Privacy Policy – Vexa AI AB

Vexa AI AB (org. no. 559572-9376), Rådhusesplanaden 6 F, 903 28 Umeå, Sweden ("Vexa AI", "we") provides Vexa Marketing Analytics, a private marketing management platform that we build and operate for our business client, Guilty Pleasure Group AB ("the Client"). This policy explains what data the platform accesses, how it is used and how it is protected.

Contact: admin@vexaai.se

1. Who the platform is for

The platform is used only by authorised staff of the Client to manage the Client's own marketing channels. It is not offered to the public.

2. Data we access

When the Client's staff connect their accounts, the platform accesses data from those accounts only:

Google (via Google APIs)

• Google Business Profile: business listings, customer reviews (including the reviewer's public name and review text) and review replies.
• Google Search Console: search performance data (queries, clicks, impressions, pages) for the Client's own verified websites.

Meta (Facebook and Instagram)

• Page and Instagram Business account information, posts and insights, comments, and Direct Messages with the Client's customers.

TikTok

• TikTok Business account information, videos and their insights, comments on the Client's own videos, and, where connected, ad account performance data.

Platform users

• Name, email address, role and activity logs of the Client's staff who use the platform.

3. How we use the data

We use the data only to provide the platform's features to the Client:

• showing reviews, comments, messages and performance data in one dashboard;
• letting staff reply to reviews, comments and messages (replies are only sent when a staff member chooses to send them);
• generating reports, AI-suggested replies and content ideas, which staff review before use.

We do not sell data, use it for advertising, or use it to build profiles of individuals. We do not use data received from Google APIs to develop, improve or train generalized AI or machine learning models.

4. Google API Services – Limited Use

Vexa AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing

We share data only with service providers needed to run the platform, under data processing agreements:

• Hosting: [Vercel Inc., Render Services Inc.]
• Database: [provider]
• AI processing: [Anthropic PBC], to generate suggested replies and content ideas.

We may disclose data if required by law. We never sell data.

6. Storage and security

Data is stored [in the EU / location]. Access tokens are encrypted, all connections use HTTPS, and access within the platform is limited by user role. Only authorised Vexa AI staff can access data, and only to operate and support the platform.

7. Retention and deletion

We keep data only as long as needed to provide the service to the Client [for the duration of our agreement with the Client, and up to 30 days after it ends]. The Client can disconnect any account at any time; we then stop accessing it and delete its data within [30] days.

To request deletion, contact admin@vexaai.se with the account or page concerned. We will confirm and delete the data within 30 days.

You can also remove the app's access yourself at any time:

• Facebook/Instagram: Settings → Business integrations (or Apps and websites) → remove Vexa Marketing Analytics.
• Google: myaccount.google.com/permissions → remove Vexa Marketing Analytics.
• TikTok: Settings → Security and permissions → Apps → remove the app.

When access is removed, we stop collecting data from that account.

8. Roles and your rights (GDPR)

For personal data in the Client's channels (for example people who review or message the Client), the Client is the data controller and Vexa AI processes the data on the Client's behalf. For platform user accounts, Vexa AI is the controller. You have the right to access, correct and delete your personal data, and to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.

9. Changes

We may update this policy. The date above shows the latest version.