Privacy Policy

IEXA is the data controller for the data described here. Contact: orwen.ai@gmail.com. Full operator details are on the Legal notice page.

• Account: your name, email address and a securely hashed password. If you sign in with Google instead: your name, email address and profile picture from Google.
• Your assistant: the name, personality, voice, look and tools you chose.
• Tasks and reminder settings you add.
• Connected tools, only if you connect them: Google Calendar events for the day (titles, times, attendees count, meeting links); Shopify order totals and counts; Stripe payment totals and failed charges. We do not store your customers' personal details.
• Build my business answers, if you fill them in: your business stage, what you sell, your 90-day goal, budget range, available time, strengths and how hands-on you want to be.
• Hardware reservations, launch alerts and early-access sign-ups: your email, the product or feature and any engraving text.
• Technical data: sign-in sessions, your time zone, basic server logs (IP address, browser) and short-lived request counters tied to your IP address, all kept for security and to stop spam.
• Visit statistics: which pages are viewed, counted by Vercel Web Analytics without cookies and without identifying you.

• To run your account and your assistant (contract).
• To build your briefs, reminders and alerts from the tools you connect (contract, and your consent when you connect each tool).
• To keep IEXA secure and prevent abuse (legitimate interest).
• To email you about your reservations and important account changes (contract and legitimate interest).
• To meet tax and legal duties once payments start (legal obligation).
• To see which of our ads bring visitors, only if you click Allow on our cookie banner (consent).

We never sell your data, never use your account or connected-tool data for advertising, and never use it to train AI models.

IEXA's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We only read your calendar to show your day and send reminders, and you can disconnect it any time.

• Vercel: hosts the website and counts visits without cookies (Web Analytics).
• Supabase: our database, hosted in the EU (Ireland).
• Google: Calendar connection, only if you connect it.
• Shopify and Stripe: only if you connect them; we read data from your own accounts.
• Meta: only if you allow advertising cookies; measures which of our ads brought you.

When we switch on the chat brain and real voices, we'll add the AI providers here (for example Anthropic and ElevenLabs) before any of your data is sent to them.

Some providers are based in the United States. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Connection tokens and keys are encrypted (AES-256). Passwords are hashed. Connections are read-only. Access to production systems is limited to the people who run IEXA.

We keep your data while your account exists. When you delete your account, we delete your data and revoke connected tools straight away; backups expire within 30 days. Reservation emails are kept until the product ships or you ask us to remove them. Invoices, once payments start, are kept as long as tax law requires.

You can access, correct, download, restrict or delete your data, object to processing, and withdraw consent at any time. Download and delete are built into Settings; for anything else email us.

You can also complain to the Croatian data protection authority (AZOP, azop.hr) or the authority where you live.

IEXA is an AI assistant, and it will always say so. Its voices are AI-generated. Briefs and alerts are produced automatically from your data; they don't make legal or financial decisions about you.

If we change this policy in a way that matters, we'll email you before it applies.