Privacy policy
What Vextory collects, why, and what you can do about it.
Last updated: September 27, 2026 Version 1.0 Download as PDF
Vextory is stock and purchasing software for small businesses. This policy explains what personal information we collect, why we collect it, who else sees it, how long we keep it, and the rights you have over it.
It is written to be read. Where the product is imperfect today, this policy says so rather than describing an ideal version of it.
Who we are
Vextory is a product of VEXRISE LTD, a company registered in England and Wales under number 17334675, with its registered office at 65 London Wall, London EC2M 5TU, United Kingdom.
For the personal information described in this policy, VEXRISE LTD is the data controller. The Information Commissioner's Office (ICO) is our supervisory authority.
People in the European Union can write to us at the address in the Contact section with any question about their data or to exercise their rights.
You can reach us about anything on this page at contact@vextory.com.
We act in two different roles
This distinction matters, because it decides who you should ask.
We are the controller of your account. Your email address, your name, your workspace, your sign-in history, your subscription: we decide why and how those are processed, and this policy governs them.
We are a processor for the business records you enter. When you add a customer, a supplier or a contact to Vextory, you are entering personal information about someone else. You decide what to record and why. We hold and process it only so the software works for you, following your instructions.
If you are one of those people (a customer, supplier or contact of a business that uses Vextory), we are not the right people to ask. Your information belongs to the business that entered it, so contact them directly. If you cannot identify them, write to us and we will pass your request on.
Businesses using Vextory in the UK or the EU need a written processor agreement with us under Article 28 GDPR. Ours forms part of our terms of service.
When we collect personal information
- When you visit vextory.com. We serve the site through a content delivery network, which processes connection data to deliver and protect the pages.
- When you create your account.
- When you set up your workspace and tell us about your business.
- When you use the app: the records you enter, and the technical data your use generates.
- When you subscribe through Google Play.
- When you contact us for support.
- When you close your account, including the optional reason you give us.
What we collect
Information you give us
- Account: email address, password (stored only as a cryptographic hash), first and last name, phone number.
- Workspace: company or individual name, country, currency, business identifier, preferred language.
- Business content: the products, stock levels, movements, orders, suppliers, customers and contacts, the documents and photos you attach, and anything else you choose to record in the app.
- Correspondence: what you write to us, and the optional reason you give when closing an account.
Information created when you use Vextory
- Sign-in and session records: the time you signed in and out, your IP address, the country and approximate city derived from that IP address, your device name and type, operating system, app version and platform. We keep one row per sign-in.
- Technical logs: error and diagnostic logs carrying your user and workspace identifiers.
- Push notifications: a device notification token linked to your user identifier, so a notification reaches the right person.
- Subscription: your plan, order identifier, amount, currency and renewal dates, plus a one-way hash of the Google Play purchase token.
Information from other services
If you sign in with Google, we receive your email address, name and profile identifier from Google, and we store the access and refresh tokens that keep the connection alive.
What we do not collect
- No GPS location. Vextory never asks for location permission and cannot read your device's position. The country in your sign-in history is derived from your IP address: a rough, network-level estimate, not a location fix.
- No advertising. There is no advertising SDK in the app, no advertising identifier, and no ad network receives anything.
- No analytics or tracking SDK. We do not use Firebase Analytics, Amplitude, Mixpanel, Segment or any equivalent.
- No card details. Subscriptions are charged by Google Play. Your payment method never reaches us.
How we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and running the service | Performance of a contract (Art. 6(1)(b)) |
| Managing your subscription, trial and renewals | Performance of a contract (Art. 6(1)(b)) |
| Sending service emails: verification codes, password resets, account notices | Performance of a contract (Art. 6(1)(b)) |
| Keeping sign-in records, detecting abuse, investigating faults | Our legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Answering your support requests | Performance of a contract, and our legitimate interest in supporting you (Art. 6(1)(b) and (f)) |
| Push notifications, voice input, contact picking | Your consent, given through the device permission (Art. 6(1)(a)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Establishing or defending legal claims | Our legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and concluded the processing is what you would reasonably expect from business software. You can object at any time, as explained under Your rights.
Where we rely on consent, you can withdraw it at any time by turning the permission off. Withdrawing consent does not affect processing that already happened.
There is no automated decision-making and no profiling in Vextory. Nothing about your account is decided by an algorithm alone.
How we may share it
We do not sell personal information, we do not share it for advertising, and we do not build profiles for anyone else.
We do use a small number of service providers to run Vextory. Each is bound by a written contract, processes data only on our instructions, and receives only what its job requires. They fall into these categories:
| Category | What they receive |
|---|---|
| Hosting and infrastructure | All service data, at rest and in transit |
| Email delivery | Your email address and the content of service emails |
| Push notification delivery | Your notification token, user identifier, device model and language |
| Error monitoring | Error details, including user and workspace identifiers |
| Internal operational alerting | Workspace identifier and country only. Never names, emails or phone numbers |
| IP geolocation | Your IP address, to return a country code. We keep only the country |
| Content delivery and security | Connection metadata for the website |
| App store and payment processing | Purchase and subscription data, handled by Google Play |
A full, named list of our service providers is available on request. Write to contact@vextory.com and we will send it, along with the safeguards that apply to each.
Three of them are worth naming here, because they are visible to you rather than behind the scenes: Google Play takes your subscription payment and issues the receipt; Google Sign-In identifies you if you choose that route; and Google's speech recognition service converts your voice to text when you dictate into a field. In practice, this means the recorded audio leaves your device and reaches Google.
We also disclose information where the law requires it (to a court, a regulator or law enforcement acting under a valid request), and to our professional advisers where necessary. If the business is ever sold or reorganised, data may transfer with it, and you would be told before that happened.
Where your information is stored, and transfers abroad
Your account and your business records are stored on servers in the Netherlands, inside the European Union.
Some of the providers above are in the United States. Those transfers are covered by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with the additional safeguards each provider applies. Transfers between the UK and the EU are covered by the European Commission's adequacy decision for the United Kingdom.
You can ask us for a copy of the safeguards that apply to any specific transfer.
How long we keep it
| Data | Retention |
|---|---|
| Account and business records | For as long as your workspace is open |
| Sign-in records, including IP address and derived country | 365 days, then deleted automatically each day |
| Technical and error logs | 30 days |
| Subscription and accounting records | 6 years from the end of the financial year they relate to, as UK tax law requires |
| Support correspondence | 3 years from our last exchange |
| Closed accounts | See below |
What happens when you close your account. You delete your account yourself, directly in the app: open Settings, tap Delete account and follow the steps. This option stays available whether or not you have an active subscription. Your account and workspace are then deactivated at once: you are signed out, the account can no longer be used to sign in, and the data stops being reachable through the app. We keep the underlying records for a short period afterwards so an account closed in error can be restored, and so we can meet the accounting obligations above.
We are being precise on purpose: deactivation is immediate and automatic, but final erasure of the underlying records is carried out by us on request, not by an automatic job. If you want erasure rather than deactivation alone, say so at contact@vextory.com and we will complete it, and confirm in writing, within one month.
Two more things worth knowing before you close your account. Your workspace goes with it: deleting your account also deletes your workspace and everything in it. And your subscription is separate: deleting your account does not cancel a subscription bought through Google Play. A step-by-step guide walks you through each step.
Security
What we actually do, stated without embellishment:
- All traffic between the app and our servers runs over TLS.
- Passwords are stored as salted cryptographic hashes. We cannot read them, and we will never ask you for one.
- Each workspace is isolated at the database level, so one business cannot query another's records.
- Access is controlled by signed, expiring session tokens, and you can see and end your active sessions.
- Sign-in records are kept so unusual activity can be investigated.
- Staff access to production data is limited to what running and supporting the service requires.
No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
Your rights and how to exercise them
Under the UK GDPR and the EU GDPR you have the right to:
- Access: get a copy of the personal information we hold about you.
- Rectification: have inaccurate information corrected. Most of it you can edit yourself in the app.
- Erasure: have your information deleted, where we have no overriding obligation to keep it. You can also delete your account yourself in the app, from Settings.
- Restriction: have us pause processing while a dispute is resolved.
- Portability: receive the information you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.
- Object: object to processing based on our legitimate interests.
- Withdraw consent: withdraw it at any time, for anything based on consent.
How to exercise them. Write to contact@vextory.com from the address on your account. We answer within one month. If a request is unusually complex we may extend that by two months, and we will tell you why within the first month. It is free, unless a request is manifestly unfounded or excessive.
On portability specifically: Vextory does not yet offer self-service export in the app. For now, export is available on request, whether or not you have an active subscription: write to contact@vextory.com from the address on your account, and we will send you your business data as structured files within the same one-month deadline. We plan to offer export directly in the app soon. Until then, we would rather tell you so plainly than advertise a feature that is not there yet.
Cookies and tracking technologies
On vextory.com, we set one cookie: vx_lang, which remembers the language you chose so we do not send you to the wrong one next time. It is strictly necessary for that feature, it holds no identifier, and it is why you are not being asked to dismiss a cookie banner. We run no analytics, no tag manager and no tracking pixels on the website.
In the app, there are no cookies, no advertising identifier and no tracking SDK.
Because we set no non-essential cookies, there is nothing here to opt out of. If that ever changes, we will ask for your consent first.
Device permissions in the app
Android asks before granting each of these, and you can withdraw any of them at any time in your device settings. Refusing one disables the related feature and nothing else.
| Permission | What it is for | What leaves your device |
|---|---|---|
| Camera | Scanning barcodes, and taking photos to attach to a record | Barcode recognition runs entirely on your device. Photos are uploaded only when you attach them. |
| Microphone | Dictating text into a field instead of typing it | The recorded audio is sent to Google's speech recognition service, which converts it to text. We receive only the text. |
| Contacts | Filling in a supplier or customer from a contact you pick | Only the single contact you select. We never read your address book in the background. |
| Photos and files | Attaching and saving documents | Only the files you choose. |
| Notifications | Sending you stock alerts and account messages | A notification token. |
Children's privacy
Vextory is business software. It is not designed for or directed at children, we do not knowingly collect information from anyone under 16, and you must be 18 to take out a subscription. If you believe a child has created an account, write to us and we will remove it.
Notice for residents of the United States
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We have not done so in the past twelve months.
Residents of California and of other US states with comparable laws have the right to know what we collect, to obtain a copy, to ask for deletion and correction, and not to be discriminated against for exercising those rights. Use the same address as everyone else: contact@vextory.com. We will verify your identity against the account before we act.
Links to other services
Vextory and vextory.com contain links to services we do not run: Google Play, our own suppliers' sites, and pages we reference in support articles. Following one of those links takes you outside Vextory, and what happens there is governed by that service's own privacy policy, not this one. We are not responsible for their practices, and we would encourage you to read them.
Changes to this policy
If we change how we handle personal information, we update this page and change the date at the top. Where the change matters to you, we also tell you in the app or by email before it takes effect. Previous versions are available on request.
Contact us and complaints
Write to contact@vextory.com, or to VEXRISE LTD, 65 London Wall, London EC2M 5TU, United Kingdom.