Privacy Policy

Last updated: 2026-04-30 · Version: 1.0.0

Effective date: 2026-04-30
Version: 1.0.0

This Privacy Policy explains how BCAX LLC ("we", "us", "Alex Spexx") collects, uses, shares, and protects personal data when you use alexspexx.com (the "Service"). It supplements our Terms of Use, Cookie Policy, and Affiliate Disclosure.

1. Who we are

The Service is operated by BCAX LLC, Wyoming, USA — see Legal Entity below.

2. What we collect

The Service is primarily a static editorial website. We collect:

We do not collect: payment data, biometric data, sensitive-category data, or third-party-platform OAuth tokens.

3. Why we collect (legal bases)

PurposeLegal basis
Send the newsletter to addresses that opted inConsent — GDPR Art. 6(1)(a)
Reply to your contact-form messageLegitimate interest — Art. 6(1)(f)
Operate the website (security, performance)Legitimate interest
Improve, secure, develop using de-identified aggregate dataLegitimate interest
Defend against claims, audits, regulatory inquiriesLegitimate interest + legal obligation
Successor-in-interest transferLegitimate interest
Comply with court orders / regulatory requestsLegal obligation

4. Sharing

Sub-processors

We use the following third-party service providers ("sub-processors") to operate the Service. Each sub-processor processes only the personal data needed for its specific purpose, under contractual data-protection commitments at least as protective as the GDPR (Art. 28) Standard Contractual Clauses where required.

Sub-processorFunctionPersonal dataRegionTransfer safeguard
Stripe, Inc.Payment processingBilling & transaction dataUSADPF-certified; SCCs
Mercury / Choice Financial GroupU.S. business bankingIdentity, KYC, transactionUSAMandatory contractual safeguards
Wise Payments LtdInternational transfersIdentity, transactionUK / BelgiumUK adequacy + SCCs
Supabase, Inc. (on AWS)Database, auth, storageAll categoriesUSA (us-east-1)DPF + SCCs
Anthropic, PBCAI processing (Claude)Prompts (no training; content-moderation only)USADPF + SCCs
OpenAI, L.L.C.AI processing (where used)Prompts (no training under API terms)USADPF + SCCs
Google LLC (Workspace, OAuth, Maps)Email, OAuth, geo dataOAuth tokens, Google account emailUSA / EUDPF + SCCs
Meta Platforms, Inc.OAuth (where used)Meta account dataUSADPF + SCCs
TikTok Pte Ltd / ByteDanceDirect-Post & developer APIs (where used)TikTok account dataSingapore / USASCCs
Resend, Inc.Transactional emailEmail addresses, message contentEU (Ireland)EU adequacy
Sinch (CLX Communications AB)Fax & SMSPhone, message contentEU (Sweden)EU adequacy
DocuSeal (self-hosted)E-signatureIdentity & signed documentsEU (Frankfurt VPS — Hostinger)EU hosting
Hostinger International LtdVPS hostingServer logsEU (Lithuania)EU adequacy
Contabo GmbHVPS hosting (browser-worker)Server logsEU (Germany)EU adequacy
Cloudflare, Inc.DNS, CDN, edge proxyIP, request metadataGlobal edgeDPF + SCCs
AdsPower (where used)Anti-detect browser profilesLimited (no PII forwarding)SingaporeSCCs
GitHub, Inc.Source-code hosting (no production user data)LimitedUSADPF + SCCs

We may add or replace sub-processors. Material additions are announced at least 30 days in advance, by updating this page and (where required) emailing account holders. Continued use after the effective date constitutes acceptance.

To object to a new sub-processor, email [email protected] within the notice period. Objection on reasonable data-protection grounds entitles you to terminate the affected service for a pro-rated refund of unused fees.

We do not sell personal data, run third-party retargeting, or share with data brokers.

5. International transfers

Same as Section 5 of the BCA Privacy Policy. We rely on the EU–U.S. Data Privacy Framework, SCCs (2021/914), and your explicit consent under GDPR Art. 49(1)(a) where required.

6. Retention

See Data Retention Policy. Headlines:

7. Security

TLS in transit; encryption at rest where applicable; least-privilege staff access. No system is 100% secure; you provide data at your own risk; breach notification per Art. 33 GDPR (72 hours) where applicable.

8. Your rights

Your Rights

If you are in the European Economic Area, United Kingdom, or Switzerland (GDPR / UK-GDPR)

You have the right to:

To exercise any of these rights, email [email protected] with the subject line DSR Request. We may need to verify your identity before responding.

If you are a California resident (CCPA / CPRA)

You have the right to:

We do not knowingly collect personal information from California consumers under 16 years of age.

To exercise these rights, email [email protected] or use the "Do Not Sell or Share My Personal Information" link in the site footer (where applicable).

If you are in another jurisdiction

We extend the substantive rights above to all users where reasonably possible, regardless of residence. Email [email protected] for assistance.

9. Children's data

The Service is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

10. Changes

Material changes are announced 30 days in advance to newsletter subscribers (where applicable) and posted with a new effective date.

11. Contact

Contacting BCA on legal matters

Type of inquirySubject lineAddress
General privacy / data-subject rightsDSR Request[email protected]
Refund requestRefund Request — [Engagement Reference][email protected]
Acceptable-use violation reportAUP Report[email protected]
DMCA takedown noticeDMCA — Takedown[email protected] (designated agent: see DMCA Policy)
DMCA counter-noticeDMCA — Counter-Notice[email protected]
Spam / abuse complaintSpam Complaint[email protected]
Law-enforcement / subpoenaLaw-Enforcement Request[email protected]
Sanctions / OFAC concernSanctions Disclosure[email protected]
Legal service of process(paper, certified mail)BCAX LLC, c/o Registered Agent, 30 N Gould St Ste R, Sheridan WY 82801, USA
Security vulnerabilitySecurity[email protected] (we follow coordinated disclosure; we do not pay bounties)

We acknowledge each request within 5 business days and substantively respond within the timelines required by applicable law (typically 30 days under GDPR, 45 days under CCPA, 14 days for DMCA).

Email is preferred. Mail and fax service of process is accepted but slower; electronic delivery to [email protected] is sufficient legal service of any pre-litigation notice required under these legal pages.

12. Legal Entity

Legal Entity

Alex Spexx is a service operated by:

BCAX LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States of America

Employer Identification Number (EIN): 42-2153191
State of formation: Wyoming, USA

This entity is the data controller and contracting party for all users of alexspexx.com.

Governing Law & Jurisdiction

These terms are governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-laws principles. The exclusive forum for any dispute shall be the state and federal courts located in Sheridan County, Wyoming, except where applicable consumer-protection law of your country of residence grants you a non-waivable right to a local forum.

Contact

Legal & data-protection inquiries: [email protected]

For data-subject-rights requests (access, deletion, portability, objection), use the same email with subject line DSR Request. We respond within 30 days as required under GDPR Article 12 and within 45 days under California CCPA §1798.130.