Data Privacy Policy
McMillan Grubb Ltd (trading as Vextor®) · Last modified: September 2026
McMillan Grubb Limited (trading as Vextor®) understands that your privacy is important to you. This Privacy Policy explains what personal data we collect, why, and what your rights are — both if you're simply visiting our website, and if you're a customer using the Vextor Service. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.
1. Information About Us
Vextor® is operated by McMillan Grubb Limited, a company registered in Scotland under company number SC868764, registered office Eagle Labs Beco Building, 58 Kingston Street, Glasgow, United Kingdom, G5 8BP. Contact: [email protected].
2. What Does This Policy Cover?
This Privacy Policy applies to (a) anyone visiting our website at vextor.tech, and (b) anyone using the Vextor Service as a customer under our End User Licence Agreement (EULA). It should be read alongside our Cookie Policy, which covers cookies in more detail.
3. Your Rights
Under UK data protection law, you have the right to: be informed about our use of your data; access the data we hold about you; have inaccurate data corrected; ask us to delete your data; restrict or object to our processing; withdraw consent at any time; and request data portability. To exercise any of these rights, contact us at [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO).
4. Part A — If You're Just Visiting Our Website
4.1 What we collect
If you are simply browsing our public website without an Account, we collect very little about you:
| Data collected | How we collect it | Why |
|---|---|---|
| Technical data (IP address, browser type) | Automatically, via standard web server logs | Security and fraud prevention (legitimate interests) |
| Cookie data | See our Cookie Policy (Section 6, below) | See Section 6 |
4.2 Support enquiries
Our support form is only available to signed-in Vextor Pro customers, not to website visitors browsing without an Account — so if you're just visiting our website, you won't generate any support-enquiry data. If you do have an Account and use our support form, see Part B below for how that data is handled.
5. Part B — If You're a Vextor Customer
5.1 What we collect and hold
We connect to your accounting system via a read-only OAuth connection. We read your financial data to generate your dashboard. We do not store your underlying accounting transactions.
| Data we hold | Why |
|---|---|
| Account and contact details | To provide and manage your Account (performance of contract) |
| OAuth access tokens (revocable at any time from within your accounting system) | To maintain your accounting-system connection (performance of contract) |
| Your licence record and session data | To manage your subscription and keep you signed in (performance of contract) |
| Aggregated account-level GL data, your chart-of-accounts mapping, and your forecast assumptions | To generate and maintain your dashboard (performance of contract) |
| Your generated Vextor output (dashboard figures, AI narrative) | To provide the Service to you (performance of contract) |
| Support enquiries submitted via our in-app support form (Vextor Pro only) | To respond to your enquiry (legitimate interests / performance of contract) |
We do not store raw transaction-level or invoice-level detail — that data remains in your own accounting system. This data is stored in encrypted, isolated per-customer storage for the duration of your active Account.
5.2 Retention and deletion
If you disconnect your accounting system, cancel your subscription, or your Account is otherwise terminated, your customer data is automatically and permanently deleted within 30 days, unless you reconnect before the 30 days elapse.
6. Cookies
Our website uses a small number of cookies. Full detail is in our separate Cookie Policy; a summary is below.
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
| __vx_sid | First-party, essential | Session (deleted on browser close) | Keeps you signed in after you log in |
| vextor_cookie_consent | First-party, essential | 1 year | Remembers your cookie consent choice |
| Google Fonts (Google) | Third-party | No cookie set on our domain | Loads the fonts used on our site |
| ESG certificate badge (embedded widget) | Third-party | Uncertain — set by the third party | Displays our sustainability certificate |
| Stripe Checkout (Stripe) | Third-party | Session, on Stripe's own domain | Processes your subscription payment — governed by Stripe's own privacy policy |
We do not use any analytics, advertising, or tracking cookies. You can manage your cookie preferences at any time — see our Cookie Policy for details.
7. Who We Share Data With
We share payment data with Stripe (our payment processor) in order to process your subscription. We do not sell your data, and we do not share it with any advertising or analytics providers, because we do not use any.
8. Where Your Data Is Stored
Your data is stored on secure cloud infrastructure within the European Economic Area (EEA). Personal data can flow freely between the UK and the EEA under UK data protection law — no additional safeguards are required for this.
9. How to Complain
If you're unhappy with how we've handled your data, please contact us first at [email protected] so we can try to resolve it. You can also complain to the Information Commissioner's Office (ico.org.uk) at any time.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to active customers at least 30 days before they take effect.
Contact us
Data Protection Officer: Vextor® (McMillan Grubb Ltd)
[email protected]