Last updated: 15 September 2026
1. Who is responsible
MOBILEXY LTD operates Vaexi and is the controller of personal information used for the purposes described here. We are registered in England and Wales under company number 16824054. Our registered office is 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF. Our correspondence address is 1b-10, Veca Jurmalas Gatve, Riga, Latvia, LV-1083.
Contact privacy@vaexi.com about personal information, rights requests or a data protection complaint. You can also use https://vaexi.com/contact or write to either address. For account support, contact support@vaexi.com. For creator matters, contact creators@vaexi.com.
This notice covers visitors, account holders, learners, creators, applicants and people who contact us. It explains processing under the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where it applies. Acknowledging this notice is not consent to all processing. The lawful basis depends on the purpose.
2. Information we use and where it comes from
We receive information you submit, information generated when you use Vaexi, and results from the providers used to deliver the service.
| Information | Examples and source |
|---|---|
| Account and access | Email, account identifiers, profile details, password hash where password sign-in is used, sign-in tokens, account roles and session records. Supplied by you or generated by the service. |
| Conversation processing | Microphone audio, speech transcripts, AI responses, selected avatar and the context needed to generate a response. Received from your device or generated by our AI providers. |
| Saved learning information | With optional saving enabled: audio of both sides of a conversation, transcript, lesson notes, inferred language level, goals, recurring errors and memory used in later sessions. Generated from your conversations and profile choices. |
| Usage and technical records | Session time and duration, minute balance and adjustments, estimated processing usage, IP address, request and error information, browser or device information present in requests, and security logs. |
| Creator information | Legacy application answers, profile and avatar descriptions, images, settings, reference materials, source and rights evidence, review decisions, and voice samples or synthetic-voice references when that feature is used. |
| Identity verification | Account reference, provider and session reference, status and timestamps received from Didit. Identity documents and any selfie or biometric comparison information are submitted through and processed by Didit. |
| Agreements and requests | Terms version, acknowledgements and consent records, timestamps and associated IP address; your name, email, subject, message and correspondence when you contact us. |
Do not provide information that is unnecessary for language practice or your support request. In particular, avoid medical records, identity documents, financial credentials, intimate information and another person's private data. Identity documents belong in the designated verification process, not in avatar materials or ordinary support messages.
3. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and operate your account, authenticate access, deliver live conversations and maintain the usage balance | Performance of our contract with you, or steps you request before entering it. |
| Save optional conversation audio and transcripts and use them for lesson notes and continuing learning memory | Consent. You may decline saving and still use the live conversation feature. |
| Enable creator access and operate an avatar at the creator's request | Steps requested before a contract and performance of the creator agreement. |
| Verify a creator's identity and reduce impersonation | Legitimate interests in establishing who is responsible for published avatars and protecting users. Where biometric matching relies on consent, separate explicit consent is required for that biometric processing; accepting general Terms is not that consent. |
| Process an optional voice sample to create the synthetic voice requested by its speaker | Consent for the speaker's personal information, together with the separate voice and content permissions required for the feature. A recording is not automatically special-category biometric data; that classification depends on using biometric processing to identify someone uniquely. |
| Prevent abuse, secure accounts, diagnose faults, investigate reports and review content rights | Legitimate interests in a secure, reliable service and protecting users and rights holders. |
| Respond to account and creator requests | Contract where necessary to provide the requested service; otherwise legitimate interests in answering and resolving the enquiry. |
| Handle data rights requests, comply with a binding disclosure requirement and keep legally required records | Compliance with the particular legal obligation that applies. |
| Establish, exercise or defend a claim | Legitimate interests in resolving disputes and protecting legal rights, with an additional condition where the law requires one for sensitive information. |
We do not treat every identity check as a statutory anti-money-laundering obligation. We do not use a consent checkbox to replace the separate assessment required for legitimate interests or sensitive information.
Account information needed for authentication is necessary to provide account features. Creator identity checks and rights evidence are conditions of creator access. Optional saving is not a condition of ordinary live use. If you do not provide a required item, we will explain which feature cannot be provided.
4. Live processing, recordings and memory
Live audio must reach our voice provider and conversation text must be processed by AI systems to produce a response. Turning off saving prevents Vaexi from saving that session's audio and transcript in its lesson storage. It does not prevent the transient processing needed for the conversation or the creation of duration, usage and security records.
When saving is enabled, the recording can include both you and the avatar. The transcript is used to generate a lesson summary and update learning information. Some profile information, such as your goals and language background, can be used across avatars. Other notes concern your work with a particular avatar. Previous memory can remain available until removed, even if you turn off saving for a later session.
Choose whether to save before starting a conversation. To stop saving during a conversation, end it and start another with saving disabled. To withdraw consent for further use of previously saved information, or ask for its removal, contact privacy@vaexi.com or use the available data-removal control. Withdrawal does not affect the lawfulness of earlier processing.
Learning notes can be wrong. You can ask us to correct or remove them. They are used to personalise practice, not as a formal assessment of your ability or eligibility for education or employment.
We do not train a general-purpose model ourselves on your conversations or creator materials. Supplying context to generate responses and updating learning notes are different from training model weights. Provider data use is governed by the relevant service terms and account settings. We do not promise that turning off Vaexi saving turns off every provider log or enables zero retention throughout the processing chain.
5. Providers and other recipients
| Recipient | Purpose and information involved |
|---|---|
| Contabo hosting infrastructure | Runs the application and stores its database, files and server backups. This can include account information, saved conversations and creator materials. |
| ElevenLabs | Processes live voice and conversation context, supplies speech recognition and synthesis, and processes voice samples when a synthetic-voice feature is used. |
| Google Gemini services | Generate AI responses and learning or creator-content outputs, including through ElevenLabs or OpenRouter. The inputs can contain conversation text, profile context and relevant creator materials. |
| OpenRouter | Routes background AI requests used for learning notes and processing creator materials to the configured model provider. |
| Didit | Hosts creator identity verification and processes the document, selfie or liveness evidence required by the selected check. Returns verification references and results to Vaexi. |
| Resend | Sends account and service emails using your email address, message content and delivery information. |
| Authorised personnel and professional advisers | Access information needed to operate the service, handle a request, investigate an issue or advise on a legal obligation or claim. |
Our application records the limited Didit fields described above. Documents and selfies are not saved in the Vaexi application database, but are processed in Didit's systems. We remain responsible for the check we request and for handling requests about it. The provider may have separate responsibilities for processing undertaken for its own purposes.
Public avatar names, profiles, images and other content marked for publication can be viewed by visitors and indexed or copied by others. Publishing an avatar does not give its creator access to learners' private transcripts or contact details. Authorised support or technical staff may access relevant records where needed to resolve an issue; ordinary creators do not receive that administrative access.
We may disclose information where necessary to comply with law, protect people or respond to a legal claim. If the business is transferred, relevant information may pass to the successor subject to applicable law and appropriate notice. We do not sell personal information or disclose it to advertisers for cross-site behavioural advertising.
6. Where processing takes place
The production application uses Contabo infrastructure. Current network-location information places the server in France. The configured daily database and file backups are stored on that server. This does not mean every provider processes data only in France or only within the European Economic Area.
Our AI, verification and email providers operate internationally. Processing and support may involve the EEA, the United Kingdom, the United States and other locations used by their authorised providers. Their published processor and subprocessor information describes the services they use. For information about a particular Vaexi data flow, destination or transfer safeguard, contact privacy@vaexi.com.
UK adequacy rules permit covered transfers to EEA recipients. A transfer elsewhere requires an applicable adequacy arrangement, appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or a narrowly applicable legal exception. EU transfers must also meet the EU GDPR requirements where those apply. The availability of a provider's standard agreement is not, on its own, evidence that every Vaexi transfer is covered. Contact us for information about the safeguards applicable to your information and how to obtain a copy.
7. Retention and deletion
Retention depends on the information and the purpose for which it is still needed. We consider whether the account or feature remains in use, whether you have withdrawn consent or requested erasure, whether a complaint or claim is unresolved, and whether a particular law requires continued retention. We do not keep every record for a single fixed “AML” period.
| Information | Retention approach |
|---|---|
| Account and access information | Kept while needed to operate or secure the account. A sign-in session expires after at most 30 days from issue; account closure and erasure are separate from session expiry. |
| Saved audio and transcripts | Kept to provide your saved lesson history until removed through the data controls or an erasure request, unless a specific legal reason requires restricted retention. They do not currently expire automatically after a fixed number of days. |
| Learning notes and memory | Kept for continuing personalisation while that purpose remains applicable. Requests to withdraw consent, correct or erase these notes can be made through privacy@vaexi.com. |
| Creator content and applications | Kept while operating the creator account or avatar; legacy application records may also remain. On removal or closure, content is removed or retained only for a necessary, identified legal or recovery purpose. A user's existing saved conversation may require separate assessment. |
| Verification records | Kept while needed to maintain creator eligibility and address a specific verification dispute or legal obligation. Underlying Didit evidence requires a provider-side retention and erasure process; clearing Vaexi's lesson data does not delete it. |
| Usage, agreement and security records | Kept as needed to administer access, demonstrate an agreement, investigate abuse or resolve a particular claim. They may remain after lesson content is erased. |
| Support correspondence | Kept while resolving the issue and for any subsequent period justified by a related complaint, claim or legal obligation. |
| Backups | Daily server backups use an age-based rotation of approximately one month. Separate deployment and recovery snapshots can have different lifetimes and must be considered when handling an erasure request. Removal from the live application does not instantly erase every backup or provider copy. |
The current “delete my data” operation clears saved conversation files and transcripts, learning profiles, certain creator content and application records, matching support messages and active sign-in sessions. It does not delete every account, usage, agreement or verification record. For full account closure or an erasure request covering remaining records and providers, contact privacy@vaexi.com. We will explain any information that must be retained and the reason.
Where backup data must remain for recovery, access must be restricted to that purpose and erasure requests must be reapplied if a backup is restored. Retaining a backup is not permission to resume ordinary use of information you have asked us to erase.
8. Your rights
Depending on the processing and applicable law, you can ask for access to your personal information and a copy, correction, erasure, restriction of use and a portable copy of information you supplied where portability applies. You can withdraw consent at any time for processing that relies on it. These rights are subject to the conditions and exceptions in law; we will explain a refusal or limitation.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your particular situation. We must stop unless we establish a legally sufficient reason to continue, including where necessary for legal claims. You can always object to use of your information for direct marketing. Vaexi does not currently use the website for targeted advertising.
Email privacy@vaexi.com or use https://vaexi.com/contact. Tell us what you want and identify the relevant account. We may request proportionate evidence of identity before disclosing or changing information. Do not send a passport unless a secure process and a genuine need have been explained.
We respond to rights requests without undue delay and normally within one month, subject to any lawful clarification, identity-check or extension rules. If an extension is permitted because a request is complex or there are multiple requests, we will explain it within the applicable period. Requests are normally free; a fee or refusal is possible only where the law permits it.
9. Automated processing and creator decisions
OpenAI receives avatar profile text, instructions, generated style information and extracted reference-material text for automatic safety moderation before publication. Identity documents and learners’ private conversations are not submitted as part of this publication check. The check can delay or block publication; creators can revise flagged content, retry or contact us to challenge a result.
AI produces responses, transcripts, summaries and inferred learning notes. These outputs can be inaccurate and are not official qualifications or assessments. Didit can use automated document and facial checks. Its result is used by the application to permit or restrict creator functions, so an incorrect result can prevent creation or publication of an avatar.
You can request human review of a verification result or creator-access decision, explain your position and challenge the information used. Contact creators@vaexi.com or privacy@vaexi.com. We do not describe the identity gate as having no consequences simply because a third-party provider performs the check.
10. Children and security
Vaexi is intended for adults aged 18 and over. We do not invite children to create accounts. If you believe a child has provided information or obtained access, contact us so we can investigate and take appropriate steps. An age declaration is not a guarantee that children cannot reach a website.
We use HTTPS, access controls, session protections and password hashing where passwords are used. Access to private lesson content is restricted through account permissions. No service can promise absolute security. Report a suspected security problem through support@vaexi.com or the contact form, without accessing another person's records or sending unnecessary sensitive information.
11. Complaints
Send a data protection complaint to privacy@vaexi.com, through https://vaexi.com/contact or by post. Explain the concern and the outcome you seek. We will acknowledge the complaint within 30 days, investigate appropriately and communicate the outcome without undue delay. This complaints timetable is separate from the time limit for responding to a data-rights request.
You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or by calling +44 303 123 1113. Its postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Where EU law applies, you may also complain to the supervisory authority in the EU country where you live, work or believe a breach occurred. In Latvia, the Data State Inspectorate is at https://www.dvi.gov.lv/en. You do not lose the right to contact an authority or court by first contacting us.
12. Changes
We will update the date above when this notice changes and give a prominent notice of a material change affecting you. If a new purpose requires fresh consent, we will ask for it before beginning that processing. Changes to a notice do not retrospectively authorise a new use of your information.