guarantee about operating-system swap, crash dumps, network intermediaries or an independently configured host. Your workspace stores the answer and may therefore retain quotations from an analyzed file.

New chat attachments use a bounded temporary memory cache and expire within the configured lifetime, at most three hours, or when the workspace process restarts. They are not automatically added to Knowledge. Explicit Knowledge uploads and saved memories persist on the selected workspace host. Optional automatic memory starts disabled, selects conservative preferences from your own plain chat messages, and can be turned off; learned entries can be inspected and deleted in My memory. Existing legacy uploads are not silently deleted by this update.

The application is designed to collect information needed for account access and the workspace functions you choose to use. Do not upload personal, confidential, regulated, or sensitive information unless your organization has authorized that use and it is necessary for the task.

Sharing and third parties

When OpenAI is the configured AI provider, selected messages, document excerpts, connected-app results and requested output instructions are sent from the VectorXS host to OpenAI to answer your request. The application sets store=false for its OpenAI response requests. This does not promise zero retention by the provider; provider processing and retention remain subject to its terms and account settings. The operator's computer is the VectorXS processing host, not the OpenAI model infrastructure.

Google account data

You choose whether to connect Gmail, Google Calendar or Google Drive. VectorXS uses the authorized account's email address to identify the connection. Read permissions support finding and reading messages, calendar events and files that you ask to use. Gmail sending and creation of events on calendars you own are optional permissions; each supported action still requires a separate review and approval. Google credentials remain encrypted on the workspace host. Selected Google content may be sent through VectorXS to the configured AI provider when you ask the Assistant to use it. New Google connections require an acknowledgement of this processing before authorization begins.

Google account data is used to provide the connected features you request. VectorXS does not sell that data, use it for advertising, or use it to train a general-purpose AI model. It is not automatically shared with other workspace members or copied into company Knowledge. You can disconnect in Settings and revoke access in your Google Account. Existing answers or saved work that contain selected excerpts can remain until deleted; disconnecting is not retroactive deletion. Requests about account data, access or deletion can be sent to the privacy contact below. Google's API Services User Data Policy describes the applicable Limited Use requirements; publication or this notice does not constitute Google verification.

VectorXS uses Cloudflare Turnstile on account forms to protect against automated abuse. Its embedded challenge contacts Cloudflare, and VectorXS verifies the result on the server. Email codes are delivered through Resend or the configured SMTP provider. When you choose an available Google, Microsoft or Apple sign-in option, that provider verifies your identity; VectorXS retains a stable provider identifier and your verified account details. Sign-in alone does not grant access to mail, files or calendars. First-time provider linking also requires verification of your VectorXS email address.

This build contains no advertising network, analytics tracker or social-media embed. Connecting an app opens that provider's authorization website. The server contacts the selected connected app to fetch data or submit an action you separately approve. Original uploaded files may be stored in a private Cloudflare R2 bucket when configured. Public web requests contact the configured search provider or the public site being read. Model, database and hosting providers depend on the operator's configuration.

Connections are private to the signed-in account and workspace, not shared mailboxes. Connected content is not automatically copied into shared company Knowledge. Disconnecting removes locally stored credentials and cancels pending actions, but an in-flight submission may still finish; revoke the provider grant in that provider's account settings too. Deleting local credentials does not erase existing conversations, audit events or backups.

Sale, sharing, and targeted advertising

The current application code does not sell personal information or share it for cross-context behavioral advertising. It does not use personal information for targeted advertising.

Cookies and tracking signals

The application uses a strictly necessary session cookie named vectorxs_session for authentication, plus a necessary CSRF cookie for form protection. A short-lived vectorxs_native_signin cookie binds email and provider verification to the browser that started it. Cloudflare Turnstile also processes security signals for its challenge. Theme and notice preferences use local browser storage. It does not currently set analytics or advertising cookies. Because no sale or cross-context behavioral advertising is performed by this build, Global Privacy Control and browser Do Not Track signals do not change advertising or sale behavior here. See the Cookie Policy.

Retention

Authenticated sessions are configured to expire after 14 days. Other account, workspace, document, audit, and conversation data may remain until deleted, removed under an applicable workspace process, or no longer needed for the service or legal obligations. Production deployments should define and enforce a documented retention schedule.

Your choices and rights

Depending on where you live and which laws apply to the operator, you may have rights to request access, correction, or deletion of personal information, and to receive information about how it is used. California residents may have additional rights when the California Consumer Privacy Act applies to a business. Exercise requests through your workspace administrator or the legal contact listed below.

Children

VectorXS is a business workspace and is not directed to children under 13. The operator should not knowingly collect personal information from a child under 13 without meeting any applicable parental-consent requirements.

Security

The code includes authenticated sessions, role-based access controls, password hashing, login-rate limiting, audit events, and same-origin browser requests. No security measure is absolute, and this policy does not promise that unauthorized access or data loss can never occur.

Operator and contact

Service: VectorXS
Operator: Rafael Haimov
Business address: 12318 caminito festivo
Privacy contact: [email protected]

Changes

When this policy changes, the updated date at the top of the page should also change. Material changes should be communicated to affected users when required.