Terms of Service & Privacy Policy

1. Introduction & Definitions

Welcome to Vexora. These Terms of Service ("Terms") and Privacy Policy ("Policy") together form a binding agreement between you and Vexora regarding your access to and use of the website, web application, and any related services available at vexora.nl and its subdomains (collectively, the "Service"). By creating an account or otherwise using the Service, you confirm that you have read, understood, and agree to be bound by these Terms and this Policy. If you do not agree, you must not use the Service.

In these Terms and this Policy, the following definitions apply:

• "Vexora", "we", "us", or "our" refers to the operator of the platform and services provided under vexora.nl, operating from the Netherlands.
• "User", "you", or "your" refers to any individual or, where applicable, school or organization that registers for, accesses, or uses the Service.
• "Content" refers to any data, tasks, notes, goals, calendar events, documents, messages, or other information created, stored, uploaded, or generated by a User within the Service, including content created with the assistance of the AI Assistant.
• "Account" refers to the registered user profile through which a User accesses the Service.
• "AI Assistant" refers to the AI-powered assistant features integrated into the Service, which process natural-language input to perform actions or generate content within the Service.
• "Personal Data" has the meaning given to it under the EU General Data Protection Regulation ("GDPR"), i.e. any information relating to an identified or identifiable natural person.

2. Terms of Service

2.1 Eligibility & Registration

• Accurate Information Required: You must provide accurate, current, and complete information when registering for and using the Service, including your full name, email address, username, and date of birth. You must keep this information up to date. Providing false or misleading information may result in suspension or termination of your Account.
• Minimum Age: You must be at least 13 years old to create an Account. If you are under the age at which you can lawfully consent to data processing in your country (which may be higher than 13 in some EU member states), you may only use the Service with the consent of a parent or legal guardian. See Section 3.10 ("Children's Privacy") for more information.
• One Account Policy: Each individual is permitted to maintain only one Vexora Account. Creating or using multiple accounts to circumvent limits, restrictions, or bans is strictly prohibited and may result in termination of all associated Accounts.
• Account Security: You are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your Account, including activity by third parties you authorize (e.g., via OAuth applications). You must notify us immediately at [email protected] if you suspect any unauthorized access to or use of your Account. Where two-factor authentication (2FA) is available, we strongly recommend enabling it.

2.2 Acceptable Use

• Lawful Use Only: You agree to use the Service only for lawful purposes and in accordance with these Terms. You may not use the Service to create, store, upload, or share any content that is illegal, fraudulent, defamatory, infringing, hateful, harassing, sexually explicit involving minors, or that violates the rights of any third party.
• No Abuse of the Service: You may not (a) attempt to gain unauthorized access to any part of the Service, other Users' accounts, or our systems and networks; (b) interfere with or disrupt the integrity or performance of the Service, including through excessive automated requests, scraping, or denial-of-service activity; (c) reverse-engineer, decompile, or attempt to extract the source code of the Service except as permitted by law; (d) use the Service to develop a competing product; or (e) circumvent any rate limits, usage limits, or access controls.
• AI Assistant Usage: The AI Assistant is provided to help you manage tasks, notes, planning, and related Content. You may not use the AI Assistant to generate content that violates these Terms, applicable law, or third-party rights. By submitting prompts or other input to the AI Assistant, you acknowledge that this data may be stored, processed, and analyzed as described in Section 3.6 ("AI Processing & Training") of this Policy. AI-generated output may be inaccurate or incomplete; you remain responsible for reviewing and verifying any AI-generated Content before relying on it.
• Educational Plans: Where a school or organization provides access to the Service to its students or members under an educational plan, that organization is responsible for obtaining any consents required from students, parents, or guardians under applicable law, and for ensuring use of the Service complies with its own policies. Vexora may provide domain-restricted or organization-managed accounts as part of such plans.

2.3 Subscriptions, Payments & Billing

• Free and Premium Plans: Vexora offers a free tier as well as paid Premium subscription plans (e.g., monthly and multi-month plans) and optional AI credit purchases, which unlock additional features such as extra themes, increased AI usage limits, and other benefits described on our pricing page.
• Payment Processing: All payments are processed by our third-party payment processor, Stripe. Vexora does not store your full payment card details; these are handled directly by Stripe in accordance with its own terms and privacy policy. Prices are displayed in Euros (EUR) and are inclusive of applicable taxes unless stated otherwise.
• Renewals & Cancellation: Paid plans cover the period purchased (e.g., 1, 3, 6, or 12 months) and do not automatically renew unless explicitly stated at the time of purchase. You may manage or cancel your subscription at any time via your account settings or by contacting [email protected].
• Refunds: Except where required by applicable consumer protection law (including your statutory right of withdrawal under EU law for distance contracts, where applicable), fees paid for Premium plans and AI credits are non-refundable. If you believe you were charged in error, contact [email protected] and we will review your request.
• AI Credits: AI credits purchased separately from a Premium plan are used to access AI Assistant functionality beyond included usage limits. Unused credits do not expire unless your Account is terminated for violation of these Terms, but are non-refundable and non-transferable.

2.4 Intellectual Property

• Our IP: The Service, including its software, design, branding, logos, and underlying code, is and remains the property of Vexora and its licensors. Nothing in these Terms grants you any right to use Vexora's trademarks, logos, or branding without prior written consent.
• Your Content: You retain all ownership rights in the Content you create or upload. By using the Service, you grant Vexora a limited, non-exclusive, worldwide license to host, store, process, and display your Content solely for the purpose of providing and improving the Service to you, including processing by the AI Assistant as described in this Policy.

2.5 Availability, Suspension & Termination

• Service Availability: We aim to keep the Service available and reliable but do not guarantee uninterrupted, timely, secure, or error-free operation. We may modify, suspend, or discontinue all or part of the Service at any time, including for maintenance, security, or legal reasons, with reasonable notice where practicable.
• Suspension or Termination by Vexora: We may suspend or terminate your Account, with or without notice, if we reasonably believe you have violated these Terms, engaged in fraudulent or unlawful activity, or where required to protect the security, integrity, or availability of the Service. Where reasonably possible, we will provide notice and an opportunity to address the issue before termination.
• Termination by You: You may stop using the Service and delete your Account at any time via your account settings. See Section 3.9 ("Data Retention & Deletion") for what happens to your data upon deletion.
• Effect of Termination: Upon termination, your right to use the Service ceases immediately. Provisions of these Terms that by their nature should survive termination (including intellectual property, disclaimers, limitation of liability, and governing law) will survive.

2.6 Disclaimers & Limitation of Liability

• "As Is" Basis: The Service is provided on an "as is" and "as available" basis, without warranties of any kind, whether express, implied, or statutory, to the maximum extent permitted by applicable law. Vexora does not warrant that the Service will be error-free, secure, or that any defects will be corrected, nor that AI-generated content will be accurate, complete, or suitable for any particular purpose.
• Limitation of Liability: To the maximum extent permitted by applicable law, Vexora shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or revenue, arising from or related to your use of (or inability to use) the Service. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death, personal injury, or fraud.
• Indemnity: You agree to indemnify and hold Vexora harmless from any claims, damages, or expenses (including reasonable legal fees) arising from your breach of these Terms or your misuse of the Service, to the extent permitted by applicable law.

2.7 Changes to These Terms

We may update these Terms from time to time to reflect changes in our Service, legal requirements, or business practices. We will update the "Last updated" date at the top of this page when we do so, and, for material changes, may provide additional notice within the Service. Continued use of the Service after changes take effect constitutes your acceptance of the revised Terms. If you do not agree to the revised Terms, you must stop using the Service and may delete your Account.

Questions regarding these Terms may be directed to our Support Center or by email at [email protected].

3. Privacy Policy

This Privacy Policy explains how Vexora collects, uses, shares, and protects your Personal Data when you use the Service, in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

3.1 Data Controller

Vexora, operating from the Netherlands, is the data controller responsible for your Personal Data processed in connection with the Service. For any privacy-related questions or to exercise your rights under this Policy, you can contact us at [email protected].

3.2 What Data We Collect

We collect the following categories of Personal Data:

• Account Information: Full name, username, email address, date of birth, and (if you choose to set one) a profile picture.
• Authentication Data: Your password (stored in hashed form, never in plain text) and, if enabled, two-factor authentication (2FA) settings.
• Content: Tasks, notes, goals, calendar events, deadlines, reminders, projects, documents, support messages, and other information you create or upload within the Service.
• AI Assistant Data: Prompts, instructions, and other input you provide to the AI Assistant, along with the resulting AI proposals and actions.
• Preferences: Your language, theme, display density, and notification settings.
• Payment & Subscription Information: Your subscription plan, status, and transaction history. Full payment card details are collected and processed directly by Stripe and are not stored by Vexora.
• Technical Data: IP address, device and browser type, log data, and similar technical information generated through your use of the Service, used for security, abuse prevention, and troubleshooting.
• Push Notification Data: If you opt in to push notifications, we store the necessary subscription information (e.g., your device's push endpoint) to deliver notifications to you.

Sensitive fields such as your email address, full name, username, date of birth, and 2FA secret are stored in encrypted form in our database.

3.3 How We Use Your Data

We use your Personal Data to:

• Provide, operate, and maintain the Service, including your Account, Content, and AI Assistant features (necessary for performance of our contract with you);
• Process payments and manage your subscription (necessary for performance of our contract with you);
• Communicate with you about your Account, transactional matters, support requests, and important changes to the Service (necessary for performance of our contract with you, or based on our legitimate interest in keeping you informed);
• Send push notifications you have opted in to, such as reminders and deadline alerts (based on your consent);
• Maintain the security, integrity, and proper functioning of the Service, including detecting and preventing abuse, fraud, and unauthorized access (based on our legitimate interest in protecting the Service and our Users);
• Improve and develop the Service, including the AI Assistant, as described in Section 3.6 (based on our legitimate interest in improving our Service, balanced against your privacy rights); and
• Comply with our legal obligations, such as tax, accounting, and record-keeping requirements.

3.4 Cookies & Local Storage

Vexora does not use third-party advertising or tracking cookies. The Service uses your browser's local storage to keep you signed in and to remember your preferences, including:

• An authentication token, used to keep you logged in;
• A cached copy of your profile information, used to load the Service faster;
• Your theme, language, and display density preferences.

This information is stored locally in your browser and is essential for the Service to function. If you clear your browser's local storage, you will be signed out and your local preferences will be reset.

3.5 Third-Party Service Providers

We share Personal Data with the following categories of trusted third-party service providers ("processors"), each of which is contractually bound to process your data only on our instructions and in accordance with applicable data protection law:

• Payment processors – process your payment details to handle subscription and AI credit purchases.
• Email delivery providers – send transactional emails such as account verification, password resets, and important notices.
• Database hosting providers – host the database in which your Account and Content data is stored.
• Content delivery & storage providers – store and deliver uploaded files such as profile pictures.
• AI model providers – process the prompts and input you submit to the AI Assistant in order to generate responses and perform requested actions.

Some of these providers may process data on servers located outside the European Economic Area (EEA). Where this is the case, we rely on appropriate safeguards recognized under the GDPR (such as Standard Contractual Clauses) to ensure your data remains protected to a standard equivalent to that provided within the EEA.

We do not sell your Personal Data to third parties, and we do not share it with third parties for their own marketing purposes.

3.6 AI Processing & Training

• Processing for Functionality: When you use the AI Assistant, your prompts and related Content are sent to our AI processing pipeline and, where applicable, to our AI model providers (see Section 3.5) in order to generate responses, proposals, and actions within the Service. This data is stored temporarily to support features such as undo history and proposal review.
• Improvement of AI Features: By submitting prompts, refinements, or confirmations to the AI Assistant, you acknowledge and agree that this assistant-submitted data may also be used by Vexora to evaluate, train, and improve the AI Assistant's functionality and response quality. Content that you do not submit to the AI Assistant (e.g., notes or tasks you create manually without involving the assistant) is not used for this purpose.
• Retention of AI Data: AI proposals are retained for up to 24 hours, undo history for up to 30 days, and AI usage logs (used for monitoring usage limits and abuse prevention) for up to 90 days, after which they are automatically deleted.

3.7 Legal Bases for Processing (EEA Users)

If you are located in the EEA, we process your Personal Data on the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b) GDPR) – to provide the Service you have requested, including your Account, Content, AI Assistant, and paid subscriptions;
• Legitimate interests (Art. 6(1)(f) GDPR) – for security, fraud prevention, and improving the Service, balanced against your rights and interests;
• Consent (Art. 6(1)(a) GDPR) – for optional features such as push notifications, which you can withdraw at any time; and
• Legal obligation (Art. 6(1)(c) GDPR) – where we are required to retain or disclose data to comply with the law (e.g., tax records relating to payments).

3.8 Security

We implement technical and organizational measures designed to protect your Personal Data against unauthorized access, loss, misuse, or disclosure. These measures include encryption of sensitive personal data fields at rest, hashed storage of passwords, JSON Web Token (JWT)-based session authentication, optional two-factor authentication, and rate limiting to mitigate abuse. While we take reasonable steps to protect your data, no system can be guaranteed to be 100% secure, and you share information with us at your own risk.

3.9 Data Retention & Deletion

• General Principle: We retain your Personal Data only for as long as necessary to provide the Service to you, comply with our legal obligations, resolve disputes, and enforce our agreements.
• Account Deletion: If you delete your Account, your Account and associated Content (including tasks, events, notes, goals, projects, deadlines, reminders, support tickets, messages, premium and AI credit information, and push notification subscriptions) will be moved to an archived state and permanently and automatically deleted after 30 days.
• Inactive Accounts: Accounts that have been inactive for an extended period (currently 365 days) may be flagged for deletion in accordance with our data minimization obligations; we will make reasonable efforts to notify you before this occurs where possible.
• Messages & AI Logs: Messages are retained for up to 90 days, AI usage logs for up to 90 days, AI proposals for up to 24 hours, and AI undo history for up to 30 days, after which they are automatically deleted, as described in Section 3.6.

3.10 Your Rights

If you are located in the EEA or another jurisdiction granting similar rights, you have the right to:

• Access the Personal Data we hold about you;
• Rectify inaccurate or incomplete Personal Data (most account details can be updated directly in your account settings);
• Erase your Personal Data (e.g., by deleting your Account, as described in Section 3.9, or by contacting us);
• Restrict or object to certain processing of your Personal Data;
• Data portability – receive a copy of certain Personal Data in a structured, commonly used, and machine-readable format; and
• Withdraw consent at any time where processing is based on consent (e.g., push notifications), without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at [email protected] or via our Support Center. We will respond to your request within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data protection supervisory authority — in the Netherlands, this is the Autoriteit Persoonsgegevens.

3.11 Children's Privacy

The Service is intended for users aged 13 and older. If you are under the age at which you can lawfully consent to data processing in your own country (which may be higher than 13 in some EU member states), you may only use the Service with the consent of a parent or legal guardian, who should review this Policy with you. If we become aware that we have collected Personal Data from a child without the required parental or guardian consent, we will take steps to delete that information as soon as reasonably possible. Where the Service is provided to students through a school's educational plan, that school is responsible for ensuring any necessary parental consents have been obtained in accordance with applicable law.

3.12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will update the "Last updated" date at the top of this page and, where changes are material, may provide additional notice within the Service. We encourage you to review this Policy periodically.

For privacy-related inquiries or requests to exercise your rights, please contact our Support Center or email [email protected].

4. Governing Law & Disputes

Vexora is operated from the Netherlands. These Terms of Service and this Privacy Policy, and any disputes arising out of or in connection with them or your use of the Service, are governed by the laws of the Netherlands, without prejudice to any mandatory consumer protection or data protection rights you may have under the laws of your country of residence if that is an EU member state. Any disputes that cannot be resolved informally shall be submitted to the exclusive jurisdiction of the competent courts of the Netherlands, subject to any mandatory rights you have to bring proceedings in the courts of your own country of residence.