Privacy Policy for Vexter AS

1. Introduction

This English Privacy Policy is provided for convenience. In case of any discrepancies between this text and the original Norwegian Privacy Policy, the Norwegian version is the authoritative text.

This Privacy Policy explains how Vexter AS processes personal data in connection with Vexter’s services, websites, and communications.

Vexter is a B2B platform for prospecting, sales, and follow-up of business contacts. The service is designed for use between businesses and may process business-related personal data about individuals, typically employees, users, contacts, and representatives of companies.

This Privacy Policy covers:

• the processing of personal data we collect directly from you, for example when you create a user account, contact us, or use the service, and
• the processing of personal data from public sources, such as public registries, company websites, and other publicly available sources, when we maintain contact and company data on the platform.

2. Who Is the Data Controller

Vexter AS is the data controller for the processing of personal data described in this statement, unless otherwise expressly stated.

3. When Vexter Acts as Data Controller and Data Processor

Vexter has several roles under data protection legislation and may, depending on the context, act as either a data controller or a data processor. Third parties act as independent data controllers when they process personal data made available through Vexter for their own purposes.

Data Controller

Vexter is the data controller for our:

• operation and administration of our website and platform,
• creation and management of customer relationships,
• handling of billing, security, logging, support, and fraud prevention,
• processing, organizing, and updating publicly available information about companies and business contacts in our database,
• processing of information in connection with our own marketing and sales activities,
• processing to ensure compliance with legal requirements.

As the data controller, Vexter will determine the purposes and means of processing personal data.

Data Processor

When a company uses Vexter to process personal data in its own campaigns, customer lists, integrations, or lead follow-ups, the company will be the data controller and Vexter the data processor. Vexter will then process personal data on behalf of the company.

This applies when the company:

• enters its own contacts or customer data into Vexter,
• uses Vexter to send out and follow up on campaigns,
• connects to an email account, calendar, or other systems,
• uses the platform to communicate with its own leads, customers, or other contacts.

Such processing will be governed by a data processing agreement between the data controller and Vexter, acting as the data processor on behalf of the company.

4. Categories of Personal Data We Process

The information we process depends on your relationship with Vexter.

4.1 Information about customers and users of the platform

The information we process about our customers and users may include:

• name,
• work email address,
• phone number,
• employer, role, and team affiliation,
• login and account information,
• user preferences and settings,
• billing and payment information,
• support and communication history,
• technical data, such as IP address, device, browser, and system logs,
• data from connected email and calendar accounts, as described in section 8.1 (email address and name, encrypted access tokens, campaign replies, free/busy times, events created by Vexter, and an optional writing-style profile).

4.2 Information about companies and contacts

Information we process from publicly available sources may include:

• name,
• position or role,
• employer and affiliated company,
• work-related email address,
• work-related phone number,
• publicly available information about the company where the person works,
• publicly available information about the person’s professional role,
• role and ownership information from public registries (for example board positions and shareholdings),
• whether a work email address has been verified as deliverable,
• a role classification used to suggest the most relevant contact at a company,
• age and derived age ranges for persons with an ownership or role connection to a company, where necessary for company-focused searches.

People search is disabled on the Vexter platform. The system is designed for company- and role-based searches, not searches for private individuals.

The Vexter platform is designed to present up-to-date, publicly available information about businesses. We regularly retrieve information from the Brønnøysund Register Center (every 30 days or more frequently) and publicly available company websites. This means that if you remove information related to you from such sources, the information will also be updated or removed from our company database.

4.3 Information Related to Campaigns and Communication

When Vexter is used for campaigns and follow-up, the user, as the data controller, may process information such as:

• recipient and sender,
• work-related email address,
• company affiliation and role,
• content of email communications processed in Vexter,
• send status,
• delivery status (bounces, spam complaints),
• link clicks in campaign emails where the customer has enabled click tracking (time and IP address),
• AI-generated analyses of replies (intent, sentiment, topics and a short conversation memory),
• unsubscription, blocking, or opt-out,
• aggregated analysis of campaign effectiveness.

Vexter is designed for B2B communication and one-to-one personalized emails, not for consumer-oriented mass mailings. Each message must be addressed to a single recipient within a company, based on publicly available business information about that specific company.

4.4 Information We Do Not Process

Vexter is not intended for the processing of special categories (sensitive) of personal data. We require that Vexter users do not enter sensitive information into the platform. If we discover such information, we reserve the right to delete or restrict the information, as well as suspend access to Vexter, in order to comply with legal obligations.

5. Where We Get the Information From

We collect personal data both directly from data subjects and from other sources.

5.1 Information we collect directly from individuals

We collect information directly from individuals when they:

• create an account or order the service,
• fill out forms on our website,
• request a demo, contact us by email, phone, or other means.

5.2 Information we collect from publicly available sources

For company information and business contact details, we obtain information from:

• Brønnøysund Register Center,
• the Swedish Companies Registration Office and similar public registries when relevant,
• companies’ own websites,
• other publicly available sources of business information,
• professional profiles and open sources that describe a person’s role or place of work.

Since Vexter collects and updates company and contact information from publicly available sources and registries, there is normally an obligation to inform each individual directly within one month after the information was obtained.

Vexter does not send individual notifications to each contact because:

• The information is already publicly available and limited to name, title, employer, work email, and work phone number. Our processing therefore has minimal impact on individuals’ privacy.
• The number of contacts is very high, variable, and frequently updated. Collecting, verifying, and sending individual notifications within the deadline would require significant resources and involve extensive email, SMS, or phone communications, which could also be perceived as spam by the recipients.

Vexter invokes the exception to the direct individual notification requirement pursuant to GDPR Article 14(5)(b), as direct notification to every business contact in the database would require a disproportionate amount of effort. This exception is justified by the high number of ongoing updates for source synchronization, the fact that the information is limited exclusively to publicly available and professionally related contact information, and that the information has little bearing on the individuals’ private lives. Vexter also does not store information that we know has been deleted or modified from public sources.

To safeguard the rights of data subjects, we make this information available on our website, ensure easy access to opt-out, and regularly update or delete the data in accordance with the source registries. We also require that Vexter users disclose the source of the information.

6. Why We Process Personal Data

We use information to provide, manage, and promote our platform. We process personal data only when we have identified a valid legal basis for processing in accordance with our purposes. At times, we may also process personal data for other purposes provided they are not incompatible with the original purposes, such as for accounting purposes, product development, and innovation. This does not apply to data received from Google APIs, which is used only as described in section 8.1.

6.1 Operation, Delivery, and Administration of the Service

We process personal data to:

• create and manage accounts,
• provide platform functionality,
• provide access to user profiles and team features,
• manage payments, subscriptions, and customer relationships,
• provide customer support and follow up on inquiries.

Legal basis for processing: Here, Vexter relies on a balancing of interests as the legal basis, where the balancing is based on our legitimate interest in operating the service and providing access to it for the appropriate users.

6.2 Security and Prevention of Misuse

We process personal data to:

• protect the service, users, and infrastructure,
• detect and address misuse, security breaches, and unauthorized use,
• document compliance with contractual obligations and legal requirements,
• debug, test, and improve stability and security.

Legal basis for processing: For the minor security activities mentioned here, Vexter relies on a balancing of interests as the legal basis, where the balancing is based on our legitimate interest in ensuring the stable, secure, and lawful operation of the service, protecting Vexter, our customers, and data subjects against misuse and security incidents, including preventing unlawful use of the platform.

Legal basis for processing: Where processing is necessary to comply with a legal obligation, such as documenting security incidents or fulfilling statutory duties, the processing is based on a legal obligation.

6.3 Creating an overview of companies and business contacts

We process information to:

• collect, organize, and update publicly available information about companies and contacts,
• enable customers to identify relevant business information in the B2B market,
• maintain up-to-date information on companies, roles, and work-related contact information,
• remove or update information that is no longer accurate or available,
• process age information in order to provide derived age ranges for persons with an ownership or role connection in company-focused searches.

Legal basis for processing: For the activities mentioned here, Vexter relies on a balancing of interests as the legal basis, where the balancing is based on our legitimate interest in offering a B2B service for prospecting, establishing contacts, and sales efforts based on publicly available business information, while the processing is limited to work-related information and use in a business context.

For age information, the purpose is to provide derived age ranges for persons with an ownership or role connection in company-focused searches. The search result is companies, not persons. We do not display full dates of birth or use the information to determine or predict that a person wishes to sell a company or is approaching a generational transition.

7. What Vexter Does Not Do

Vexter imposes strict requirements on our customers and users regarding the use of the platform.

Vexter does not process special categories (sensitive) of personal data, such as information regarding health, political opinions, religion, trade union membership, sexual orientation, or similar. We do not allow our users to enter special categories of personal data in free-text fields, campaigns, responses, notes, or other parts of the platform.

Vexter does not permit targeted marketing or B2C campaigns.

Vexter does not allow searches for individuals on the platform; the system is designed for company- and role-based searches, not searches for private individuals.

Vexter does not sell personal data to third parties for consumer-targeted advertising.

8. Who Are the Recipients of Personal Data

The information from Vexter as a service is made available to our platform users, who are subject to our Terms of Use.

Vexter shares personal data with the data processors we need to provide the service: hosting, database and cache (Render, EU – Frankfurt), delivery of the website and the app's user interface, including cookieless page-performance measurement (Vercel; server-side code runs in the EU – Frankfurt, pages and files are delivered through Vercel's global network; page addresses, performance data and technical connection data such as IP address), file storage (Amazon Web Services, EU – Ireland), error and performance monitoring (Sentry, EU-hosted; error reports can contain the content that was being processed when a failure occurred), transactional email (Resend), payment processing, product analytics (PostHog, see below) and AI-based processing (see below). Vercel, our AI providers, and any CRM system a customer chooses to connect may process data outside the EU/EEA; see section 9.

For AI-based processing, Vexter uses OpenAI (OpenAI API platform) and Google Gemini (Google's paid Gemini API) as data processors; one is used as an automatic fallback for, or alternative to, the other, and some features use OpenAI directly. Processing by our AI providers may take place outside the EU/EEA, under appropriate safeguards such as the EU Standard Contractual Clauses (SCCs). Under their API terms, neither provider uses our prompts or responses to train its models; they may retain them for a limited period solely for abuse monitoring. These providers process campaign content solely for the purposes described in this policy: analysing incoming campaign replies (intent, sentiment, topics and a short conversation memory – results are stored in the customer's own workspace), drafting suggested emails and replies (with an optional, customer-enabled automatic send mode), preparing meeting notes and meeting descriptions, and the optional writing-style analysis of the user's own sent emails.

Vexter also learns from the results of the customer's own campaigns. For each AI-generated email we record its outcome (delivered, replied, reply sentiment, conversation outcome such as a booked meeting) together with its context (recipient industry, seniority, region, company size and subject line). Once a week these records are summarised, with the help of our AI providers under the same no-training terms, into writing patterns that are used only to improve future draft suggestions within the same customer workspace (team). What a contact has said in earlier conversations (for example interests or needs they expressed) can likewise be used in later emails to that contact from the same workspace. These writing patterns and conversation memories are shared among the users of that team, but are never shared with, or used for, other customers, and no AI model is trained on them.

When a customer connects its own CRM system (HubSpot or SuperOffice) and enables the corresponding synchronisation settings, Vexter copies, at the customer's direction: campaign replies (or an excerpt) with their sentiment/intent classification, sent campaign emails, meetings booked through Vexter, campaign status as contact properties and, where enabled, a follow-up task per reply. When the customer uses the integration, Vexter can also create or update contact records (name, work email, phone and role) in the customer's CRM system from Vexter's company data, linked to the matching company, and push prospect lists that the customer chooses. A Microsoft Dynamics 365 connection is used only to import accounts into Vexter. Copies held in the customer's CRM system are governed by the customer's agreement with that CRM provider.

To protect recipients and our customers' sender reputation, Vexter keeps a shared block list of email addresses that have hard-bounced, generated a spam complaint or soft-bounced repeatedly (three times), and blocks further sending to those addresses for all Vexter customers. The address and its classification (hard bounce, spam complaint or repeated soft bounce) are also reported to Vexter's company data service (Nordic Resolver) so that undeliverable addresses are no longer offered. No message content is included. When a recipient unsubscribes, the address may also be passed to Nordic Resolver's suppression list, so that the person is not contacted via Vexter. Apart from this block list and such opt-outs, no results of our customers' email sending are shared across customers: sends, replies, reply sentiment and booked meetings stay within the individual customer's workspace, are not shared with other customers and are not reported to Nordic Resolver, whichever email provider (Google, Microsoft or IMAP) is connected.

To show profile pictures in conversations, your browser may request an image from Gravatar using a one-way hash of the correspondent's email address. Product analytics (PostHog, EU-hosted) is used on our website and in the app only if you have consented to analytics. It records how they are used, for example which pages are visited and which buttons and links are clicked, including where on a page clicks are made (heatmaps). Session recording is disabled.

Our website and app use Google Tag Manager to load Google Analytics and advertising measurement tags. These run in Google Consent Mode: until you consent, they set no cookies and your visit is not used for analytics or advertising, although Google may receive limited technical information without cookies, such as your IP address and the address of the page. You can change your choice at any time in the cookie settings.

We may also share information when necessary to comply with legal obligations, protect rights, prevent misuse, or respond to lawful requests from public authorities.

8.1 Google API Services – Limited Use Disclosure

8.1.1 Gmail

When you connect your Gmail account, Vexter requests access to send and read email and to change labels (gmail.modify), plus your email address and name, and uses it to:

• Send emails: send the outreach emails, follow-ups and replies that you have approved, or that you have explicitly set to be sent automatically, from your own Gmail account.
• Read replies: read new messages in your inbox, including their full content, to detect replies to your Vexter campaigns. Replies matched to a campaign are stored in your workspace, analysed by our AI providers and used to draft suggested responses, as described in section 8. Other messages are not stored; their sender, subject and technical message identifiers may appear in our operational logs.
• Detect delivery problems: read bounce and spam-complaint reports to protect your sender reputation; a short diagnostic excerpt is stored.
• Mark as read: mark processed replies and reports as read. This is the only change Vexter makes to your mailbox; Vexter never deletes, moves or drafts messages in Gmail.
• Writing-style analysis (optional, only when you start it): read up to 50 of your recent sent emails to derive a writing-style profile. The emails themselves are not stored; the profile (style attributes and characteristic phrases, which may include customer or project names) is.

We receive notice of new messages through Gmail push notifications via Google Cloud Pub/Sub; each notification is logged without message content.

8.1.2 Google Calendar

When you connect Google Calendar, Vexter uses it to:

• read your free/busy times to suggest available meeting times to prospects – in a reply you approve, or automatically if you have enabled automatic replies;
• create a calendar event when a prospect accepts a meeting, with the prospect as attendee and, where selected, a Google Meet link (on some booking paths the event description is generated by AI from the conversation);
• create short-lived placeholder (“hold”) events without attendees while times are offered, and delete them when the offer expires;
• delete events created by Vexter when you cancel the meeting in Vexter;
• read your calendar's time zone.

Vexter does not read the titles, attendees or content of events it did not create, and does not change your other events. For events Vexter creates, we store the title, description, time, attendee and video link to show upcoming meetings in Vexter.

8.1.3 Sharing of Google User Data

Google user data is shared only as needed to provide the features described above:

• with our AI providers OpenAI and Google Gemini, which process reply content (and, for the optional writing-style analysis, sent emails) under no-training terms;
• with our hosting and infrastructure providers (Render, Amazon Web Services) and Sentry (error reports may contain content);
• with your own CRM system, only if you connect it and enable synchronisation;
• with Vexter's company data service (Nordic Resolver), which receives only the address and classification of hard bounces, spam complaints and repeated soft bounces;
• with Gravatar, which receives a one-way hash of a correspondent's email address when your browser loads a profile picture.

Google user data is not shared with other Vexter customers, except that addresses on the shared block list (hard bounces, spam complaints and repeated soft bounces) are blocked for all customers as described in section 8. We do not sell Google user data or use it for advertising.

8.1.4 Storage, Retention and Deletion

• OAuth tokens are stored encrypted until you disconnect the account. When you disconnect, we delete the stored tokens and stop push notifications. You can also revoke Vexter's access at any time at myaccount.google.com/permissions.
• Campaign replies, their AI analyses, campaign performance records and events created by Vexter are kept in your workspace and are deleted when you ask us to (privacy@vexter.io).
• Push-notification logs (without content) are deleted after 30 days.
• Copies held in your CRM system are governed by your agreement with that provider.

8.1.5 Security

All OAuth tokens are encrypted at the application layer before they are stored, using authenticated encryption (Fernet: AES-128-CBC with HMAC-SHA256); the encryption keys are kept in our hosting provider's secret configuration, separate from the database. Tokens are never stored in plain text, access tokens are renewed automatically, and data is encrypted in transit (TLS).

8.1.6 Limited Use Commitments

Specifically, this means that we commit to the following:

1. We use Google user data only to provide and improve the user-facing features described in this policy and visible in the Vexter app.
2. We transfer Google user data to others only as necessary to provide or improve those features (section 8.1.3), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.
3. We do not use or transfer Google user data to serve advertising, including retargeting, personalised or interest-based advertising.
4. We do not sell Google user data.
5. We do not use Google user data to determine creditworthiness or for lending purposes.
6. No one at Vexter reads your Google user data unless:
   • you have given explicit consent for us to view specific messages or data, for example in a support case,
   • it is necessary for security purposes, such as investigating abuse or a security incident,
   • it is necessary to comply with applicable law, or
   • the data has been aggregated and anonymised and is used for internal operations in accordance with applicable law.
7. We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and no AI model is trained or fine-tuned on it. The only learning Vexter performs is the workspace-level personalisation described in section 8, which is used solely for the customer whose campaigns produced it.

9. Transfer of Personal Data

Vexter's own hosting, database and file storage are located in the EU/EEA, as is our error monitoring (Sentry). Vercel, which delivers the website and the app's user interface, and our AI providers (OpenAI and Google) may process data outside the EU/EEA, and CRM systems that a customer chooses to connect (for example HubSpot) may do so; such transfers rely on the safeguards below. Our clear guiding principle is that all personal data should be processed within the EU/EEA whenever possible.

If individual services require that personal data be transferred to or accessed by a company outside the EU/EEA, this shall only occur when there is a valid legal basis for the transfer under Chapter V of the GDPR, for example:

• the European Commission’s decision on an adequate level of protection,
• the EU Standard Contractual Clauses (SCCs), or
• the EU-U.S. Data Privacy Framework, where applicable.

You may request further information from us regarding the legal bases for data transfers used by our various subcontractors.

10. How Long We Retain Personal Data

We do not retain personal data longer than necessary for the purpose for which it was collected, unless we are legally required to retain it for a longer period.

We store:

• Account information is stored while your account exists. Deactivating or deleting a workspace in the app does not erase it; we delete it when you ask us to (privacy@vexter.io).
• Sent, failed or cancelled send-queue entries are deleted within 31 days.
• Send logs are deleted within 91 days, and mailbox access logs within 31 days.
• Mailbox push-notification logs (without message content) are deleted within 31 days.
• Conversation content (campaign replies and their AI-generated analyses), conversation memory and the campaign performance records used for team learning are kept in the customer's workspace and are deleted when you ask us to (privacy@vexter.io).
• Stored access tokens for a connected Google account are deleted when you disconnect the account in Vexter.
• Email addresses that have hard-bounced, generated a spam complaint, soft-bounced repeatedly or unsubscribed are kept on a suppression list for as long as needed to honour the block. Hard bounces, spam complaints and repeated soft bounces are blocked for all Vexter customers, as described in section 8.
• Data obtained from public sources is updated or removed from our company database when it changes or is removed at the source.

11. Security

We protect information through role-based access controls, encryption during transmission and storage, and storage of Vexter's own databases and files within the EU/EEA. We implement technical and organizational measures to prevent unauthorized access.

These measures include, among other things:

• role-based access,
• encryption during transmission and storage,
• storage of Vexter's own databases and files within the EU/EEA,
• logging and monitoring of technical incidents,
• procedures for handling security incidents,
• restriction of access to personal data based on a need-to-know basis.

Vexter also employs technical and organizational measures to ensure that personal data is processed only for authorized purposes and by individuals or vendors who need access.

Vexter staff do not read the content of customers' emails unless the customer has explicitly consented to it in a support case, it is necessary to investigate a security incident or abuse, or it is required by law.

12. Your Rights

When we act as the data controller, you, as a data subject, have rights under data protection regulations. This includes, provided the conditions are met:

• the right to access the personal data we process about you,
• the right to have inaccurate or incomplete information corrected,
• the right to erasure,
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on legitimate interests, and
• the right to withdraw consent if the processing is based on consent.

Your personal data is not subject to automated individual decision-making pursuant to GDPR Article 22.

If your data is used for direct marketing, you may object to such processing at any time, cf. GDPR Article 21(2) and (3). If you do so, we will no longer process your personal data for such purposes.

If you wish to exercise your rights, please contact us at privacy@vexter.io. We handle all requests regarding access, erasure, and other data protection rights without undue delay and no later than 30 days. Contact us at privacy@vexter.io to exercise your rights.

13. Complaint to the Data Protection Authority

If you believe that Vexter is processing personal data in violation of privacy regulations, we encourage you to contact us first, and we will do our best to answer your questions or correct any errors.

You also have the right to file a complaint with the Norwegian Data Protection Authority if you believe that we are processing your personal data in violation of data protection laws.

The Norwegian Data Protection Authority can be contacted at www.datatilsynet.no.

14. Changes to the Privacy Policy

We may update this Privacy Policy from time to time, for example, if we change our services, processing activities, vendors, or procedures.

The current version will be available on Vexter's website at all times. In the event of significant changes, we may also notify users or customers by other means.