PRIVACY POLICY

Effective Date: July 30, 2026

This Privacy Policy is written in English, which is the official and authoritative version. Any translation is provided solely for your convenience. In the event of any conflict or inconsistency between the English version and a translation, the English version prevails.

1. Who We Are

Vellar is operated by Exponexa LLC ("Exponexa," "we," "us," or "our"), a Wyoming limited liability company (registration no. 2026-002001330), with its office at 7345 W Sand Lake Rd, STE 210 OFC 451, Orlando, FL 32819.

For all privacy questions, requests, or complaints — including requests directed to our Data Protection Officer for Brazilian users — contact us at support@vellarfunnels.com.

2. Scope of This Policy

This Policy describes how Exponexa collects, uses, and discloses personal information in connection with the Vellar platform (paid-traffic protection / anti-fraud tooling and the page builder). It applies to:

• Account owners — customers who sign up for Vellar to run and protect their own advertising campaigns; and
• Visitors to our own website and dashboard at vellarfunnels.com.

It does not directly govern how our customers collect or use data about visitors to the campaign pages they publish through Vellar — that relationship is described in Section 6 below and in our Terms of Service, where our customers act as the data controller/business for their own campaign traffic.

3. Information We Collect, Why, and On What Basis

3.1 Account Registration Data

• What: name, email address, phone number (including WhatsApp, where applicable), and password (stored as a one-way cryptographic hash — we never store or have access to your plaintext password).
• Google sign-in: if you choose "Continue with Google," we receive the profile information you authorize Google to share — your name, your email address (already verified by Google), and, where available, your profile photo. We never receive or store your Google password.
• Why: to create and maintain your account, authenticate your login, and communicate with you about the Service (support, billing notices, product changes).
• Legal basis: performance of a contract — this is the minimum data needed to provide the Service you signed up for.

3.2 Payment Data

• What: your subscription plan, billing status, and invoice history. Your card number is never transmitted to or stored on our servers — it is processed directly by Stripe, our payment subprocessor, which may separately collect your billing name and address under its own privacy policy.
• Why: to process your subscription, issue invoices, and meet tax and accounting obligations.
• Legal basis: performance of a contract; for tax recordkeeping, compliance with a legal obligation.

3.3 Usage and Security Data

• What: we log technical data to operate and protect the platform: your IP address, your browser's user agent, and the decision/reason recorded by our anti-fraud system. We never store your raw IP address. Instead, each event derives two separate values from it: (1) a masked IP address with the last portion of the address removed (for example, the final octet of an IPv4 address, or the last 80 bits of an IPv6 address), kept in readable form for basic troubleshooting; and (2) a one-way cryptographic hash (SHA-256) of the original IP address combined with a secret salt, used to detect abuse without keeping the address itself. The unmasked, unhashed IP address is discarded immediately after these two values are generated and is never written to our database.
• Why: to protect the platform against fraud, abuse, and unauthorized access, and to maintain an audit trail of account-relevant actions.
• Legal basis: legitimate interest — information security and fraud prevention, using the least intrusive form of the data reasonably necessary.

3.4 Traffic Data From Your Campaigns

If you use Vellar to publish pages and run paid traffic, the platform records technical telemetry about visits to your pages (country, device type, and the reason recorded by our protection system). With respect to this data, you — the Vellar customer — are the controller/business, and Exponexa acts only as a processor/service provider, processing this data on your instructions and to enable the Service you purchased. You are responsible for your own compliance with applicable data protection and privacy laws toward the visitors of your own pages.

3.5 Marketing Communications

If we send newsletters, product updates, or offers by email or Telegram, we do so only with your explicit opt-in consent, which you can withdraw at any time through the same channel or by contacting support@vellarfunnels.com.

4. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you specific rights over your personal information. We apply the practices described in this section as a matter of policy to all California residents who use the Service.

Categories of personal information we collect (as defined by the CCPA/CPRA), in the preceding twelve months:

We do not sell or share personal information, as those terms are defined under the CPRA (including for purposes of cross-context behavioral advertising). The service providers listed in Section 6 below process personal information under contract, on our behalf and for our business purposes only — they are not independent third parties that receive personal information for their own use.

Your rights:

• Right to Know — the specific pieces and categories of personal information we have collected, used, and disclosed about you.
• Right to Delete — request deletion of your personal information, subject to legal exceptions (for example, records we must keep for tax purposes).
• Right to Correct — request correction of inaccurate personal information.
• Right to Portability — receive a copy of your personal information in a portable format.
• Right to Opt Out of Sale/Sharing — not applicable today, since we do not sell or share personal information. If this ever changes, we will update this section and provide a "Do Not Sell or Share My Personal Information" mechanism before any such change takes effect.
• Right to Limit Use of Sensitive Personal Information — not applicable, since we do not collect sensitive personal information as defined above.
• Right to Non-Discrimination — we will not deny you the Service, charge you a different price, or provide a lower quality of service because you exercised any of these rights.
• Right to Appeal — if we deny your request in whole or in part, you may appeal by replying to our decision, or emailing support@vellarfunnels.com, within 30 days. We will complete our review of the appeal within 45 days of receipt.

How to exercise these rights: email support@vellarfunnels.com with your request. We will respond within 45 days of receipt; if we need more time, we will notify you and may extend that period by up to an additional 45 days.

Identity verification: to protect your information, we may ask you to confirm details associated with your account (such as your account email) before completing a request.

Authorized agents: you may designate an authorized agent to submit a request on your behalf. We may still require you to directly verify your own identity to protect against fraudulent requests.

5. Brazilian Users — LGPD

Exponexa LLC is the data controller, under Brazil's General Data Protection Law (Lei nº 13.709/2018, "LGPD"), for personal data of individuals located in Brazil processed in connection with the Service. The LGPD applies to this processing regardless of Exponexa's place of incorporation or the governing law of our Terms of Service — Brazilian data subjects retain the rights described in this section in full.

Data Protection Officer (Encarregado) contact: support@vellarfunnels.com.

Legal bases for the categories of data described in Section 3, under LGPD art. 7: - Account registration data — performance of a contract (art. 7, V). - Payment data — performance of a contract; for tax records, compliance with a legal obligation (art. 7, II). - Usage and security data — legitimate interest, information security and fraud prevention (art. 7, IX), always using the least intrusive representation of the data reasonably necessary (see Section 3.3). - Campaign traffic data — Exponexa acts as operator (operador); you, the Vellar customer, are the controller (controlador) and are responsible for your own LGPD compliance toward your visitors (Section 3.4). - Marketing communications — consent (art. 7, I), revocable at any time.

Your rights as a data subject, exercisable at any time by writing to support@vellarfunnels.com, with a response within 15 days: - Confirmation of processing and access to the data we hold about you; - Correction of incomplete or outdated data; - Deletion of your data, except where we must retain it under a legal obligation; - Portability of your data to another provider; - Revocation of consent, where consent is the legal basis; - Information about the third parties with whom we share your data.

Retention: - Account data: for as long as your account is active, plus 30 days after cancellation, unless a longer retention period is required by law. - Access/security logs (AccessLog): 90 days. - Billing and tax records: 5 years, in line with Brazilian tax law obligations for our Brazilian customers. - Audit trail: retained for as long as necessary to defend legal rights.

International data transfer: your data may be processed by subprocessors located outside Brazil, including in the United States. Where this occurs, we require that such processing follow adequate safeguards (contractual clauses and/or verification of the destination country's level of data protection), consistent with LGPD art. 33.

6. Who We Share Data With

We do not sell personal information. We share the minimum necessary with providers who help us operate the Service (subprocessors):

• Payment processing: Stripe
• Transactional email delivery: Resend
• Edge infrastructure, security, and content delivery (DNS, fraud/DDoS protection): Cloudflare
• Social sign-in ("Continue with Google"): Google LLC — only when you choose to sign in or sign up with Google; we receive the profile data you authorize to create or access your account
• Application hosting: Hostinger
• Database hosting: HostGator

Each provider processes data only to perform its specific function, under contractual confidentiality and security obligations. Within Vellar, our database is multi-tenant with logical segregation — a single database instance serves all Vellar customers, but each customer can only access their own data, never another customer's. The physical hosting infrastructure underlying that database runs on a server shared with an unrelated third-party operation, with isolation by dedicated container/process and no cross-access to data between the two operations.

7. Security

We use technical and organizational measures to protect your data: password hashing, IP masking and salted hashing before storage, access controls, and an audit trail. No system is completely immune to incidents — if one occurs, we will notify affected individuals and authorities as required by applicable law.

8. Minors

The Service is not directed to, and may not be used by, individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete that information as soon as reasonably possible.

9. Cookies

We use cookies — full details, including exact durations and categories, are in our Cookie Notice.

10. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by email or via a notice in the dashboard.

11. Contact

Questions, complaints, or requests to exercise your rights: support@vellarfunnels.com