Privacy Policy
Last updated: September 10, 2026
This Privacy Policy describes how Zexius handles information when you use the platform at https://www.zexius.xyz. Zexius is a management and workflow tool for projects, construction, and interiors. Please read this document together with the Terms of Service.
1. Who we are
Zexius is a management and workflow platform for projects, construction, and interiors, available at https://www.zexius.xyz. Identification details of the responsible legal entity will be published on this page once defined.
2. Information we collect
We collect only the categories of information needed to operate the platform, always from your use or from data you and your organization enter:
- Account and authentication data (name, email, profile photo when provided by social login, language and theme preferences).
- Work content entered in Zexius (organizations, members and roles, projects, rooms, items, options, suppliers, purchases and payments, documents and attachments, notifications).
- Strictly necessary technical data (session and language cookies, operational security logs).
3. Account and authentication
You can create an account with email and password or sign in with Google. In this process we handle your name, email, profile photo (when provided), language preference, and session data. Signup confirmation and password-reset emails are part of operating the service.
4. Sign in with Google
Zexius uses Google sign-in only with basic authentication scopes (identity, email, and profile). This may provide us with your name, email address, and profile photo, when made available by your Google account. Zexius does not request and has no access to your Gmail, Google Drive, Google Calendar, contacts, or files.
5. Project data and content you enter
All work content — organizations, invites and member roles, projects, rooms, items, options and proposals, suppliers, purchase lists, payments, documents, comments, and notifications — is provided by users. We handle this content solely to operate the requested features (storing, processing, transmitting, and displaying it).
6. Files and documents
Files uploaded to Zexius (images, project documents, and attachments) are stored in the platform's file infrastructure (Cloudflare R2) and associated with the corresponding projects and documents. Links and documents shared in the client portal are served according to project permissions.
7. How we use information
We use information to:
- Operate the platform and requested features (authentication, organizations, projects, client portal).
- Manage team and client invites and enforce access permissions.
- Send operational communications (signup confirmation, password reset, project notifications).
- Keep the service secure and prevent abuse.
8. Service providers and infrastructure
To operate Zexius we use the following services:
- Supabase — authentication and database.
- Vercel — application hosting.
- Cloudflare R2 — file and image storage.
- Google — social login (basic authentication only).
- Firecrawl — used on demand, only when you request importing data from a URL.
9. Sharing of information
Work content is visible to members of your organization and to project participants according to configured roles and permissions. Content published in the client portal is visible to invited clients, including tracking links when shared by the team. We do not sell your personal data.
10. Security
We apply per-organization database access controls, authorization on file URLs, HTTPS communication, and security headers. No service is entirely immune to incidents; in the event of a relevant security incident, we will take appropriate measures.
11. Retention
We keep your information while your account or organization is active and for as long as needed to operate the service. We have not yet published formal retention or backup-deletion timeframes; when defined, they will be reflected here.
12. Deletion and requests
You can delete projects, documents, and other content wherever the product offers that action, subject to your role's permissions. Account or organization deletion is handled through official Zexius channels. Deletion may not immediately reach backup copies and operational logs.
14. Processing and transfers
Zexius infrastructure may process information outside Brazil, according to the operation of the providers listed in this policy. We apply the access and security controls described above regardless of where processing takes place.
15. Your rights
You can access and correct your account data directly in the product (profile, language, photo). For access, correction, or deletion requests, use the official channels published on this page. We respond in line with purpose, necessity, and transparency principles.
16. Minors
Zexius is a professional-use tool and is not directed at children. Accounts must be created and operated by people with capacity to contract the service.
17. Changes to this policy
When this policy is updated, we will publish the new version on this page with the update date. Material changes will be communicated through official Zexius channels.
18. Contact
The official channel for privacy-related requests will be published on this page. Until then, use the official Zexius channels provided in the product.