Vexor
Vexor Privacy Policy
Last updated: 25 October 2026
1. Who we are
This Privacy Policy explains how Vexor ("Vexor", "we", "us", "our") collects, uses, stores, shares and protects personal data when you visit vexor.wtf, create or use a Vexor account, use the Vexor dashboard, download or run the Vexor software (the "Software"), join the Vexor Discord server, or otherwise interact with us (together, the "Services").
The controller of your personal data within the meaning of Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") is:
Vexor, Finland, contact: vexorowner@gmail.com.
If you have any question about this Policy or about how your personal data is processed, contact us at the address above.
2. Scope
This Policy applies to all personal data processed by us in connection with the Services. It does not apply to third-party websites, platforms or services (including Discord, Roblox, payment providers and resellers) that may be linked from or used together with the Services. Their own privacy policies govern their processing.
3. Personal data we process
We only collect personal data that is necessary for the purposes described in Section 4. Depending on how you use the Services, we process the following categories:
3.1 Account data
- Username, internal user ID, account creation date.
- Email address and password hash (passwords are never stored in readable form), where you register with them.
- Linked Discord account identifier, username and avatar, where you sign in or link via Discord, and any profile picture you upload.
- Your account recovery question and answer, if you set one.
- Your token balance, token transactions and referral information (who referred you and whom you referred).
3.2 Licence and purchase data
- Licence keys assigned to your account (stored in full on our servers, displayed only partially in the dashboard), licence tier, activation date and expiry date.
- Order records, amounts, dates and payment status, and gift card codes you submit as payment. Card and bank details are processed by our payment provider and are not received or stored by us.
3.3 Device and security data
- A hardware identifier ("HWID") generated from characteristics of the device on which the Software is activated, used to bind a licence to one device.
- Records of HWID resets, including time and date, the previous HWID, the number of resets made and the date the next reset becomes available.
- IP address, approximate location derived from the IP address (country, city) and internet service provider, collected when you log in, use the dashboard, activate the Software or request an HWID reset.
- Browser user agent string.
- Security flags, such as indications that the same HWID or IP address has been used with more than one account, that a device has been banned, or that reset activity is unusual.
3.4 Usage data
- Roblox usernames and place (game) identifiers seen while the Software is in use, linked to your Vexor account.
- Session times, Software version, login and activation events, and error or crash information.
3.5 Communications
- Messages you send to us through support tickets, website chat, email or Discord, and our replies.
We do not intentionally collect special categories of personal data (such as health data or political opinions). The Software does not collect files, documents, passwords, browsing history or other content from your device beyond the data listed above.
4. Purposes and legal bases
| Purpose | Data used | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Creating and managing your account | Account data | (b) performance of contract |
| Delivering, activating and validating licences | Licence data, HWID, IP | (b) performance of contract |
| Processing purchases and keeping accounting records | Purchase data | (b) contract; (c) legal obligation |
| Providing self-service HWID resets and enforcing reset limits | HWID, reset records, account data | (b) performance of contract |
| Detecting and preventing fraud, licence sharing, chargebacks and abuse, including logging every HWID reset for review by authorised staff | Device and security data, usage data, account data | (f) legitimate interest in protecting the Services and our revenue |
| Keeping the Services secure and fixing errors | Device, usage and log data | (f) legitimate interest |
| Answering support requests | Communications, account data | (b) contract; (f) legitimate interest |
| Complying with law and responding to lawful requests | Any relevant data | (c) legal obligation |
| Establishing, exercising or defending legal claims | Any relevant data | (f) legitimate interest |
Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You may object to such processing at any time (see Section 9).
5. Fraud prevention and HWID reset logging
When an HWID reset is requested, we log account, device, network and usage information related to the reset. This log is visible only to authorised Vexor staff and is used solely to detect licence sharing, resale of personal licences and other fraud. Entries may be automatically marked for manual review. No decision with legal or similarly significant effect is made solely by automated means; any suspension or ban following such a review is decided by a person.
6. Sharing of personal data
We do not sell your personal data. We share it only with:
- Service providers acting on our behalf (hosting, database, email delivery, payment processing), under contracts requiring them to protect it: our hosting provider (servers in the EU), Stripe (payments) and an IP geolocation provider.
- Discord, to the extent necessary to operate sign-in, roles and staff logging channels on our Discord server.
- Authorities, courts or advisors, where required by law or necessary to establish, exercise or defend legal claims.
- A successor, if the Services are transferred, subject to this Policy.
7. International transfers
Some providers (including Discord) may process data outside the European Economic Area. Where this happens, we rely on an adequacy decision of the European Commission or Standard Contractual Clauses, or another safeguard permitted by Chapter V GDPR.
8. Retention
| Data | Retention |
|---|---|
| Account data | While your account exists, then deleted within 30 days of closure, except as below |
| Licence and HWID data | For the life of the licence plus 12 months |
| HWID reset and fraud logs | 24 months from the entry, or longer if needed for an ongoing investigation or claim |
| IP and usage logs | 12 months |
| Purchase and accounting records | As required by Finnish accounting law (generally 6 years from the end of the financial year) |
| Support communications | 24 months after the case is closed |
9. Your rights
Subject to the conditions in the GDPR, you have the right to: - access the personal data we hold about you and receive a copy; - have inaccurate data corrected; - have data erased; - restrict processing; - receive data you provided in a portable format; - object to processing based on legitimate interest, including fraud logging, in which case we will stop unless we have compelling legitimate grounds or need the data for legal claims; - withdraw any consent you have given, without affecting earlier processing.
To exercise a right, contact vexorowner@gmail.com from the email or Discord account linked to your Vexor account. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).
10. Security
We use reasonable technical and organisational measures, including hashed passwords and HWIDs, encrypted connections (HTTPS), restricted staff access to logs and access controls on our servers. No system is completely secure; if a personal data breach is likely to result in a risk to you, we will notify the authority and, where required, you.
11. Children
The Services are not directed at children under 13. If you are under the age required in your country to consent to data processing (13 in Finland), you may use the Services only with the involvement of a parent or guardian. If we learn we have collected data from a child without this, we will delete it.
12. Changes
We may update this Policy. The "Last updated" date will change, and material changes will be announced on vexor.wtf or our Discord server before they take effect.
13. Contact
Vexor – vexorowner@gmail.com