Privacy Policy

SECTION 01

Who This Policy Applies To

This policy applies to individuals who purchase or use a Vexo Band and the Vexo App, visitors to our Site, and developers who build on the Vexo platform. If you are under the age of 16 (or the minimum age of digital consent in your jurisdiction), you may not use the Services, and we do not knowingly collect data from you (see Section 12).

SECTION 02

The Short Version

The essentials at a glance. The rest of this document is the long version.

SECTION 03

The Information We Collect

Voice & Speech Information

The Band includes a microphone that is always listening while the Band is powered on. While you wear it, it hears the conversations around you, including what other people say, not only your own speech. Powering the Band off stops it listening. You can delete any conversation in the App, or ask us to delete your whole account (see Section 9).

How your voice is handled. Please read this carefully:

• Audio from the Band reaches your phone over Bluetooth. Features such as phone voice input may instead use your phone's microphone with microphone permission.
• On-device transcription processes audio locally. Cloud transcription streams audio to the selected speech provider, such as Deepgram or Soniox. Speaker-separation features may also stream audio to pyannoteAI. Availability depends on your app version and settings.
• Cloud speech features process audio outside your phone; their provider processing and retention terms apply. Do not enable a cloud engine if you want transcription audio to remain on-device.
• The resulting text transcript may be stored on your phone, synced to your Vexo account, and provided to our cloud AI service to answer your requests or prepare notes and actions.

Recording others. Because the Band is always listening while it is powered on and hears the people around you, you are responsible for complying with applicable laws when recording. Some jurisdictions require the consent of all parties to a conversation before recording ("two-party" or "all-party" consent). You must obtain any consent required by law before recording other people, and you must not use Vexo to record anyone unlawfully. Power the Band off wherever recording is not allowed.

Profile Information You Provide

When you set up the App, you may provide your name / display name and preferences for how you use Vexo.

Account & Identity Information

To create and secure your account (via our authentication provider), we collect your email address (and one-time verification codes), your phone number if you use SMS sign-in, your Apple account identifier if you use Sign in with Apple, your Google account identifier if you use Google sign-in, and authentication tokens stored securely in your device's Keychain.

We do not receive your Apple or Google password. If you use Sign in with Apple, Apple may provide us a private relay email address rather than your real one, at your choice.

Connected Google Accounts: Gmail, Drive, and Calendar

Connecting a Google account is optional and separate from signing in to Vexo. Google shows the permissions requested before you authorize a connector. We receive OAuth access and refresh tokens, not your Google password. Our Nango connection service stores and refreshes these credentials to provide the features you enable.

• Gmail: read access lets Vexo find and read messages needed for inbox assistance, summaries, and answers. Draft and send access lets the assistant prepare drafts and send messages you ask it to send. Data can include subjects, participants, dates, message content, and draft content, depending on the feature used.
• Gmail onboarding and User Study: after you connect Gmail in this flow, Vexo immediately reads a sample of recent subjects, senders, recipients, dates, and message/thread identifiers to suggest three opening questions and tentative context. This step reads up to 60 distinct threads from the past 90 days and does not fetch message bodies, snippets, or attachments. Relevant metadata is processed by our AI provider. These suggestions can be incomplete or wrong and are not verified facts about you.
• Google Drive: access is limited to files you open or share with Vexo, or files Vexo creates, under the per-file permission. Vexo can read or edit those files for the actions you request; this permission does not grant access to all files in your Drive.
• Google Calendar: read access supports schedule and availability questions; event access supports creating or updating events at your request. Data may include calendar names and event titles, dates, times, descriptions, and participants.

We use Google data to provide these user-facing features, including personalizing your own assistant experience. Relevant Google data and results may pass through our backend, hosting and connection infrastructure, and AI service providers. We do not use Google data for advertising, sell it, or use it to develop, improve, or train generalized AI or machine-learning models. Providers processing it on our behalf must follow these same restrictions.

Vexo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access to Google user data is limited to your affirmative agreement for specific data, necessary security investigation, legal obligations, or permitted internal operations involving aggregated and anonymized data.

Band Device Information

To operate and maintain your Band, we collect its serial number and hardware identifiers, firmware version, battery level, and connection timestamps. The Band itself stores only its own settings; it does not retain a history of your voice data. Your phone is the primary store.

Reminders

If, and only if, you tap to route a note into Apple Reminders, the App requests access to your Reminders and writes the item you selected. We do not read your existing reminders and do not access this data on our servers.

Information We Do Not Collect

For clarity, the current Services do not collect:

• Location data. The App contains no location tracking.
• Phone microphone audio without microphone permission.
• Camera, photos, or contacts.
• Advertising identifiers. The Band and App embed no advertising or crash-reporting SDKs.

The Site

Our marketing and developer-documentation website uses analytics to understand page visits, referral and campaign attribution, clicks, scroll depth, product and checkout interactions, performance, and errors. We also use session replay, which records how pages render and how visitors interact with them. We mask all form inputs in replay, do not record payment pages hosted by Stripe, and mask checkout-session identifiers in captured URLs. The Site uses a first-party cookie and browser storage to maintain an anonymous visitor and session identifier. We do not use Site or App analytics for advertising or combine them with voice data. Standard server logs may also be generated by our hosting provider for security and reliability.

Launch Updates

If you sign up for launch updates on the Site, we collect the email address you enter and use it only to email you about the Vexo Band launch. Our email provider, Resend, delivers your sign-up to our inbox. We count sign-ups in our Site analytics without recording your email address. To unsubscribe or have your address deleted, email info@vexoai.com.

SECTION 04

How Your Data Flows (Band → Phone → Cloud)

Understanding the architecture is the best way to understand your privacy:

• On the Band. The microphone listens while the Band is powered on, as described above. The Band transmits over Bluetooth to your paired phone and stores no history.
• On your phone. The App receives wearable data, displays your information, and handles local processing. When you choose a cloud speech engine, it also streams audio to that provider. Some features may buffer audio on-device while processing.
• In the cloud. Our services store synced account data and process enabled assistant features. Connected Google data passes through our Nango connection service and backend; the data relevant to a request may also be sent to our AI provider. These services are subject to access controls and the use restrictions in this policy.

SECTION 05

How We Use Your Information

We use your information to:

• Provide the core Services: organize your transcripts, memories, notes and reminders; generate summaries and assistant responses using local or cloud processing as applicable; and carry out connected-account actions you request.
• Sync and back up your data to your account so you don't lose it.
• Operate your Band: manage pairing, firmware updates, and battery/connection status.
• Authenticate and secure your account and detect abuse or fraud.
• Communicate with you about your account, security, and material changes, and send launch updates if you sign up for them.
• Improve the Site: understand acquisition, content engagement, checkout conversion, usability, and technical performance using aggregated analytics and privacy-masked session replay.
• Comply with law and enforce our terms.

We do not use your personal information to build advertising profiles, and we do not sell it.

SECTION 06

Legal Bases for Processing (EEA/UK Users)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent (Art. 6(1)(a)): for voice-derived transcripts, launch-update emails you sign up for, and any sharing you initiate. You may withdraw consent at any time (Section 9).
• Contract (Art. 6(1)(b)): to provide the Services you request.
• Legitimate interests (Art. 6(1)(f)): to secure our Services, understand Site usage, improve usability and conversion, diagnose technical issues, and prevent abuse, balanced against your rights.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law.

SECTION 07

Who Can Access Your Information

You choose which external assistants and apps can access your Vexo data. They receive access only after you approve a connection and only within the permissions you grant. You can revoke access. Providers that operate Vexo and limited legal or business disclosures are described separately below.

Providers That Operate Vexo

We use service providers for database, authentication, storage, and backend hosting. Our self-hosted Nango service manages OAuth connections and authenticated requests to connected services. Cloud AI features use Anthropic, directly or through Amazon Bedrock, to process relevant prompts, context, and tool results. Selected speech features use providers such as Deepgram, Soniox, and pyannoteAI as described above. An analytics service provider processes Site and App product analytics and privacy-masked session replay. Resend delivers launch-update sign-ups from the Site to our inbox. Authentication codes may be delivered through our authentication provider's email or SMS services. We share only data needed for the enabled service; we do not use advertising or data-broker services.

Sharing You Initiate: External AI Assistants (MCP)

Vexo lets you connect an external AI assistant (such as Claude or ChatGPT) through our shared MCP server URL and OAuth sign-in. When you approve a connection, the assistant receives read-only access to your transcripts, conversation-derived memories, people, preferences, commitments, saved notes and reminders.

• This happens only when you turn it on. It is off by default.
• The shared server URL is not a credential. The assistant receives access tokens after authorization; it does not receive your Vexo sign-in code or your Apple or Google password.
• You can disconnect an assistant in Vexo settings, which revokes future reads. Disconnecting does not remove copies already returned to that assistant.
• Once your data reaches a third-party assistant, its handling is governed by that provider's privacy policy, not ours. Older personal connection links, where still enabled, remain credentials and can be disabled in the App; keep them private.

Sharing You Initiate: Marketplace Apps

Third-party "mini-apps" may request scoped, revocable access to specific data categories (such as transcripts and saved notes). Access is deny-by-default: an app receives only the scopes you approve, and you can revoke them. These features operate only on your explicit, per-grant consent.

Apple Reminders

We write to Apple Reminders only when you explicitly route a note there.

Legal & Safety

We may disclose information if required by law, subpoena, or legal process, or where we believe in good faith it is necessary to protect the rights, safety, or property of you, us, or others.

Business Transfers

If Vexo is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you and honor the commitments in this policy.

SECTION 08

Data Retention

• Synced transcripts, memories, notes, reminders, profile information, and device data is retained in your account until you delete the specific data, delete your account, or request deletion, so your history stays available across devices.
• Local app data, including any buffered audio, can be removed by clearing the App's data or deleting the App. This does not by itself delete synced account data or data already processed by a cloud provider.
• Google connections and derived results: credentials are retained while a connection is active. Disconnecting removes that connection's stored credentials and stops future Vexo access through it. Stored assistant conversations, notes, or files you chose to create may remain until you delete them or request deletion. Gmail onboarding context is cleared when its Vexo connection is disconnected. In the local User Study, inspected metadata and generated questions are held in memory and cleared by Disconnect & clear or a server restart; only connection ownership records are persisted locally.
• Site and App analytics and session replays are retained according to our configured analytics retention periods and are not joined to voice data.
• Launch-update email addresses are kept until you unsubscribe or ask us to delete them.
• We retain limited records as required to comply with legal obligations, resolve disputes, and enforce agreements.

SECTION 09

Your Rights & Choices

Depending on where you live, you may have rights to access, correct, delete, export/port, restrict, or object to processing, and to withdraw consent. Vexo honors these rights for all users regardless of location, to the extent practicable.

You can exercise many of these directly:

• Access / view: your data is visible in the App.
• Correct: edit your profile in the App.
• Disconnect external AI access: revoke the assistant connection in Vexo settings, or disable an older personal connection link.
• Disconnect Google: use the connector controls in Vexo or remove Vexo's access in your Google Account connections. Revocation stops new access after it takes effect; it does not automatically erase prior assistant results. Contact us to request deletion of retained Google data or derived results.
• Revoke app grants: manage scoped permissions in the App.
• Stop collection: power down or unpair the Band; disable recording and revoke Bluetooth, microphone, speech, or other permissions in your phone's settings.
• Site analytics: enable your browser's Do Not Track setting; our Site is configured to honor it. You may also contact us to exercise applicable rights over Site analytics data.
• Delete your account or export your data: email us and we will process your request, deleting your synced transcripts, memories, notes, reminders, profile information, and device data, or providing a copy on request.

To make a rights request, email info@vexoai.com. We will verify your identity (typically by confirming control of your account email) before acting, and respond within the timeframe required by applicable law (generally 30 to 45 days). You will not be discriminated against for exercising your rights.

California residents (CCPA/CPRA): You have the rights to know, delete, correct, and to limit the use of sensitive personal information. We use sensitive information only to provide the Services and do not use it to infer characteristics for advertising. We do not sell or share your personal information.

EEA/UK residents: You may also lodge a complaint with your local data protection authority. Authorized agents may submit requests on your behalf with proof of authorization.

SECTION 10

Security

We protect your information with technical and organizational measures, including:

• Encryption in transit (TLS/HTTPS) between the App and our backend, and secure Bluetooth between the Band and your phone.
• Per-user access controls (row-level security) so each account's data is isolated and readable only by that account and services it authorizes.
• Secure credential storage: mobile authentication uses platform secure storage; server-side secrets and OAuth credentials are access-controlled.
• Purpose-limited processing: connected-account data is used for the features you enable. Gmail onboarding reads a bounded set of message metadata rather than message bodies or attachments.
• Access logging with redaction of sensitive fields such as tokens and transcript text.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

SECTION 11

International Data Transfers

Some features involve international data transfers. Where required, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses. You can request information about these safeguards using the contact details below.

SECTION 12

Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, email info@vexoai.com and we will delete it.

SECTION 13

Third-Party Services

The Services integrate with Apple, Google (including Gmail, Drive, and Calendar when you connect them), and external assistants or apps you choose. Your direct use of third-party services is subject to their terms and privacy policies. Our handling of Google user data remains subject to the Google Limited Use commitments in this policy.

SECTION 14

Changes to This Policy

We may update this policy from time to time. If we make material changes (for example, to the categories of data we collect or how we share it), we will notify you through the App or by email before the change takes effect, and we will update the "Last updated" date. Your continued use of the Services after an update means you accept the revised policy.

SECTION 15

Contact Us

If you have questions, requests, or complaints about this policy or your data, contact us:

Vexo: email info@vexoai.com