Privacy Policy

Information you provide directly, such as contact details, account profile details, company information, inquiry submissions, support messages, newsletter sign-ups, billing contacts, and content you choose to submit.

Technical and usage information, such as IP address, user agent, device identifiers, request metadata, pages visited, timestamps, error metrics, diagnostics, and security or audit logs used to maintain reliability and prevent abuse.

Cookies and similar technologies, including session, authentication, preference, analytics, and security cookies where applicable.

Information from third parties, such as identity providers, payment processors, app-store providers, fraud-prevention services, analytics tools, and business customers that use our products or services.

We use personal data to provide, operate, personalize, secure, and improve our websites, consulting services, apps, APIs, and related products.

This includes responding to inquiries, managing customer relationships, authenticating users, issuing and monitoring credentials, processing billing, delivering product updates, supporting customer service, detecting abuse or fraud, meeting legal obligations, enforcing our terms, and developing or improving our products.

We may use aggregated or de-identified information to understand usage trends and improve Vexon services. We do not sell personal data.

This policy applies to Vexon websites and services, including products, mobile apps, web apps, APIs, and related brands or services operated by Vexon, such as Passportbase and Frameport.

Some products may collect product-specific information. For example, travel, passport, visa, mobility, media, or frame-processing tools may process the information needed to deliver the requested feature, support diagnostics, maintain security, and improve service quality.

Where a product has additional privacy notices or in-product disclosures, those notices should be read together with this Privacy Policy.

Where UK or EU data protection law applies, we rely on contract where processing is needed to provide services you request; legitimate interests to secure, maintain, improve, and market our services; legal obligation to meet statutory, tax, accounting, and regulatory duties; and consent where required for optional cookies, marketing communications, or permission-based app features.

You may withdraw consent at any time where processing is based on consent.

We keep personal data only for as long as needed for the purposes described in this policy, then delete, anonymize, or securely retain it where a legal hold or statutory obligation applies.

Typical retention periods vary by data type. Account and customer records are generally kept for the life of the relationship. Billing, tax, and accounting records may be retained for the period required by law. Security, audit, and usage logs are kept for a limited period unless needed to investigate abuse, fraud, or service issues. Support correspondence is kept as long as reasonably needed to resolve requests and maintain customer history.

We share personal data with service providers that help us operate our business, including cloud hosting, storage, database, authentication, payment, billing, analytics, error monitoring, logging, email delivery, customer support, security, fraud-prevention, and professional advisory providers.

We may also disclose information where required by law, court order, regulator, or lawful request; to protect the rights, safety, and security of Vexon, our customers, users, or the public; or in connection with a merger, acquisition, financing, restructuring, or sale of assets.

We do not share personal data for cross-context behavioral advertising.

Vexon may process personal data in the United Kingdom, the European Economic Area, the United States, and other jurisdictions where we or our service providers operate.

Where personal data is transferred from the UK or EEA to a country without an adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

We use administrative, technical, and organizational measures designed to protect personal data, including access controls, encryption in transit, monitoring, logging, and proportionate internal safeguards.

No system is perfectly secure. If you believe your information, account, or interaction with a Vexon service has been compromised, please contact us promptly.

Subject to applicable law, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent where we rely on consent.

Under UK and EU GDPR, you may also have the right to lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office.

To exercise privacy rights, contact us using the details below. We may need to verify your identity before responding.

Our services are not directed to children in a way that requires parental consent under applicable law unless that consent has been obtained.

If you believe we have collected personal data from a child contrary to this policy, contact us and we will take appropriate steps to review and delete the information where required.

We use cookies and similar technologies to keep services working, maintain session state, remember preferences, measure usage in aggregate, understand performance, and protect against abuse or fraud.

You can control cookies through your browser settings and, where presented, through consent tools on our websites. Rejecting non-essential cookies should not prevent core services from working, but may limit some features.

Our mobile apps and app-like experiences may collect device identifiers, diagnostics, crash reports, push-notification tokens, and permission-based information such as location, photos, files, camera, or microphone access where required for a requested feature.

You can manage app permissions through your device settings. App stores and platform providers may process information under their own policies.

Frameport is an exception: it collects none of the information described in this section. See the Frameport section below.

Frameport is an iPhone and iPad app that backs up the photos and videos you choose to an Immich server you run or control. This section describes Frameport specifically. Where it differs from the rest of this policy, this section applies.

What Frameport collects: nothing. Frameport does not collect, store, or share any personal data with Vexon. It has no Vexon account and no analytics. It has no crash reporting, no advertising identifiers, and no tracking. Nothing about you or your photo library is sent to Vexon.

Your photos and videos. Frameport uploads the original files you choose directly from your device to the Immich server address you enter, using the credentials you provide. Vexon never receives, stores, or can access your photos, videos, or server credentials. Your Immich server is operated by you or whoever you chose, and its handling of your files is governed by that operator, not by Vexon.

What stays on your device. To show what is left to back up, Frameport reads your album list and each item's date, type, and size. It keeps its backup progress, your selection, and your server connection on your device. Your server key is kept in the iOS Keychain, on this device only. None of this is included in device or iCloud backups. To end Frameport's access to your server at any time, delete its upload key in your Immich account settings.

Checking what is already backed up. Before uploading, Frameport sends your Immich server a fingerprint (checksum) of each file, so your server can say whether it already has it. This goes only to your server.

Notifications. Frameport's notifications are created on your device. They show counts only, never filenames or your server's name. No push token is sent to Vexon or anyone else.

Diagnostics. A diagnostics report is created only when you ask for one. It contains no filenames, server address, or keys, and you see all of it before choosing where to share it. Nothing is sent automatically.

Children. Frameport is not directed at children and collects no data from anyone.

We do not use solely automated decision-making that produces legal or similarly significant effects on individuals.

Any guidance, analysis, or content surfaced by Vexon products is informational and should be reviewed by an appropriate person before being used for important decisions.

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated effective date and, where appropriate, additional notice.

Your continued use of our services after an updated policy takes effect means the updated policy applies to your use of the services.

Vexon

Privacy queries: [email protected]

General inquiries: Contact Vexon

If you are not satisfied with our response, you may complain to the UK Information Commissioner's Office or your local supervisory authority where applicable.