Privacy Notice
Last updated: 12 October 2026
Who we are
VexRoute is the controller for personal data collected through vexroute.com and the VexRoute CRA Reporting Desk.
Contact: menachem@vexroute.com.
Use this address for privacy requests, including access, correction, deletion, objection, restriction, portability, or questions about how we use your data.
What we collect
When you use the public website, we may collect basic website analytics, such as page views and events, through Vercel Analytics.
On the CRA Desk we also count six steps: opening the deadline calculator, opening the desk, logging a case, downloading report drafts, asking about the Report Pack beta and joining the paid-plan waitlist. Each count stores only the step name and the date. It uses no cookies or browser storage, and stores no IP address, device details, email or case content, so a count cannot be linked to you or to your other visits.
When you submit the CRA Desk forms, we collect the details needed for the form you use.
The CRA Desk itself is browser-first. Case summaries, notes, backups and deadline calculations stay in your browser unless you submit them through a form, email them to us, or later use a logged-in product.
When you use the contact page or book a call, we collect the details you provide so we can respond.
- Work email address.
- Product name.
- Case type, such as actively exploited vulnerability or severe incident.
- Requested export format, if you ask about the Report Pack beta.
- Selected paid-plan waitlist option, company name and optional product-count or workflow comment.
- The missing field or comment you choose to send, if any.
- Whether an email was sent successfully.
- Submission date and source form.
Why we use it
- Send the deadline chain or report-draft flow you requested.
- Respond to demo, contact and beta-interest requests.
- Follow up about CRA Desk feedback, product fit and the VexRoute service.
- Improve the website and CRA Desk based on aggregate usage and form signals.
- Protect the service from abuse and keep operational records.
Legal basis
For CRA Desk lead forms, paid-plan waitlist forms, contact messages and follow-up, VexRoute relies on legitimate interests: responding to people who ask for CRA Desk outputs, learning whether the product solves a real business problem, improving the service, and following up with relevant B2B product information. You can object or ask us to stop follow-up at any time.
Where processing is necessary to take steps before entering a contract or to provide a paid service, VexRoute may rely on contract necessity.
Where a legal duty applies, VexRoute may process data to comply with that duty.
International transfers
VexRoute and its providers may process data in countries outside the country where you are located. Where GDPR transfer rules apply, VexRoute relies on the relevant provider safeguards, such as standard contractual clauses, adequacy decisions, or equivalent lawful transfer mechanisms offered by those providers.
How long we keep it
CRA Desk lead records are normally kept for up to 24 months after the last meaningful interaction; an automated job deletes them on that schedule, unless we need to keep them longer for a legal, security, accounting, contractual or dispute reason.
Contact and demo-call messages live in our email inbox rather than a database. We aim to delete or anonymise them within 24 months of the last meaningful interaction by removing them manually, unless we need to keep them longer for a legal, security, accounting, contractual or dispute reason. Our email provider, Resend, may separately retain its own delivery logs under its own retention policy.
Anonymous CRA Desk step counts are deleted automatically after 24 months.
If you ask us to delete your data, we will delete it unless we need to keep limited information for a legal, security, accounting, contractual or dispute reason.
Browser-only CRA Desk data stays on your device until you clear it, delete it, or change browsers/devices. VexRoute cannot recover browser-only data that you have not submitted.
Your rights
- Access your personal data.
- Correct inaccurate data.
- Delete your data.
- Restrict or object to processing.
- Receive a copy of data you provided in a portable format.
- Complain to your data protection authority.
Depending on where you are, these rights may apply to you. To exercise a right, email menachem@vexroute.com. We may need enough information to confirm which records are yours.
Required or optional
CRA Desk forms are optional. If you do not provide a work email, we cannot send requested emails, follow up about the Report Pack beta or add you to the paid-plan waitlist, but the browser-only desk remains usable.
Automated decisions
VexRoute does not use CRA Desk form data for automated decisions that produce legal or similarly significant effects.
Changes
We may update this notice as VexRoute changes. The latest version will be posted on this page with its last-updated date.
Return to the CRA Reporting Desk.