VEXPay privacy policy
What data VEXPay handles about businesses, their buyers and visitors to its sites, why, who it is shared with and for how long.
Who handles your data
Last updated: November 2, 2026. The Spanish version prevails if the two differ.
VEXPay is a technology platform operated by Chu Capital, C.A. (RIF J-50832436-6), Caracas, Venezuela. This policy explains what data we handle to provide VEXPay. For buyers' data, the business collecting the payment decides what it uses it for; VEXPay handles it to process their payments.
What data we handle
| About whom | Data | Why |
|---|---|---|
| Businesses (clients) | Legal name, RIF or ID, address, activity, company documents, identity data and documents of owners and representatives (including a selfie when asked), owner email and phone, bank accounts and wallets for withdrawals | Open and verify the account (KYB), screen sanctions lists, reach the owner and pay withdrawals |
| Portal and API users | Email, credentials, IP address, browser and API key usage | Give access, protect the account and detect misuse |
| Buyers (bolívares) | Cédula or RIF, phone, bank, reference, amount and date; name and email when the business or checkout asks for them | Run or verify the payment (Débito Inmediato, Pago Móvil), reconcile it and issue receipts |
| Buyers (bolívar cards, when available) | Number, expiry, code and PIN are sent to the bank to authorise and are not stored. We keep the last 4 digits, the BIN and an irreversible card fingerprint | Authorise the payment, price it and prevent fraud |
| Buyers (Colombian pesos and stablecoins) | What each channel asks for (ID, phone, email); wallet addresses and transactions | Process and reconcile the payment |
| Buyers who choose "remember my details" | Saved phone, cédula and bank, and the trusted device (30 days) | Prefill future payments after confirming a code sent by WhatsApp |
| Sellers and payout recipients | Name, ID, bank account or Pago Móvil | Verify the destination and send the payment |
| Visitors to our sites | Page views and aggregate technical data; portal session cookies | Keep you signed in and measure use of the docs |
We handle this data to perform our contract with the client, meet legal obligations, prevent fraud and, for "remember my details", with the buyer's consent.
Who we share it with
- The business collecting: sees the data of the payments it receives.
- Partner banks and payment processors: receive what they need to run, verify or refund each payment and payout.
- Service providers acting for us: cloud hosting (Railway and Contabo), KYB document storage (Cloudflare R2), email delivery (Resend), WhatsApp messaging for verification codes and our internal communication tools (Slack). They use the data only to provide that service to us.
- Authorities: when a law or competent order requires it.
Sanctions screening runs on our own system, without sending the data to third parties. We do not sell personal data or use it for advertising.
Where the data is kept. Data is stored and processed outside Venezuela:
- United States (Virginia): the platform, the portal and the main database, with payment, account, KYB and customer data (Railway).
- European Union: the WhatsApp messaging server for verification codes, the online-store apps (Shopify and Tiendanube), the documentation and the exchange-rate service (Contabo).
- Cloudflare's global network: KYB documents and business logos (Cloudflare R2).
- United States: email delivery (Resend) and our internal communication tools (Slack).
- Venezuela and Colombia: partner banks and payment processors receive what each payment needs.
How long we keep it
- Payment, payout and KYB records are kept while the account is active and afterwards for as long as the law and the handling of claims, reversals and chargebacks require.
- The usage log of each API key (IP and browser) is deleted after 90 days.
- Verification codes expire after 10 minutes and a trusted device after 30 days. A buyer can ask us to delete their remembered details.
Security
We use encrypted connections, store credentials and secrets encrypted or hashed, sign webhooks, limit internal access to those who need it and log access. KYB documents open only through short-lived links. No system is infallible; if an incident affects your data, we will tell you.
Your rights and contact
You can ask us for access to, correction or deletion of your data, or object to its use, by writing to soporte@vexwallet.co. If you bought from a business, you can also contact that business. Some data cannot be deleted while the law or an open claim requires keeping it.
We may update this policy; we will publish the new version here with its date. The laws of the Bolivarian Republic of Venezuela apply. More about the service in the Terms of service.