01The short version
Vertexa is a rate-comparison site. We never move your money and we never see your bank account. When you click through to a vendor to send funds, you leave our site and their privacy policy takes over.
- We collect only what we need to run the site: an email if you sign up, a currency pair if you save one, and an approximate country from your IP so the FROM currency defaults sensibly.
- We never sell your personal data. There are no ad networks, no behavioural retargeting pixels, and no third-party analytics that build a profile of you.
- You can export or delete everything we have about you at any time by emailing support@thevertexa.com. We reply within 30 days.
02Who we are
Vertexa is operated by the Vertexa team. The site lives at thevertexa.com. For anything related to this policy, write to support@thevertexa.com.
03What we collect
We group the data into three categories, based on how you interact with the site:
| Category | What it contains | When we collect it |
|---|---|---|
| Account data | Email address, a bcrypt hash of your password, optional first name / last name / country, saved default currencies, saved corridors, notification preferences, optional SMS / WhatsApp phone number. | You explicitly create an account or update your preferences. |
| Alert data | Currency pair, target rate, vendor selection, alert status, and the timestamps of each trigger. | You create a rate alert from /alerts. |
| Usage data | Approximate country derived from your IP address (never the raw IP, and never stored on our server), your preferred display language, and the currency pair you last compared. | Automatically, on your device — stored in localStorage, not on our servers, unless you sign up. |
04Why we collect it (lawful basis)
- To provide the service — you can't sign in without an email, and rate alerts can't trigger without a target rate. Legal basis: performance of a contract.
- To geolocate defaults — showing an Indian visitor a default of INR is more useful than defaulting to USD. Legal basis: legitimate interest, and you can override the default at any time.
- To notify you — email, SMS, or WhatsApp when an alert fires. Legal basis: consent, which you toggle per channel on
/account. - To keep the site secure — server logs of unusual activity (rate limits, brute-force attempts). Legal basis: legitimate interest.
06How Vertexa makes money
Some vendors pay us a referral fee when you click through and complete a transfer. That fee never influences the ranking on /compare — the table is sorted strictly by the rate the vendor offers. We disclose this on the homepage and in our About page.
The referral fee is paid by the vendor, not by you. We do not pass your personal data to them as part of the referral — only an anonymous click identifier so they can attribute the transfer.
07How long we keep it
- Account data — kept until you delete your account. Deletion removes the row from our
userscollection immediately. - Alerts — active alerts stay until you archive or delete them. Triggered-but-unread alerts are archived 90 days after the trigger.
- Backups — encrypted daily database snapshots are kept for 7 days on rolling deletion, then removed automatically.
- Server logs — request logs are kept for 14 days for security investigation, then deleted.
08Your rights
If you live in the EU, UK, California, or any jurisdiction with modern privacy law, you have the right to:
- Access — request a copy of everything we hold about you.
- Correct — ask us to fix data that's wrong.
- Delete — ask us to erase your account and all associated data.
- Port — receive your data in a machine-readable format (JSON).
- Withdraw consent — turn off any notification channel from
/account, or unsubscribe from any email we send. - Object — tell us to stop processing your data under legitimate interest.
- Complain — lodge a complaint with your local data protection authority.
Email support@thevertexa.com from the address on your account. We reply within 30 days at no cost.
09How we protect your data
- Passwords are hashed with bcrypt (cost factor 12). We never see or store the plaintext.
- Sessions use a signed JWT stored in an HttpOnly, Secure, SameSite=None cookie — JavaScript on the site can't read it, so a compromised third-party script can't steal a session.
- All traffic is TLS 1.3 end to end. HTTP requests are redirected to HTTPS.
- Database backups are encrypted at rest.
- We keep our stack up to date — dependencies are scanned weekly for known CVEs.
10Children
Vertexa is not directed at children under 16. If you believe a child has provided us data, email support@thevertexa.com and we'll delete it.
11International transfers
Our infrastructure runs in the United States and Canada. If you access the site from the EU or UK, your data crosses those borders under the standard contractual clauses adopted by our sub-processors (Resend, Twilio, Cloudflare).
12Changes to this policy
We'll update the Last updated date at the top whenever this document changes. Material changes (new data collected, new sub-processor, new lawful basis) are announced by email to every signed-up user at least 14 days before they take effect.