Privacy Policy
Processing register
Vortex processes three categories of data: (1) account data — email, password (kept only as a hash), subscription plan; (2) billing data — handled by Stripe, never stored in plaintext by Vortex; (3) prospecting data you import or that we extract for you — public professional contact details of third-party businesses.
Legal basis: contract performance (account, billing) and B2B legitimate interest (publicly extracted prospecting data).
Extracted data relates to companies and their public professional activities. Collection of natural persons' names is disabled by default.
Client portal & analytics
If you enable the Client Portal, the sites Vortex generates for your clients include an audience-measurement beacon — pageviews, call-link clicks, form submissions, and real page load time. It works without cookies or a persistent identifier: the visitor's country is derived locally from their IP and the IP is immediately discarded (never stored), device type (mobile/tablet/desktop) is derived from the User-Agent which is discarded the same way, and only the referring domain is kept, never the full URL. A one-time "unique visitor" identifier is recomputed daily via a one-way hash — it cannot be reversed back to the original IP or User-Agent and does not track anyone across days.
This data never leaves our self-hosted infrastructure: geolocation uses a locally bundled MaxMind database, with no call to any third-party service. As the publisher of the final site, you remain responsible for informing your own visitors — Vortex automatically adds a notice to that effect in the footer of every site it generates.
Cookies
Strictly necessary cookies, always active: authentication session and language preference. Any third-party cookie (analytics, marketing) is only set after your explicit consent via the banner shown on the site.
Data security
- Passwords: never stored in plain text. Only a one-way hash is kept; Vortex cannot recover your password.
- Payment: card numbers are handled exclusively by Stripe. They never pass through Vortex's servers and are never stored there.
- Third-party credentials you give us (Google Maps key, Telegram bot token): encrypted at rest with AES-256-GCM. The encryption key is kept outside the database, so a database leak alone does not expose them. They are never sent back to your browser in clear (only the last 4 characters are shown).
- Contract signing links: only their hash is stored in the database. Client Portal links: a hash for verification, plus an encrypted copy so you can copy them again.
- Isolation: each account can only access its own data (row-level security in the database), and traffic to our services is encrypted in transit (HTTPS/TLS).
Limits, in the interest of transparency: our application has to decrypt your third-party credentials to act on your behalf (query Google, send your Telegram notifications), so clear-text access is limited to that automated processing and to the infrastructure administrator. Your other data (prospects, clients, contracts) is protected by access control and encryption in transit, but is not end-to-end encrypted: as the host of the service, Vortex can access it to operate and secure the service and to answer your support requests. No system offers absolute security.
Backups: technical database backups are kept for 14 days at most, then deleted.
Your rights (GDPR)
Right of access, rectification, and portability: contact privacy@usevortex.tech.
Right to erasure ("right to be forgotten"): available immediately, no need to contact us. From Settings → Danger zone, the "Delete my account & data" button triggers a real, immediate cascading deletion in our Supabase database: account, profile, prospects, clients, generated prompts, demos. Any Stripe subscription is canceled automatically. Only technical backups (deleted within 14 days) and the billing records Stripe must keep for its own legal obligations remain.
Hosting
Self-hosted infrastructure: PostgreSQL, authentication, and storage run in our own Docker containers, with no third-party data subprocessor for those components.