Who is responsible
VAXERON is currently an invite-only private pilot based in Estonia. Its legal operating entity is being established. Until the registered entity details are published, privacy enquiries and requests can be sent to hello@vaxeron.com. The completed controller identity, registry code and registered address will be added before commercial launch.
Information we handle
Depending on how you use VAXERON, we may handle:
- name, business email address, role, organization and property information;
- account invitations, authentication events and access permissions;
- support messages and information you choose to provide;
- technical records such as IP address, device, browser, timestamps and security logs;
- operational hospitality data submitted by a customer or received from an enabled integration;
- website preferences and analytics information, but only where the required consent has been obtained.
VAXERON is designed for hospitality businesses and is not intended for children.
Why we use it
- To provide, secure and administer the requested workspace and guest experiences.
- To authenticate users, apply roles and keep customer workspaces separated.
- To support customers, investigate errors and improve reliability.
- To operate integrations requested by the customer.
- To comply with legal duties and protect VAXERON, its customers and users.
The applicable legal basis may be performance of a contract or requested pre-contractual steps, legitimate interests in operating and securing the pilot, compliance with law, or consent where consent is required.
Customer data and roles
For workspace data, the hospitality customer generally determines why personal data is used and VAXERON processes it on that customer's instructions. For account administration, website operation, security and direct enquiries, VAXERON may act as controller. Commercial customers will receive a separate Data Processing Agreement before launch.
Demo enquiries and website measurement
Demo enquiries use your name, email, company, product interest and message to respond to your request. The form explains whether it is opening an email draft or submitting online. Online submission, when configured, uses Cloudflare Turnstile to check for abuse and Resend to deliver the message. Do not include sensitive guest data or credentials.
Optional PostHog measurement runs only after you choose to allow analytics. It measures public page paths and demo-link clicks, without session replay, automatic click capture or form contents. Query strings and URL fragments are excluded from those events. Analytics remains disabled where its project is not configured. You can withdraw permission through Privacy choices in the footer. Declining does not prevent use of the site.
Service providers and transfers
VAXERON uses specialist infrastructure providers to deliver the service. The current categories and providers are documented on the Subprocessors page. Where data is transferred outside the European Economic Area, appropriate transfer safeguards supplied by the provider are used where required.
We do not sell personal data.
Retention
Information is retained only for as long as needed for the pilot, the customer relationship, security, dispute handling and applicable legal requirements. Account and workspace records are reviewed when access ends. Security logs and backups may remain for a limited period before scheduled deletion. Customer-specific retention and export terms will be defined in the commercial agreement.
Your rights
Subject to the GDPR and applicable limits, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. Contact hello@vaxeron.com. We may need to verify your identity. You may also complain to the Estonian Data Protection Inspectorate or your local supervisory authority.
Security and changes
VAXERON uses access controls, authenticated sessions, tenant-scoped data access and infrastructure security measures appropriate to the pilot. No online service is risk-free. Material changes to this notice will be dated and published here.