Privacy Policy

RexGen ("RexGen", "we", "us" or "our") operates rexgen.store, a digital marketplace and web-services platform. We respect your privacy and aim to collect only the information we genuinely need in order to run the platform and to respond to you.

This Privacy Policy applies to the website, your RexGen account, product requests, the AI Website Consultant, support conversations and the emails we send you about those activities. It should be read together with our Terms of Service.

We collect two kinds of information: information you give us directly, and a limited amount of technical information that is generated automatically when you use the platform. We do not ask for identity documents, and we do not collect special categories of personal data such as health or biometric information.

Depending on how you use the platform, this may include:

• Account details — your name, email address and, if you choose to add it, a phone number and profile picture. When you sign in with Google, we receive basic profile information from your Google account, such as your name, email address and profile image.
• Product requests — the products you request, together with the timestamps of the request and delivery so we can show you the status of your files.
• AI consultation briefs — the project description and any additional requirements you enter into the AI Website Consultant, together with the analysis, product recommendations and cost estimate generated in response.
• Support messages — the content of conversations you have with our support team through the in-app chat, and messages you send us by email.
• Correspondence — anything else you choose to send us, for example a question about a service or a project enquiry.

Please do not include confidential third-party information, passwords or access credentials in a consultation brief or support message.

When you use the platform, a limited amount of technical information is generated:

• Usage and request records — dates and times of account activity, product requests, file deliveries and how many times a download link has been used. This lets us show the correct status in your dashboard, support you if something goes wrong, and detect abuse.
• Availability status — if you use the support chat, we record whether you are currently online and when you were last seen, so the conversation can show whether someone is available.
• Technical data handled by our infrastructure — like any website, our hosting, database and security providers process information such as IP address, browser type and the pages requested, in server and application logs, in order to deliver the site, keep it secure and diagnose faults. We do not use this data to build advertising or marketing profiles about you.
• Analytics data — where analytics is enabled, aggregated information about how pages are used, as described in the sections on cookies and analytics below.

We use the information described above to:

• create and maintain your account and keep you signed in securely;
• process your product requests, prepare files and make download links available to you;
• run the AI Website Consultant — analysing your brief, producing recommendations and estimates, and keeping a record of the consultation in your dashboard;
• send transactional emails and notifications, such as request confirmations, "files are ready" messages and password reset emails;
• answer your support messages and project enquiries;
• operate, secure, troubleshoot and improve the platform, and prevent fraud and abuse; and
• meet our legal, accounting and record-keeping obligations.

We rely on the need to perform our agreement with you, our legitimate interest in operating and securing the platform, your consent where we ask for it, and our legal obligations — as those concepts apply under the privacy law relevant to you.

We do not currently run a marketing mailing list. If we introduce one, it will be opt-in and every message will include a way to unsubscribe.

Accounts and sign-in are handled by Supabase, our authentication and database provider. You can sign in with Google, or with an email address and password where that option is available to you.

Passwords are stored by the authentication provider in hashed form; RexGen staff cannot see your password. Password reset and account setup links are sent to your email address and are valid for a limited time only.

If you sign in with Google, Google confirms your identity to us and shares basic profile information. We do not receive your Google password, and Google’s own privacy policy governs how it handles your data.

Your session is maintained in your browser so that you stay signed in between visits. Signing out ends the session on that device.

We use cookies and similar browser storage for a small number of purposes:

• Essential — to keep you signed in, to secure the session and to make core features work. The site cannot function properly without these.
• Preferences — to remember choices such as your light or dark theme and your language, so the interface looks the same next time.
• Analytics — where analytics is enabled, to understand in aggregate which pages are visited and how the site performs.

You can delete or block cookies through your browser settings. If you block essential cookies or storage, signing in and other core features will not work.

We use a small set of established providers to run the platform. They process information on our instructions and for the purposes described here:

• Supabase — authentication, database and file storage for accounts, product requests, consultations and support messages.
• Google — sign-in through Google Identity Services and, where it is configured for the site, Google Tag Manager and the analytics tools loaded through it, which use cookies to measure aggregate site usage.
• Resend — delivery of transactional email such as request confirmations, delivery notifications and password resets.
• Groq — the model provider that performs the automated analysis behind the AI Website Consultant. Your project brief is sent for analysis and the result is returned to the platform.
• Hosting and content-delivery providers — serving the website and protecting it from attack.

Each provider handles data under its own privacy terms in addition to our instructions. This list may change as the platform evolves; we will update this page when it does.

We share personal information only in these situations:

• with the service providers listed above, so that they can perform their function for us;
• with members of our team who need access in order to prepare your files, answer your support message or work on your project;
• where we are required to do so by law, a court order or a valid request from a competent authority, or where it is necessary to establish, exercise or defend legal claims;
• to protect the rights, safety and property of RexGen, our users or the public, including to investigate fraud or abuse; and
• in connection with a merger, acquisition or transfer of the business, in which case we will take reasonable steps to make sure your information stays protected.

We do not sell your personal information, and we do not share it with third parties for their own independent marketing.

We keep information for as long as we need it for the purpose it was collected for. In practice:

• account and profile information is kept while your account is active;
• product requests, consultations and support conversations are kept as a record of the service we provided to you, so that we can help with follow-up questions and meet our record-keeping obligations;
• deleted messages and records may remain in our systems, and in routine backups, for a period after deletion before they are permanently removed; and
• aggregated or anonymised information that can no longer identify you may be kept for longer.

If you ask us to close your account, we will delete or anonymise your personal information unless we are required to keep some of it for legal, accounting or dispute-resolution reasons.

We take reasonable technical and organisational measures to protect personal information. These include encrypted connections (HTTPS) between your browser and our services, database access rules that restrict each account to its own records, administrative access limited to the people who need it, hashed password storage handled by our authentication provider, and download links that expire after a limited period.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password, keep your sign-in details private, and tell us promptly if you suspect your account has been compromised.

Subject to the privacy law that applies to you, you may have the right to:

• be informed about how your personal data is collected and used;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data where there is no overriding reason for us to keep it;
• request that we restrict or stop certain processing, or object to it;
• receive your data in a portable format where that right applies; and
• withdraw consent at any time where our processing is based on consent.

To exercise any of these rights, contact us at hello@rexgen.store. We may need to verify your identity before acting on a request, and we will respond within the period required by the applicable law. You can also update most of your profile details yourself from your dashboard.

If you are not satisfied with our response, you may raise the matter with the competent data protection authority in your jurisdiction.

RexGen operates from Saudi Arabia, but the providers listed above operate global infrastructure. This means your information may be stored or processed on servers located outside the Kingdom of Saudi Arabia, including in other regions where those providers or their sub-processors operate.

Where information is transferred internationally, we take reasonable steps to work with established providers that offer appropriate contractual and technical safeguards. If you would like to know more about where a particular category of data is processed, please contact us.

The platform is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Our website, product listings and articles may link to third-party sites, including vendor and documentation pages. Those sites are not operated by us and have their own privacy policies. We are not responsible for their content or their handling of your information, and we encourage you to read their policies before sharing anything with them.

We may update this policy as the platform changes or as legal requirements evolve. The "Last updated" date at the top of this page shows when the current version took effect, and previous versions are replaced by it.

Where a change materially affects how we handle your personal information, we will take reasonable steps to notify you in addition to updating this page.

For any question about this policy, or to make a privacy request, you can reach us at:

If you have an account, you can also start a support conversation once you are signed in.