Privacy Notice

Vexa Studio is operated by Direct Media Group Limited, 86-90 Paul Street, London, England, EC2A 4NE. We are the controller of the personal data described here, except for the contacts your own Social Studio automations collect, which you control.

We collect account details such as email address, display name, authentication information, billing identifiers supplied by payment providers, and support communications. We also process prompts, uploads, generated media, project data, settings, and usage records needed to provide the service.

For signup, login, and generation events, we record the request IP address encrypted at rest, a country code only when supplied by a trusted proxy or CDN, user-agent data, event time, and limited operational metadata. We do not infer location from an IP address. Administrative views mask IP addresses.

We use data to operate and secure accounts, process generations and payments, prevent fraud and abuse, provide support, enforce policies, maintain records, improve reliability, and comply with legal obligations. We do not sell personal information.

We use providers for AI generation, payment processing, cloud/storage infrastructure, authentication, and monitoring. They process data only as needed to provide their services and under their applicable agreements and policies.

When you connect an Instagram, Facebook or WhatsApp account, Meta gives us an access token for the permissions you approve. We store it encrypted and use it only to do what you set up in Social Studio. We keep the account’s ID, username, name and profile picture.

Your followers, posts, likes, comments, views, reach and other numbers shown on the Dashboard and in Analytics are read from Meta when you open those pages and kept for up to 10 minutes; we don’t store them.

When your automations run, we process data about the people who comment on your posts or message your account: their Meta-assigned ID, username or name as Meta provides it, the text of their comment or message (to match your keywords), whether they follow you (when an automation checks), and an email address or phone number only if they send one in reply. These people are saved as contacts in your account, with the tags your automations add and whether they replied STOP. You can see, export and delete them in Social Studio → Automations → Contacts. For these contacts you decide what is collected and why, so you are responsible for having a lawful basis and giving any notice your audience needs.

If you use AI replies or AI comment filtering, the comment or message text and the instructions you wrote are sent to our AI provider to produce the reply or check. A log of what each automation did (sent, skipped, failed) is kept for 90 days; finished automation runs are deleted after 90 days.

We don’t sell this data, use it for advertising, or use it to train our own models. We use it in line with Meta’s Platform Terms.

Deleting it: disconnect the account in Social Studio, which deletes its token, automations, contacts and logs. You can also remove Vexa Studio from your Instagram or Facebook settings (Apps and websites, or your business portfolio’s integrations): Meta then sends us a deletion request and we delete that account’s data and give you a confirmation code. You can also ask us through the Contact page.

We share data when you direct us to publish content, when needed to operate the service, when required by law, or to protect rights, safety, and security. Content you publish to an Explore or public project page may be visible to others; do not publish confidential or personal information.

We keep account, content and project data while your account is open, and delete or anonymise it after the account is closed, except records we must keep for legal, tax, accounting, fraud-prevention or dispute reasons, which we keep only as long as those reasons last. Social Studio activity logs are deleted after 90 days.

You can access profile settings and request an authenticated data export at /api/me/export. Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of data. Account deletion is handled through a reviewed support process because billing, fraud, and legal-retention obligations may apply. If you are in the UK you can complain to the Information Commissioner’s Office (ico.org.uk); elsewhere, to your local data-protection authority.

Use the Contact page for privacy requests. We may update this notice as the service changes; the current version will be posted here with its update date.