Privacy Policy

Who controls your information

In this policy, “Vayfora,” “we,” “us,” and “our” refer to XPO8 Limited. We normally control the personal data used to manage accounts, billing, security, support, our public website, and our direct relationship with you.

When we host a customer website, the website owner normally decides why and how visitor information is collected through that website. This includes contact-form submissions and visitor analytics. For that information, the website owner is responsible for its privacy notice and lawful basis, and we act as its service provider or processor to the extent required by applicable law. We may still process limited information for our own billing, security, fraud-prevention, and legal purposes.

Scope

This policy applies to vayfora.com and other Vayfora services that link to it. It also explains our role when we process information for websites hosted by Vayfora. It does not govern an independent customer website owner, a source website before migration, or a third-party service operating under its own privacy notice.

Personal data means information that identifies, relates to, or can reasonably be linked to a person. Aggregated or de-identified information that cannot reasonably identify a person is not personal data. If we combine it with personal data, we treat the combined information as personal data while it remains combined.

Information we collect

The information we collect depends on how you use the service:

• Account information: name, email address, account status, preferences, and the websites connected to your account.
• Email preference and delivery information: Your current marketing choice, consent wording and history, delivery and click events, unsubscribes, and hashed-address suppression records for hard bounces or spam complaints.
• Authentication and security information: login and password-recovery events, session identifiers, security records, and hashed network identifiers used for access control, ownership records, and rate limiting.
• Website scan information: the URL and domain you submit, publicly available pages, text, metadata, links, code, images and other assets, screenshots, detected technologies, performance results, migration compatibility, and hosting estimates. Public pages may contain information about people published by the source website.
• Migration and hosting information: ownership authorizations, source snapshots, converted website files, quality-assurance evidence, repair history, deployment records, domain and DNS configuration, SSL status, form configuration, uptime checks, incidents, and service logs.
• Hosted form information: the text a visitor submits through a supported form, such as a name, email address, and message, together with submission time, spam status, and a hashed network identifier. Where photo uploads are enabled, we also store the submitted photo and its filename, file type and size. Photos are private and available through the site owner’s authenticated inbox. Form submissions and their photos are retained for up to 90 days.
• Hosted-site usage information: page path, time, referring hostname, country code, broad device type, and coarse browser family. We use these events to measure traffic, show website analytics, and apply the correct hosting plan. Query strings are removed before page paths are recorded for this purpose.
• Billing information: plan, billing interval, subscription and invoice status, billing contact details, tax information where required, and payment-processor references. Stripe processes payment instruments; we do not receive or store full card numbers.
• Communications: support requests, feedback, legal and privacy requests, notification preferences, and messages we send about the service.
• Technical information: browser and device details, IP-derived request information, timestamps, error reports, and diagnostic, fraud-prevention, and security logs.

Anonymous website scans and protected hosted forms may use Cloudflare Turnstile. Cloudflare may receive network, browser, device, and interaction signals needed to determine whether the request is automated and return a verification result to us.

Sensitive information

Vayfora is not designed to collect identity documents, payment-card details in form messages, bank or financing records, medical information, government identifiers, biometric data, or other sensitive information. Do not place this information in website forms, support messages, or source pages provided for migration unless it is genuinely necessary and you have a lawful right to provide it. We may delete, mask, restrict, or decline to process sensitive information submitted unnecessarily.

Where information comes from

We receive information directly from you, automatically when you use the service, from visitors to websites we host for you, from the public website you ask us to scan or migrate, and from providers that support authentication, payments, email, analytics, security, and infrastructure. We do not intentionally access password-protected areas of a source website as part of the public scan or migration workflow.

How we use information

We use information to:

• scan public websites, prepare reports, assess eligibility, and estimate migration and hosting requirements;
• reproduce, repair, test, preview, deploy, host, secure, and monitor customer websites;
• operate accounts, authenticate users, manage domains, deliver form submissions, and send service notifications;
• process subscriptions, taxes, invoices, refunds, traffic-based plan changes, and billing support;
• measure hosted-site traffic, provide customer analytics, diagnose errors, and improve reliability and product quality;
• prevent spam, abuse, fraud, unauthorized access, and security incidents, and enforce our Terms of Service; and
• comply with law, respond to lawful requests, resolve disputes, protect rights, and preserve records where required.

AI-assisted migration

If automated migration does not pass our quality checks, we may send public source-website material and limited technical or visual quality evidence to an AI service through OpenRouter to help repair or reconstruct the migrated website. This workflow is used to generate website code and migration fixes. We do not send account passwords, full payment-card data, or hosted-form submissions through this repair workflow. AI output is tested before it is selected for a preview, and you review the migrated preview before moving your domain.

Legal bases

Depending on the context and law that applies, we process personal data because it is necessary to perform a contract, you have given consent, we or a customer have a legitimate interest that is not overridden by individual rights, or we must comply with a legal obligation. Legitimate interests may include operating and improving the service, securing accounts, preventing abuse, measuring billable use, supporting customers, and protecting legal rights.

A customer using Vayfora forms or analytics is responsible for identifying and communicating the lawful basis that applies to its own website visitors. Where consent is legally required, the responsible party must obtain it before the relevant processing begins.

How we share information

We do not sell personal data. We disclose information only as reasonably needed for the purposes described in this policy:

• With the website owner: hosted-form submissions, website analytics, migration records, and other information connected to its website are available to its authorized account.
• With service providers: providers supporting database and authentication services, application and worker hosting, storage, content delivery, website acquisition, payments, email, analytics, AI-assisted repair, logging, and security. Current functionality may use Supabase, Vercel, Google Cloud, Cloudflare, ScrapingBee, Stripe, PostHog, OpenRouter and model providers available through it, and Resend or SendGrid.
• At your direction: with recipients you configure for notifications, a registrar or DNS provider you use, or another party you ask us to involve.
• For legal and safety reasons: with advisers, auditors, insurers, regulators, courts, law enforcement, or other parties where reasonably necessary to comply with law, protect rights and security, or resolve a dispute.
• For a business transaction: with relevant advisers, counterparties, and successors during a merger, financing, restructuring, acquisition, insolvency, or sale of all or part of the business.

Providers may change as the service evolves. Where appropriate, we use contracts and operational controls intended to limit a provider to authorized processing and require suitable security. Third-party services may also process information independently under their own terms and privacy notices.

Cookies and similar technologies

We use cookies and comparable storage needed for authentication, password recovery, scan access, security, and routing. Local account-session and scan-access cookies may remain for up to seven days unless they expire or are removed earlier; an external authentication provider may apply its own session period. Stripe and other linked services may set their own technologies when you visit them.

With your permission, we use a first-party analytics preference cookie for up to 180 days and a random visitor identifier for up to 30 days. These help us understand the Vayfora signup and migration journey through PostHog. We do not send email addresses, submitted website URLs, form content, exact hosting costs, payment-provider identifiers, or raw error messages, and we do not use session replay or advertising profiles. Withdrawing permission prevents future optional browser events and removes the visitor identifier.

Traffic measurement for websites hosted by Vayfora is generated from server-side delivery events and does not require us to create an advertising profile of the visitor. Browser controls may not affect server records required for security, billing, or delivery of the service.

International transfers

XPO8 Limited is based in Hong Kong, and our providers may process information in Hong Kong, the United States, the European Economic Area, and other locations where they operate. Data-protection laws may differ between those places. Where required, we use contractual, technical, and organizational measures intended to protect information transferred across borders.

Retention

We keep information only for as long as reasonably needed for the service, the purpose for which it was collected, and legal, accounting, security, dispute, and enforcement requirements. In particular:

• hosted-form submissions are normally removed after 90 days;
• processed pageview-event details are normally removed after 90 days, while monthly totals may remain for billing, accounting, service history, and dispute handling;
• source snapshots, migration files, deployments, and recovery material may remain while a website is hosted and for a limited operational or backup period afterward; and
• ownership authorizations, invoices, refunds, audit records, and security records may remain for the period required to comply with law, prevent fraud, establish rights, or resolve a dispute.

Deletion from active systems may not immediately remove limited copies from encrypted backups, provider systems, legal holds, or immutable security and billing records. Those copies follow their own deletion cycles and are not used for unrelated purposes. We may retain aggregated or de-identified information that no longer reasonably identifies a person.

Security

We use technical and organizational measures intended to protect information, including encrypted transport, access controls, tenant isolation, restricted credentials, logging, provider security controls, backups, monitoring, and incident-response procedures. No online service can guarantee perfect security. You are responsible for protecting your account, email, devices, registrar, and DNS access and for telling us promptly about suspected unauthorized access.

Your choices and rights

Depending on where you live and the law that applies, you may have rights to request access, correction, deletion, restriction, portability, or information about how personal data is used; to object to certain processing; to withdraw consent; or to opt out of direct marketing. You may also have a right to complain to a data-protection authority.

We may ask you to verify your identity, account, or authority before acting. A request may be limited or refused where the law permits, including when information must be kept for billing, security, legal claims, fraud prevention, or another person’s rights. If your request concerns a hosted website, we may direct you to the website owner or work with that owner because it controls the relevant visitor information.

Communications

We may send account, migration, billing, security, domain, uptime, form, legal, and other service messages. You cannot opt out of messages necessary to operate an active service. Optional marketing email is sent only after an affirmative choice. You may withdraw that choice immediately through the one-click link in any marketing message or from dashboard settings. Withdrawing marketing consent does not stop service messages.

Children

Vayfora is not intended for anyone under 18, and we do not knowingly collect personal data directly from children. Contact us if you believe a child has provided personal data so we can review it and take appropriate action.

Public websites and external links

A migrated website is public once its owner makes it live. Public content can be viewed, copied, indexed, or shared by others. Source websites and migrated websites may link to services we do not control. Review those services’ privacy terms before providing information to them.

Changes to this policy

We may update this policy to reflect changes to the service, providers, operations, or law. If a change is material, we may give notice through the website, product, or email. The date at the top identifies the current public version.

Contact us

Send privacy requests, questions, corrections, deletion requests, and complaints to contact@xpo8.com. Include the email address connected to your account and the relevant website or domain so we can locate the record.