Back to home

Privacy policy

Last updated: September 13, 2026

This policy explains how we process your personal data when you visit the VrexAI website and use the service, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

  • Controller: [RAZÓN SOCIAL]
  • Tax ID (NIF): [NIF]
  • Address: [DOMICILIO]
  • Email: vreexai@gmail.com

The remaining identification details are available in the Legal notice.

2. What data we process

Depending on how you use VrexAI, we process the following categories of data:

  • Account data: name, email address, password (stored as a hash, never in plain text), email verification status and sign-up date.
  • Google profile data: if you sign in with Google, we receive your name, email address and profile photo. We never receive your Google password.
  • Payment data: amount, credits purchased, date and transaction identifiers. Your card details are entered into and processed exclusively by Stripe; we never see or store them.
  • Content you submit: prompts, texts to convert into speech, dialogue scripts, music lyrics and descriptions, reference images and audio files you upload (for example, for transcription or voice cloning).
  • Generated content: images, audio, music, sound effects, transcriptions and subtitles you produce, as well as the cloned voices you create.
  • Usage and credit data: generation history, model and settings used, credit cost, balance movements (purchases, usage, refunds).
  • Technical and analytics data: IP address, browser and device type, pages visited, in-app usage events and technical errors.
  • Feedback and support messages: the content of the messages you send us and your email address.
  • Referral program data: your referral code, which users signed up through your link, commissions earned and, if you request a withdrawal, the payment method chosen and the payment detail you provide (PayPal email or IBAN/account number).
  • Waitlists: your email address and the feature you signed up for (for example, video).

We do not request special categories of data. Please do not include sensitive personal data in your prompts or files, nor third-party data without a legal basis to do so. Bear in mind that a voice recording may allow a person to be identified.

3. Why we use your data and on what legal basis

Purpose Legal basis
Creating and managing your account, verifying your email and signing you in Performance of a contract (art. 6.1.b GDPR)
Processing your generation requests, sending them to AI providers, storing and showing you the results Performance of a contract (art. 6.1.b GDPR)
Managing credit purchases, balance, refunds and invoicing Performance of a contract and compliance with accounting and tax obligations (art. 6.1.b and 6.1.c GDPR)
Running the referral program, calculating commissions and paying withdrawals Performance of a contract (art. 6.1.b GDPR)
Sending you transactional emails (account verification and service notices) Performance of a contract (art. 6.1.b GDPR)
Handling your enquiries, feedback and data protection requests Performance of a contract, legitimate interest and legal obligation (art. 6.1.b, 6.1.f and 6.1.c GDPR)
Notifying you when a waitlisted feature becomes available Consent (art. 6.1.a GDPR), given when you sign up
Preventing fraud, abuse and uses contrary to the terms (for example self-referrals or prohibited content) and protecting the security of the service Legitimate interest (art. 6.1.f GDPR)
Internally recording basic service events (account creation, purchase, start of a generation) to measure how the service is working Legitimate interest (art. 6.1.f GDPR)
Browsing and usage analytics through cookies or similar technologies in your browser, to improve the service Legitimate interest (art. 6.1.f GDPR). You can object by blocking or deleting cookies in your browser or by writing to us
Complying with requests from authorities and legal obligations Legal obligation (art. 6.1.c GDPR)

Where the legal basis is legitimate interest, we have assessed that your rights and interests do not override it, and you may object at any time.

We do not use your prompts or content to train our own models. We do not sell your data.

4. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. AI providers may apply automatic moderation filters that block a generation; in that case the credits are returned and you can contact us if you believe it was a mistake.

5. Recipients and processors

We do not disclose your data to third parties unless required by law. To provide the service we rely on providers that process data on our behalf (processors) or, in some cases, as independent controllers:

  • Vercel Inc. — web application hosting and aggregated visit analytics (Vercel Analytics).
  • Supabase Inc. — database hosting (servers in the European Union, Frankfurt).
  • BunnyWay d.o.o. (Bunny.net) — storage and delivery (CDN) of generated and uploaded files.
  • Stripe Payments Europe Ltd. / Stripe Inc. — payment processing. Stripe also acts as an independent controller for fraud prevention and its own legal obligations.
  • ai33 (api.ai33.pro) — AI API aggregator through which, from our servers, we send your prompts, texts and files for processing.
  • AI model providers to which the aggregator forwards each request depending on the model you choose, including: ElevenLabs, MiniMax, Microsoft (Edge voices), Fish Audio, Suno, OpenAI, Google, ByteDance (Seedream/Seedance), Alibaba (Wan), Black Forest Labs (FLUX), Kuaishou (Kling), Runway, Krea and Recraft. Only the provider of the model you use receives your request.
  • PostHog Inc. — product analytics (European Union instance).
  • Google LLC / Google Ireland Ltd. — Google sign-in and sending of transactional emails through Gmail.
  • ntfy (ntfy.sh) — internal notification service we use to receive operational alerts (for example new sign-ups, payments, feedback messages or withdrawal requests), which may include your email address, the content of your message or the payment details you provide for a withdrawal.
  • PayPal or banks — when we pay a referral commission through the method you choose.
  • Other users (referral program): if you sign up through another user's link, that user will be able to see in their dashboard the email address associated with your account and the amount of the purchases that generated a commission.
  • Public authorities, judges and courts, where required by law.

6. International transfers

Some of the providers above are located, or may access data, outside the European Economic Area (for example in the United States or Asia). In those cases transfers are based on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies), on standard contractual clauses approved by the European Commission or on other appropriate safeguards under article 46 GDPR. You can ask us for more information about the applicable safeguards by writing to vreexai@gmail.com.

7. How long we keep your data

  • Generated content and files uploaded for generation: automatically deleted, together with their history record, 10 days after creation. Download anything you want to keep.
  • Cloned voices: until you delete them or close your account.
  • Account data and credit balance: while your account is active. After deletion, they will be blocked for the limitation periods of any potential liabilities.
  • Purchase, invoicing and commission payment records: for the period required by commercial and tax law (generally 6 years).
  • Feedback and support messages: for as long as needed to handle them and, at most, while your account is active.
  • Waitlists: until we launch the feature, you unsubscribe or you delete your account.
  • Analytics data: for as long as needed for the analytics purpose and, at most, 24 months.
  • Cookies: according to the periods stated in the Cookie policy.

AI providers may keep requests for limited periods under their own policies (for example, for security or abuse prevention).

8. Your rights

You may exercise at any time your rights of:

  • Access to your data.
  • Rectification of inaccurate data.
  • Erasure of your data (including deleting your account).
  • Objection to processing based on legitimate interest.
  • Restriction of processing.
  • Portability of the data you have provided to us.
  • Withdrawal of consent at any time, where processing is based on it, without affecting the lawfulness of prior processing.

To avoid analytics in your browser you can also block or delete cookies in its settings, as explained in the Cookie policy.

To exercise them, write to vreexai@gmail.com from the email address linked to your account, stating the right you wish to exercise. We will reply within one month. If we have reasonable doubts about your identity, we may ask for additional information.

If you believe we have not handled your rights properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

9. Minors

VrexAI is not intended for minors. You must be at least 18 years old to create an account. If we detect that an account belongs to a minor, we will delete it.

10. Security

We apply reasonable technical and organisational measures to protect your data: encrypted connections (HTTPS), hashed passwords, restricted access to systems and provider keys kept on the server only. No system is completely secure, but we will notify you and the competent authority of any data breach where required by law.

11. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the current version on this page with its update date and, if the changes are significant, we will notify you by email or within the app.

See also the Terms and conditions and the Cookie policy.