1. Who We Are
Vexil SecurePass is a product of Vexil Technologies Ltd., a technology company incorporated in Lagos, Nigeria. We provide event access control infrastructure for professional event organisers (“Clients”). When Clients deploy our platform, they upload guest lists containing personal data belonging to event attendees (“Guests”).
This Privacy Policy explains how we collect, store, use, and protect data from both Clients and Guests. For questions, contact us at hello@vexil.com.
2. Data We Collect
2.1 Client Account Data
- Name and email address (used for account creation and login)
- Business or organisation name
- Billing and payment information (processed by third-party payment processors — we do not store card data)
- Communication history with our support team
2.2 Guest Data (uploaded by Clients)
- Guest name and phone number or email address (as provided by the Client)
- VIP tier assignment
- Unique cryptographic pass identifier
- Scan timestamp and gate terminal identifier (generated at the moment of admission)
2.3 Platform Usage Data
- Browser type, device type, and operating system
- IP address and general geographic region
- Page interactions and feature usage (for platform improvement only)
3. How We Use Your Data
- ✓Service delivery: To generate, encrypt, distribute, and validate event passes.
- ✓Real-time gate enforcement: Scan timestamps and invalidation records are written to the database at the moment of scan for anti-passback enforcement.
- ✓Audit logs: Post-event CSV exports are generated for Client use and are not retained by us beyond 90 days after the event date.
- ✓Platform communication: We send transactional emails related to your account (password resets, invoices, platform notices). We do not send unsolicited marketing emails.
- ✓Security: IP and session data is used to detect and prevent unauthorised access to Client accounts.
4. Data Sharing
We do not sell, rent, or trade personal data. We share data only with:
Supabase (database infrastructure)
Guest and Client data is stored on Supabase-managed PostgreSQL. Row-Level Security (RLS) is enforced — Clients can only access data belonging to their own events.
Cloudflare (hosting and edge network)
The platform is hosted on Cloudflare Pages and Workers. Cloudflare may process request metadata as part of DDoS protection and CDN delivery.
Payment processors
Billing is handled by third-party payment processors subject to their own privacy policies. We do not receive or store card details.
Law enforcement
We will disclose data when legally required under applicable African and international legal process, and only to the extent necessary.
5. Data Retention
Guest data
90 days post-event
Permanently deleted after 90 days from the event end date.
Client account data
Account lifetime + 12 months
Retained for 12 months after account closure, then permanently deleted.
Scan audit logs
90 days post-event
Clients may export their full CSV audit at any time within this window.
6. Security
Vexil SecurePass is built on a security-first architecture:
- All data is encrypted in transit via TLS 1.2+
- Data at rest is encrypted by Supabase infrastructure
- Row-Level Security policies enforce strict data isolation between Clients
- Pass validation uses atomic database operations to prevent race conditions
- Gate access codes can be rotated instantly by Clients in the event of a suspected compromise
No system is perfectly secure. If you discover a vulnerability, please disclose it responsibly to hello@vexil.com.
7. Your Rights
You have the right to:
- Request access to the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention obligations)
- Object to or restrict processing in certain circumstances
- Receive your data in a portable format
To exercise any of these rights, contact us at hello@vexil.com. We will respond within 30 days.
9. Children
Vexil SecurePass is a business-to-business platform. We do not knowingly collect data from individuals under 18 years of age. If you believe a minor has provided data through our platform, contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated to Clients via email at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the revised policy.
11. Contact
For any privacy-related enquiries:
Vexil Technologies Ltd.Lagos, Nigeria
hello@vexil.com