Privacy Policy

01Who we are

Vexsite (“Vexsite”, “we”, “us”) is a digital marketing agency based in Riyadh, Kingdom of Saudi Arabia. We plan and manage paid advertising for online businesses, and we operate the Vexsite ads dashboard (the “App”), a reporting tool our clients use to see the results of their campaigns.

For information we collect through our website and to run our own business, Vexsite is the controller. For advertising and store data we process inside the App on behalf of a client, the client is the controller and Vexsite acts as a processor, following the client's instructions and our agreement with them.

02The short version

03What we collect

When you visit vexsite.com

• Messages you send us. If you use the contact form, it opens your own email app; we receive whatever you choose to send, typically your name, email address, store or company name, budget range and message.
• Technical data. Our hosting provider records standard server logs: IP address, browser type, pages requested, referring page and time of request. These are used for security and to keep the site running.

This website does not use advertising or analytics cookies.

When you become a client

• Contact and business details: names, job titles, work email addresses, phone numbers, company and store names, billing details and the contents of our correspondence.
• Account access: the partner or user access you grant us inside advertising platforms (we never ask for your personal passwords to those platforms).
• Brand materials: logos, product images, copy and other content you give us to create ads.

When you use the Vexsite ads dashboard

• Access data: a hashed version of your viewer or admin passcode, session identifiers, login times, and the IP address used for each login attempt (used to limit repeated failed attempts).
• Activity log: a record of administrative actions such as passcode changes, connector key updates, exports and uploads, with the time and the account that made them.
• Campaign performance data from connected advertising and analytics platforms (described in the next section).
• Store sales data you upload, such as a Salla campaign workbook. From it we read daily store revenue and order counts only. Advertising spend in that file is ignored. Nothing is saved until you review the preview and confirm.
• Report entries you type into the daily store report, and store logos you upload. Uploaded images are converted to PNG and stripped of embedded metadata (such as location or camera details).
• Preferences such as language (English or Arabic) and display theme, stored in your browser.

04Advertising platform data

With a client's authorisation, the App connects to the following services to retrieve campaign reporting data for the client's own ad accounts and properties:

This data is aggregated reporting data. The App does not request or store the names, contact details, user IDs or browsing histories of the people who saw or clicked your ads.

We use platform data only to show reports to the client who owns the account, to produce exports for that client, and to manage that client's campaigns. We do not sell it, transfer it to data brokers, use it for our own advertising, or combine it across clients.

Google user data

Vexsite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta platform data

We process data received from Meta in line with the Meta Platform Terms and Developer Policies. You can remove the App's access at any time in your Meta Business settings, and request deletion of related data as described in Data deletion.

05How we use information

• To provide our marketing services: planning, launching, monitoring and optimising campaigns.
• To run the App: showing dashboards, calculating metrics such as real ROAS and cost per order, and creating Excel and HTML exports, including scheduled monthly workbooks.
• To keep accounts secure: authenticating users, limiting login attempts, detecting misuse and keeping an activity log.
• To communicate with you: replying to enquiries, sending reports and service notices, and billing.
• To meet legal, tax and accounting obligations, and to establish or defend legal claims.

We do not use automated decision-making that has legal or similarly significant effects on you.

06Legal bases

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, and, where they apply, the EU and UK GDPR. Depending on the activity, we rely on:

• Contract — to provide the services and App access you've signed up for.
• Consent — where you've given it, for example when you choose to contact us. You can withdraw consent at any time.
• Legitimate interests — to secure our systems, improve our services and run our business, where those interests are not overridden by your rights.
• Legal obligation — to keep records required by law.

07Who we share it with

We share information only as needed to provide our services, and only with:

• Service providers who host or process data for us under contract, such as our cloud/VPS hosting provider, email provider and Windsor.ai (data connector). They may use the data only to provide their service to us.
• Advertising platforms you ask us to work in (for example, when we create campaigns or audiences in your ad accounts). Their use of data is governed by their own policies.
• Professional advisers such as accountants and lawyers, under duties of confidentiality.
• Authorities, where required by law or to protect rights, property or safety.
• A successor business, if Vexsite is involved in a merger or acquisition, subject to this policy.

We do not sell or rent personal data.

08Cookies & local storage

Website: vexsite.com does not set advertising or analytics cookies.

App: the Vexsite ads dashboard uses only what it needs to work:

• a session token to keep you signed in — viewer sessions last up to 14 days and admin sessions up to 12 hours;
• browser local storage for your language and theme preferences.

These are strictly necessary, so they don't require consent. Clearing your browser data removes them and signs you out.

09How long we keep it

10Security

We use technical and organisational measures appropriate to the data we handle, including:

• encrypted connections (HTTPS) between your browser and the App;
• platform access tokens and API keys stored only on our server, never sent to the browser, and shown masked in the admin console;
• separate viewer and admin roles, hashed passcodes and limits on repeated login attempts;
• an activity log of administrative actions;
• access to client data restricted to the Vexsite staff working on that account.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authority as required by law.

11Your rights

Depending on where you live, you may have the right to:

• be informed about how your data is processed;
• access a copy of your personal data;
• ask us to correct incomplete or inaccurate data;
• ask us to delete your data when it's no longer needed;
• object to or restrict certain processing, and withdraw consent;
• receive your data in a portable format;
• complain to a data protection authority — in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

To exercise any of these rights, email privacy@vexsite.com. We may need to verify your identity, and we will reply within 30 days. If your data was provided to us by one of our clients, we may refer your request to them as the controller.

12Data deletion

You can ask us to delete the data we hold about you or your business, including data received from Meta, Google, Snapchat, TikTok or other connected platforms.

How to request deletion

• Email privacy@vexsite.com with the subject “Data deletion request”.
• Tell us your name, your company or store name, and the ad accounts or properties concerned.
• We will confirm receipt within 3 working days and complete the deletion within 30 days, then confirm by email.

Removing platform access yourself

• Meta: Business Settings → Users / Partners or Integrations → remove Vexsite. You can also remove apps in your Facebook account under Settings & privacy → Apps and websites.
• Google: remove Vexsite's access in Google Ads (Admin → Access and security) and Google Analytics (Admin → Property access management), or at myaccount.google.com/permissions.
• Snapchat and TikTok: remove Vexsite as a member or partner in Snapchat Business Manager or TikTok Business Center.

Removing access stops new data being collected. To delete data already stored in the App, please also send us a deletion request. We may keep records we are legally required to retain, such as invoices.

13International transfers

Some of our service providers and the advertising platforms themselves operate outside Saudi Arabia. Where personal data is transferred abroad, we do so in accordance with the PDPL and its transfer regulations, using appropriate safeguards such as contractual commitments, and only to the extent needed to provide our services.

14Children

Our website, services and App are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15Changes to this policy

We may update this policy when our services or the law change. We'll post the new version on this page with a new “Last updated” date, and notify clients by email of any significant changes before they take effect.

16Contact us

Questions about this policy or your data:

Vexsite
Riyadh, Kingdom of Saudi Arabia
Privacy: privacy@vexsite.com
General: hello@vexsite.com

See also our Terms of Service.