Privacy Policy

Last updated: 7 Oct 2026

Introduction

VCXOS Management and Technologies LLP ("we," "us," or "our") operates the vCXOs Hub platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

Information We Collect

Personal Information You Provide

We collect information that you voluntarily provide when using the Service:

  • Account Information: Name, email address, and profile picture (when signing in with Google OAuth)
  • Organisation information: Company name, GSTIN (optional), industry, team size, and state/location
  • Financial Data: Transactions, income, expenses, and related financial information you enter or sync from your accounting system
  • Compliance Information: Compliance tasks, deadlines, and related documentation
  • Communications: Support tickets, feedback, and correspondence with us

Information Collected Automatically

When you access the Service, we automatically collect certain information:

  • Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns
  • Device Information: Browser type, operating system, device type, and screen resolution
  • Log Data: IP address, access times, and referring URLs
  • Cookies: Session cookies for authentication and preference cookies for user settings

How We Use Your Information

We use the collected information for the following purposes:

  • Provide the Service: Process transactions, calculate KPIs, generate reports, and manage compliance tasks
  • Account Management: Create and manage your account, authenticate users, and process invitations
  • Communications: Send notifications, compliance reminders, weekly digests, and support responses
  • Improvements: Analyse usage patterns, fix bugs, and enhance features based on user behaviour
  • Security: Detect and prevent fraud, unauthorised access, and other security issues
  • Legal Compliance: Comply with applicable laws, regulations, and legal processes

Product usage

To improve the Service, we record how it is used: which screens are opened and for how long, which features are used, and when syncs, digests and scheduled jobs run. Each record names the organisation and the team member it belongs to, so we can see which parts of the Service people rely on and which they do not. These records are kept inside our own infrastructure, are never sold or shared, and never contain your financial figures, the names of your customers or vendors, or anything you type. We do not record your screen, your mouse movements or whether you open our emails. Raw records are kept for 24 months; after that only totals remain.

Data Storage and Security

Where We Store Your Data

Your data is stored on secure servers provided by Supabase (our database provider) and Vercel (our hosting provider). Our primary data centres are located in Mumbai, India (BOM1), ensuring compliance with Indian data localisation requirements where applicable.

Security Measures

We implement industry-standard security measures including:

  • TLS/SSL encryption for all data in transit
  • Encryption at rest for stored data
  • Row Level Security (RLS) ensuring data isolation between organisations
  • Regular security audits and vulnerability assessments
  • Rate limiting and protection against common attacks
  • Automated daily backups with point-in-time recovery

Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Financial and compliance data is retained for a minimum of 8 years to comply with Indian statutory requirements. You may request deletion of your account and personal data at any time, subject to legal retention requirements.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party service providers who assist in operating the Service (Supabase for database, Vercel for hosting, Resend for email delivery, Sentry for error tracking, Razorpay for subscription payments)
  • Within your organisation: With other members of your organisation based on their assigned roles and permissions
  • Legal Requirements: When required by law, subpoena, or other legal process, or to protect our rights, privacy, safety, or property
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections
  • With Your Consent: For any other purpose with your explicit consent

Your Rights and Choices

You have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information, subject to legal retention requirements
  • Export: Export your data in a machine-readable format (CSV/PDF)
  • Opt-out: Unsubscribe from marketing communications and weekly digests
  • Withdraw Consent: Withdraw consent for data processing where consent is the legal basis

To exercise any of these rights, please contact us at privacy@thevcxos.com.

Cookies and Tracking Technologies

We use the following types of cookies:

  • Essential Cookies: Required for authentication and basic functionality of the Service
  • Preference Cookies: Remember your settings such as theme preference (light/dark mode)
  • Usage Session Cookie: A first-party cookie holding a random session number, so product usage can be grouped into visits (see "Product usage"). It expires after 30 minutes without activity and is never shared

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the Service.

Third-Party Services

Our Service integrates with the following third-party services:

Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@thevcxos.com.

International Users

The Service is primarily designed for users in India. If you access the Service from outside India, please be aware that your information may be transferred to, stored, and processed in India where our servers are located and our central database is operated.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or through the Service.

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Grievance Officer

In accordance with the Information Technology Act 2000 and rules made thereunder, the contact details of the Grievance Officer are provided below:

The Grievance Officer shall acknowledge receipt of any complaint within 24 hours and address it within 15 days of receipt.

Back to top