The short version
- We do not sell your personal information, and we do not use it to advertise to anyone.
- Google Sign-In gives us only your name, email address, and profile picture, and we use them only to sign you in.
- Data from Meta, payment processors, and CRMs you connect is used only to show reporting to your own workspace.
- You can disconnect any integration at any time, and you can ask us to delete your data (how).
1. Who we are
VortexOS (“VortexOS,” “we,” “us,” or “our”) operates the website at vortexos.io and the VortexOS web application (together, the “Service”). VortexOS is a business-analytics platform for sales teams and agencies: it brings payment, CRM, and advertising data into one dashboard so a business can see revenue, pipeline, ad performance, attribution, and team commissions in one place.
This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to visitors of our website, to people who sign in to the Service, and to people who respond to our advertising.
When a business uses VortexOS, it connects its own accounts and controls the data inside its workspace, which may include personal information about that business’s own customers and leads. For that data, the business is responsible for its own privacy practices and VortexOS processes the data on the business’s behalf to provide the Service. If you are a customer of a business that uses VortexOS, please contact that business with privacy questions; we will help them respond.
2. Information we collect
Information you give us
- Account information: your name, email address, and password (passwords are stored only as a secure hash by our authentication provider), plus the details you submit when you request access.
- Workspace content: information you enter into the Service, such as deals, commission plans, team members, client profiles, goals, notes, and settings.
- Invitations: the name and email address of team members or clients you invite.
- Integration credentials: API keys, access tokens, or sheet links you provide so that VortexOS can read data from services you connect, and API keys you create to let your own tools or AI agents read your workspace.
- Communications: messages you send us, such as support requests, and the information you submit when you book a demo or respond to our ads.
Information from Google Sign-In
If you choose “Continue with Google,” Google shares your name, email address, profile picture, and Google account identifier with us. We never receive your Google password. See Section 4.
Information from services you connect
When you or your workspace connects a third-party service, we retrieve data from that service using the credentials you provide. Depending on what you connect, this can include:
- Payment processors (Stripe, Whop, Commas): transactions, charges, refunds, subscriptions, products, payment amounts and dates, and the customer name and email address attached to each payment.
- CRMs (Pipedrive, Close, GoHighLevel): deals, pipelines and stages, deal values, owners, activities, and the contact details stored on deals and leads.
- Meta (Facebook and Instagram) Ads: ad accounts, campaigns, ad sets, ads, and performance metrics such as spend, impressions, clicks, and conversions, plus metadata about Instagram business-account posts. See Section 5.
- Google Sheets: the contents of a spreadsheet you link for ad-spend reporting.
- Bank accounts through Plaid: read-only transaction data from a bank account you choose to connect. See Bank accounts connected through Plaid below.
Bank accounts connected through Plaid
You can connect a bank account through Plaid so that payments landing in it (such as Zelle, Cash App, Venmo, and wire transfers) count as cash collected in your reports.
- Your bank login stays with Plaid. You enter your bank username and password in Plaid’s own window. They never reach VortexOS.
- What we receive, read-only: the bank’s name; each connected account’s name, type, and last four digits; and transaction records (date, amount, description, the payer or merchant name where the bank shows one, and the category Plaid assigns). VortexOS cannot move money or make payments from your account.
- How we use it: only to count deposits as cash collected in your workspace’s reports, including recognizing payouts from payment processors you already connect so they are not counted twice.
- The access token: Plaid gives us an access token for the connection. It is stored encrypted and can be read only by our server functions.
- Disconnecting: when you disconnect the bank in Settings → Connections, VortexOS immediately deletes that bank’s transactions (and the deposits counted from them) and its access token, and asks Plaid to end the connection.
- Plaid’s own handling of your information is described in the Plaid End User Privacy Policy.
Tracking links and attribution
Businesses using VortexOS can create tracking links. When someone clicks one, we record the click, the campaign parameters in the link (such as utm_source), and a salted one-way hash of the visitor’s IP address — the raw IP address is not stored. We also set a first-party cookie, vx_click_id, for up to 90 days so that a later lead or sale can be attributed to that click.
Usage and device information
Like most websites, our hosting providers automatically log technical information when you use the Service, such as IP address, browser and device type, pages requested, timestamps, and error details. The app also keeps your sign-in session and display preferences in your browser’s local storage.
3. How we use information
We use information to:
- Provide the Service — sign you in, sync your connected accounts, and build your dashboards, reports, attribution, forecasts, and commission calculations.
- Send the emails the Service relies on, such as invitations, access-request updates, sync and data-quality alerts, and scheduled reports you have set up.
- Answer questions you ask the Service’s AI features (see Section 6).
- Keep the Service secure and reliable — prevent fraud and abuse, keep each workspace’s data separate, and diagnose errors.
- Respond to support requests and to people who contact us through our ads or website.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell personal information. We do not use data from your connected accounts or your workspace to advertise to you or to anyone else, and we do not use it to build profiles for any purpose other than providing the Service to your workspace.
Where the GDPR or a similar law applies, our legal bases are: performance of our contract with you (providing the Service), our legitimate interests (security, support, and improving the Service), your consent (for example, connecting an optional integration), and compliance with legal obligations.
4. Google user data
VortexOS uses Google Sign-In so you can log in with your Google account. We request only the standard openid, email, and profile scopes.
- What we access: your name, email address, profile picture, and Google account identifier.
- How we use it: to create and identify your VortexOS account, to sign you in, and to show your name and picture inside the app. Your email address also lets us match you to an approved access request or workspace invitation.
- How we store it: in our authentication and database provider’s systems, protected by encryption in transit and at rest and by access controls.
- How we share it: we do not sell Google user data, and we do not transfer it to third parties except to service providers that host the Service on our behalf, when you direct us to, or when required by law.
- What we never do: we do not use Google user data for advertising, we do not use it to train artificial-intelligence or machine-learning models, and our staff do not read it except with your permission, to investigate security issues or abuse, or to comply with law.
VortexOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove VortexOS’s access to your Google account at any time at myaccount.google.com/permissions, and you can ask us to delete the Google data we hold as described in Section 10.
5. Meta (Facebook & Instagram) data
When you connect Meta Ads to VortexOS
A workspace can connect its Meta ad account by providing an access token with the ads_read permission. VortexOS uses it to read the ad account’s campaigns, ad sets, ads, and performance insights (such as spend, impressions, clicks, and conversions), and metadata about the connected Instagram business account’s posts (captions, media type, links, and timestamps).
- We use this data only to show advertising performance, return on ad spend, and attribution to the workspace that connected it.
- We do not sell it, we do not use it to advertise, we do not combine it with other workspaces’ data, and we do not share it with other customers.
- Disconnecting Facebook Ads in the app (Settings → Connections) immediately deletes the stored access token and stops all syncing.
Meta Conversions API (optional, off by default)
A workspace owner can choose to turn on sending closed-deal conversions back to their own Meta ad account so Meta can measure their ads. When enabled, the email address and phone number of the converted customer are normalized and hashed with SHA-256 before they leave our systems, as Meta requires; raw values are not sent or logged. This feature is off unless the workspace owner turns it on, and it only sends data to the workspace’s own ad account.
When you see or respond to our ads
We advertise VortexOS on Meta platforms, including Facebook and Instagram. If you respond to one of our ads — for example, by submitting a lead form or booking a demo — we receive the information you submit (such as your name, email address, phone number, company, and answers to form questions) and use it only to contact you about VortexOS. We may use Meta’s measurement tools, such as the Meta Pixel or the Conversions API, to understand how our ads perform. You can control how Meta uses your information for ads at facebook.com/adpreferences.
To have your Meta-related data deleted, follow the data deletion instructions.
6. AI features
VortexOS includes an AI assistant that answers questions about your workspace. When you use it, your question and the workspace data needed to answer it are sent to our AI provider, Anthropic, which processes it on our behalf to generate a response. Under its commercial API terms, our AI provider does not use this data to train its models. AI answers are generated automatically and can be wrong; please verify important numbers.
9. Data retention
- We keep account and workspace data for as long as your account is active.
- Data synced from connected services is kept so your historical reports stay accurate, until the workspace asks us to delete it or closes its account.
- Disconnecting an integration deletes its stored credentials immediately. Disconnecting a bank connected through Plaid also deletes that bank’s transactions immediately.
- When an account is deleted, we delete or anonymize its personal information within 30 days, except where we must keep it to comply with law, resolve disputes, or enforce agreements. Residual copies in backups are overwritten on our providers’ normal backup cycle.
10. Data deletion instructions
You can ask us to delete your data at any time, including data we received from Google or Meta.
To stop us collecting data from Meta or another service
- Sign in to VortexOS, open Settings → Connections, and click Disconnect on Facebook Ads (or any other integration). This deletes the stored access token immediately and stops syncing.
- You can also remove VortexOS from your Facebook account under Settings & privacy → Settings → Business integrations, if it appears there, and revoke Google access at myaccount.google.com/permissions.
To delete your account and the data we hold
- Email support@vortexos.io from the email address on your account with the subject “Delete my data.” Tell us whether you want all data deleted or only data from a specific service (for example, Meta).
- We will confirm your request, delete the data within 30 days, and email you when it is done.
11. Security
We protect information with encryption in transit (TLS) and at rest, database-level access policies that keep each workspace’s data separate, server-side storage of integration credentials, and access limited to the people and systems that need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we learn of a breach that affects your personal information, we will notify you as required by law.
12. Your privacy rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy of it;
- correct inaccurate information;
- delete your information;
- object to or restrict certain processing, and withdraw consent where processing is based on consent;
- receive your information in a portable format; and
- not be discriminated against for exercising these rights.
To exercise any of these rights, email support@vortexos.io. We will verify your request (usually by confirming it comes from the email address on your account) and respond within 30 days, or within the time required by applicable law. You may use an authorized agent where the law allows. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.
California residents: we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. We treat Global Privacy Control signals as a request to opt out of sale and sharing where required.
13. International transfers
VortexOS and its service providers may process information in the United States and other countries whose data-protection laws may differ from those where you live. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for these transfers.
14. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
15. Changes to this policy
We may update this Privacy Policy from time to time. We will change the “Last updated” date above, and if a change is material we will notify you by email or in the app before it takes effect.
16. Contact us
Questions or requests about this policy or your information:
VortexOS
Email: support@vortexos.io
Website: vortexos.io