Privacy Policy

QENEX LTD (“QENEX”) is the controller for QENEX Agent. This policy covers the Vercel integration at qenex.dev and supplements the company Privacy Policy. Data protection enquiries: privacy@qenex.ai. ICO registration ZC051598.

Data we process

• Vercel OAuth and SSO: user id, name, email, avatar, team and installation ids.
• Session cookies issued by Better Auth (JWE, eight-hour expiry).
• Chat messages, tool calls, and tool results from agent sessions.
• Optional MCP integration settings: server URL, label, and encrypted auth secrets stored in httpOnly cookies (eight-hour expiry). Secrets are never sent to the model.
• Technical logs: IP address, user agent, and request timing.

Why we process it

We process this data to authenticate you, provide the agent, keep sessions durable, secure the service, and meet legal obligations. The lawful bases are contract (UK GDPR Art. 6(1)(b)) and legitimate interests in security (Art. 6(1)(f)).

Processors

Vercel hosts the app and handles OAuth/SSO. Model inference is sent to Cursor Ultra at ultra.qenex.ai. We do not sell personal data.

Retention and rights

Account and session data is kept while your installation is active, then for up to 30 days unless a longer legal retention applies. You may request access, rectification, erasure, restriction, portability, or objection by emailing privacy@qenex.ai. You may complain to the ICO.

Children

QENEX Agent is not directed at anyone under 18.