Volvexa ("we", "our", or "us") — a brand operated by LEXVAR, S.A.S. de C.V., Mexico — runs the website volvexa.ai and the Volvexa platform (the "Service"). This page explains what data we collect, why, how we use it, and the rights you have over it. It covers two groups of people: the customers who use the Service, and the business contacts (prospects) whose professional data the Service processes on a customer's behalf.
We aim for plain language over legalese. If anything here is unclear, email hello@volvexa.ai and we'll explain.
1. Information we collect from customers
Account information
When you sign up, we collect your email address, name, and authentication credentials. Authentication is managed by Clerk; we never see or store your password.
Business profile and Vector definitions
During onboarding you describe who you sell to and what you want to achieve (a "Vector"): industry, geography, buyer criteria, and — optionally — the accounts you already work with. We use this solely to run your Vectors and personalize your dashboard and the Service's AI outputs.
Workspace data
Volvexa operates the infrastructure behind your workspace. You do not connect databases, supply API keys, or bring your own data tools. The workspace holds the company records, contact records, buying signals, opportunity scores, outreach drafts, replies, and execution logs that the Service generates for your Vectors. We process this data to provide the Service. We do not sell it, share it with other customers, or use it to train AI models for anyone else.
Connected mailbox (optional)
If you choose to send outreach from your own email account, you connect a Google or Microsoft mailbox through their standard OAuth consent screen. We request only the permission needed to send messages on your behalf (Google: gmail.send; Microsoft: Mail.Send); we do not read your inbox. The access token is stored encrypted (AES-256-GCM) and used only to send the messages you approved. You can disconnect the mailbox at any time from your dashboard or from your Google or Microsoft account settings, which revokes our access immediately. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Replies to your outreach
Messages sent through the Service carry a Volvexa-managed reply address so that replies can be logged, classified (interested, not interested, out-of-office, wrong person, bounce) and shown in your dashboard. We process only replies to messages sent through the Service — never your wider inbox.
Usage data
We collect standard server logs (IP address, browser type, pages visited, request timestamps) for security and operations, and an aggregate, per-page, per-day view count that contains no personal identifiers. Product analytics (which sections of the site people engage with) are first-party, stored in our own systems, and collected only after you accept them in our cookie banner. We use no third-party advertising pixels and no cross-site tracking.
Payment data
Payments are processed entirely by Stripe. We receive a payment or subscription identifier, the amount, and your billing email; we never see, store, or process card numbers. If you request a Mexican tax invoice (CFDI), we collect the tax details required by law to issue it.
2. Business-contact data we process on your behalf
To recommend accounts and draft outreach, the Service processes professional contact data of people at the companies that match your Vector: name, role, business email, company, and the public buying signals that make the company relevant. This is the core of the Service, so we are explicit about it:
- Sources. Publicly available sources such as company websites, job postings, press and business directories; and licensed business databases. We do not obtain this data from the individuals directly.
- Legal basis. Our customers' and our legitimate interest in business-to-business communication (GDPR Art. 6(1)(f)); under Mexico's LFPDPPP, data from publicly accessible sources and the professional data of people acting for a legal entity; and the applicable US frameworks (CAN-SPAM, CCPA/CPRA).
- What we do with it. Evaluate whether the company fits a customer's Vector, prioritize it with evidence, draft a message, and — only if the customer approves — send it from the customer's own mailbox. We also keep company-level market intelligence (the company, its public signals and how well it fits a market) to operate and improve the Service for customers prospecting that market. We do not use business-contact data for any other purpose, and we do not sell it.
- Your rights as a business contact. Every message identifies the sender and can be declined simply by replying. A "no" or an opt-out is recorded as a permanent do-not-contact flag in that customer's workspace, and bounces and wrong-person replies stop further contact. You can also write to hello@volvexa.ai to access, correct, or delete the data we hold about you, or to object to processing; we answer within 20 business days.
- Retention. Company-level information (name, website, public signals, fit) is not personal data and is kept for as long as it is useful. Personal contact records (name, role, business email) are kept while a Vector in that market is active and for up to 36 months after the last contact or verification; re-verifying a record restarts that period. Records that bounce or reach the wrong person are flagged so they are not contacted again. Do-not-contact records are kept for as long as needed to honor them.
3. How we use customer information
- To provide, maintain, and improve the Service
- To run your Vectors and personalize your dashboard, recommendations, and drafts
- To process payments and manage campaign windows and subscriptions
- To send transactional emails (account verification, password resets, billing receipts, security alerts, delivery notices)
- To respond to your support requests
- To send occasional product updates (you can unsubscribe anytime)
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations
We do not sell your personal information and we do not share it with third parties for their own marketing.
4. Service providers
Volvexa relies on a small set of providers to deliver the Service. Each processes data only as needed to perform its function, under contract:
- Clerk — authentication, user accounts, session management
- Vercel — application hosting and serverless functions
- Cloudflare — DNS and email routing for our domains
- Stripe — payment processing
- Resend — transactional email delivery and the reply-capture addresses described above
- Google / Microsoft — only if you connect your mailbox, to send messages from your own account
- Anthropic — AI inference for market validation, scoring narratives, and outreach drafting. Per its published terms, prompts and outputs are not used to train its models
- Managed database, cache and backup providers (United States) — storage for workspace data, encrypted tokens, and weekly backups
- Licensed business-data and business-directory providers — the source categories described in section 2. We do not disclose the identity of these partners publicly; details are available to customers under a data-processing agreement on request
5. Data storage and security
Application servers run on Vercel's infrastructure (United States and global edge locations). Authentication data lives with Clerk (United States). Workspace data is stored with our managed database provider (United States) and backed up weekly to an encrypted private repository.
We use industry-standard practices: TLS in transit, encryption at rest, encrypted storage of mailbox tokens, short-lived session tokens, HTTP-only cookies, and access to production systems limited to authorized personnel behind two-factor authentication.
No system is perfectly secure. If we detect a security incident affecting your data, we will notify you without undue delay — where feasible within 72 hours of becoming aware — and tell you what happened and what we are doing about it.
6. Data retention
We retain your account and workspace data while your account is active. You can delete your account at any time from your account menu; your access ends immediately and any active subscription is cancelled the same day. Within 60 days we delete your personal data and your workspace content (messages, notes, the list of accounts you uploaded), except where the law requires us to keep it longer (for example, tax and billing records). We may keep your Vector definition and your decisions on the accounts we delivered in anonymized form, with no link to you or your company, to improve the Service. Business-contact data follows the retention rules in section 2.
7. Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data (subject to legal retention requirements)
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time (for processing based on consent)
- Lodge a complaint with your local data protection authority
These rights apply under the EU GDPR, Mexico's LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), and California's CCPA/CPRA — among other regional laws. To exercise any of them, email hello@volvexa.ai; we respond within 20 business days.
8. Cookies, local storage and consent
We use a small number of first-party cookies. None of them are advertising cookies:
- Clerk session cookies — keep you signed in (strictly necessary)
- Language preference cookie (
VOLVEXA_LOCALE) — remembers your EN/ES choice - Consent cookie (
volvexa_consent) — remembers the choice you made in our cookie banner - Browser local storage — a random visitor/session identifier used only for analytics once you have accepted analytics, and the draft of the Vector you started typing on the home page so it is not lost
Beyond those, we ask for your consent before collecting product analytics. Our banner lets you accept all, decline everything except the strictly necessary cookies, or choose category by category (essential, analytics, marketing). Until you accept, no analytics or marketing events are collected. Analytics events go to our own systems, never to an ad network. You can change your choice at any time and clear cookies from your browser settings.
9. International data transfers
Our providers operate globally. By using the Service, you consent to your data being transferred to and processed in countries outside your own, including the United States. We rely on standard contractual clauses and our providers' certifications (SOC 2, ISO 27001 where applicable) to ensure appropriate safeguards.
10. Children's privacy
The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us and we'll delete it.
11. Changes to this policy
We may update this Privacy Policy as the Service evolves. When we make material changes, we'll notify customers by email and update the "Last updated" date at the top. Continued use of the Service after changes constitutes acceptance.
12. Contact
Questions, requests, or complaints about this Privacy Policy?
Email: hello@volvexa.ai
Data controller: LEXVAR, S.A.S. de C.V. (Volvexa), State of Mexico, Mexico