Privacy Notice

Who we are

VoxUno is operated by Holden Labs LLC, the controller of the personal data this notice describes. In this notice, "we" and "us" mean Holden Labs LLC.

For anything about your personal data, email privacy@voxuno.ai.

This notice is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, and US state privacy laws such as the California Consumer Privacy Act (CCPA). It is also our notice at collection under the CCPA. We haven't appointed a representative in the EU or the UK, and we haven't appointed a data protection officer.

What we collect

From our customers

• Your account: your email address, your password (we store only a hash of it), whether you've verified your email address, and when you joined. If you sign in with Google, Google shares your email address and basic profile with us; we ask for nothing more.
• Your Projects: each Project's name and website; its Business Profile (a description, products and services, target customers, competitors, the problems it solves, and industry terms); its Monitors, Match terms, Excluded terms and Tags; its Followed Communities; its Results and whether each is saved or dismissed; its Digest settings; and its members, their roles, and the email addresses of people invited to it.
• Billing: Stripe handles payment, so your card details never reach us. We keep the Project's Stripe customer and subscription references, its Plan, and its subscription's status and dates.
• The trial record: to stop the free trial being used twice, we keep a digest (a one-way hash) of the email address and Google account that started a trial, never the address or account itself, together with the IP address it came from.
• Audit logs: a record of who did what in each Project, with the email address of whoever did it, and a record of each deleted Project (its name, its website, and the email address of whoever deleted it).
• Technical data: the app sets a cookie to keep you signed in and a cookie that protects its forms against forgery; both are needed for the app to work. Our servers keep logs of requests, and we receive error reports with email addresses, cookies and request contents removed.
• Emails you send us, for support or anything else: your email address and whatever you write.

Where it comes from. Most of it comes from you, and from what you and your Project's members do in the app. Google provides your email address and basic profile if you sign in with Google. Stripe tells us whether a Project's payments succeed and its subscription's status. If someone invites you to a Project, your email address comes from the Owner who invited you.

What you must give us. You need an email address to have an account, and a Project needs a website. Without them we can't provide VoxUno. To buy a Plan, you give your payment details to Stripe. Everything else is up to you.

From community authors

If you write in a public online community, VoxUno may collect your post, but only if it matches one of our customers' Monitors. VoxUno reads other posts to find the matches and discards them; they're never stored. For each matching post, we keep:

• its title, an excerpt around the match, and its full text where the platform gave it;
• your name or handle as the post shows it, and a link to your profile where the platform's licence requires credit (Stack Exchange);
• its link, whether it's a reply, and when it was posted and collected.

These come from publicly accessible sources: public posts on the communities VoxUno covers, listed on the Communities We Support page. VoxUno never collects anything behind a login. Each post is shown, as a Result, to the Projects whose Monitors matched it, and may appear in their daily Digest emails.

VoxUno doesn't build profiles of the people who write posts, doesn't link an author's posts across platforms, and infers nothing sensitive about them. Community posts are never sent to Anthropic, and never used to train or fine-tune any model.

VoxUno never posts or sends messages, so we don't contact authors one by one. We publish this notice so that authors can find out what we do.

From visitors to voxuno.ai

This site uses Cloudflare Web Analytics to count visits. It sets no cookies and stores nothing on your device, so the site has no cookie banner. Cloudflare, which hosts the site, receives each request your browser makes, including your IP address. The site has no forms. If you email us, we receive your email address and whatever you write.

Automated decisions

We make two kinds of decision about people by automated means, both at sign-up:

• Disposable email addresses. Sign-up, by email or with Google, refuses an address at a known disposable-email service. You can sign up with another address.
• The free trial. Whether a new Project can start a free trial: one per verified email address and Google account, and a few a day from one IP address. If it can't, you can still buy a Plan.

If we refuse a trial automatically (for example a disposable email address), you can ask us to review it at support@voxuno.ai, and a person on our team will.

We make no other automated decisions with legal or similar effects.

Why we use it, and the legal basis

Where we rely on legitimate interest for community authors' posts, we've weighed it against authors' interests: VoxUno keeps only public posts that match a Monitor, builds no profiles, and removes a post when asked. You have the right to object, as described below.

Who receives it

We use these providers (sub-processors) to run VoxUno. Each receives only what its job needs:

• DigitalOcean hosts the VoxUno app and its database, in the United States.

• Cloudflare hosts voxuno.ai, provides its cookieless analytics, and stores our off-site backups in Cloudflare R2. It also sits in front of the VoxUno app and our team's back-office:

  • Every request to the VoxUno app or the back-office passes through Cloudflare, which processes your IP address, your request's headers, and the content of the pages and forms it carries, sign-in included, to deliver it and to filter out attacks.
  • Cloudflare Access guards our team's back-office, and processes the email addresses of the members of our team who sign in to it.

  The app's data stays stored with DigitalOcean. Cloudflare keeps it only while it handles each request, and in its logs.

• Stripe takes payments and manages each Project's subscription.

• Postmark sends our emails: sign-in and invitation emails, and the daily Digest, which carries Results' titles and excerpts.

• Anthropic processes your website text and Business Profile to draft your Business Profile and make Community and Monitor suggestions, using its AI model, Claude. It also receives the public names and descriptions of Communities, and, when you ask for more suggestions, your Project's Match terms and the names of its Followed Communities. Anthropic handles this under its standard API data terms until zero data retention is granted. Anthropic never receives community posts.

• Sentry receives error reports, with email addresses, cookies and request contents removed.

• healthchecks.io receives signals from our scheduled jobs, so we know they ran.

• UptimeRobot checks from outside that the app and this site are up.

• Google provides "Sign in with Google".

The platforms VoxUno searches receive our customers' Match terms as search queries, in the same way as any search. Other members of a Project see that Project's data. Our team can see customer records to run VoxUno, and can open a Project read-only for support, as described below. We may also disclose personal data where the law requires it, or where we need to establish, exercise or defend legal claims.

If our business is sold. If Holden Labs LLC or VoxUno is involved in a merger, an acquisition, a sale of all or part of its assets, or a similar transaction, personal data may be passed to the buyer or successor as part of it. Before such a deal, it may also be shared with a prospective buyer and its advisers, under a duty of confidentiality, where they need it to evaluate the deal. This notice continues to apply to the data that's passed on, until it's changed as described under "Changes to this notice".

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We haven't done either in the last 12 months.

YouTube

VoxUno uses YouTube API Services to find public YouTube videos that match our customers' Monitors. What VoxUno keeps from YouTube is described above under community authors, and it's deleted after 30 days. Google's handling of data is described in the Google Privacy Policy.

Transfers

We're based in the United States, and the VoxUno app and its database are hosted there, so personal data from the EU and the UK is transferred to the United States. Some of the providers above may also process it in other countries. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and on Standard Contractual Clauses otherwise:

• EU-US Data Privacy Framework: the European Commission has decided that it gives adequate protection to personal data transferred to US organisations certified under it. For data from the UK, the UK Extension to it does the same under UK law.
• Standard Contractual Clauses: the European Commission's model contract clauses, with the UK's addendum to them for data from the UK.

To get a copy of the safeguards for a transfer, email privacy@voxuno.ai.

How long we keep it

• Projects and their Results are kept until an Owner deletes the Project. That includes a Project whose Subscription has ended: after its 30-day Grace period it stays read-only, with its Results, until it subscribes again or is deleted.
• Your account is kept until you delete it. Deleting it removes you from every Project, and deletes every Project you alone belong to.
• Community posts are kept while a Result in some Project refers to them, and are then deleted. Changes on the original site aren't copied: a post edited or deleted there stays as it was collected until it's removed here.
• Posts from YouTube are deleted after 30 days, with every Result on them.
• Backups keep deleted data for 30 days.
• The trial record is kept to prevent repeat trials, even after the account or Project is deleted.
• Audit logs and records of our team's access are kept permanently, including the record of deleted Projects.
• Billing records are kept for as long as tax and accounting law requires.
• Emails you send us are kept for as long as we need them to deal with what you wrote and any follow-up.
• Server logs are kept for about 14 days.
• Error reports, signals from our scheduled jobs, and Cloudflare's request logs are kept by those providers only for as long as their services keep them, as set out in their own terms.

Your rights and how to use them

Depending on where you live, you have the right to:

• access the personal data we hold about you, and get a copy;
• have it corrected if it's wrong;
• have it deleted;
• restrict how we use it;
• receive it in a portable format;
• object to our using it (see below);
• complain to a data protection authority, if you're in the EU or the UK: in the EU, the authority where you live or work, or where you think your rights were infringed; in the UK, the Information Commissioner's Office (ICO).

Under US state laws such as the CCPA, you also have the rights described in "Your US state privacy rights" below.

To use any of these rights, email privacy@voxuno.ai. We may need to check who you are before we act, and you can ask someone to act for you. We'll answer within the time the law sets: under the GDPR, one month, which can be extended in some cases.

Customers can also see and change most of their data in the app, delete a Project from its Company tab, and delete their account from Settings.

Your right to object

Where we rely on legitimate interest, including for community authors' posts, you have the right to object at any time to our using your personal data. Email privacy@voxuno.ai. To have a post removed, see "Removal of posts".

Data processing agreement

If you use VoxUno for a business and need a data processing agreement (DPA), one is available on request from privacy@voxuno.ai.

Your US state privacy rights

This section is for residents of California and of other US states with privacy laws. It uses the CCPA's terms.

What we collect. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes described in "What we collect" and "Why we use it, and the legal basis":

How long we keep each is in "How long we keep it".

No selling or sharing. We don't sell personal information, and we don't share it for cross-context behavioral advertising. We haven't done either in the last 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

Sensitive personal information. We use your account log-in only to sign you in and keep your account secure. We don't use or disclose sensitive personal information for any other purpose, so there's nothing for a right to limit its use to apply to.

Your rights. You have the right to:

• know what personal information we've collected about you, where it came from, why we use it, who we disclose it to, and the specific pieces we hold;
• have it deleted, subject to exceptions the law sets;
• have inaccurate personal information corrected;
• opt out of the sale or sharing of your personal information, which we don't do;
• limit the use of your sensitive personal information, which we use only as the law allows without that right;
• not be discriminated or retaliated against for using any of these rights.

Global Privacy Control. Because we don't sell or share personal information, an opt-out preference signal, such as Global Privacy Control, has nothing to switch off, on any device, browser or account. You don't need to send one, and it does no harm if your browser does.

How to make a request. Email privacy@voxuno.ai and say what you're asking for. We'll confirm we've received it within 10 business days, and answer within 45 days. If we need longer, we'll tell you why, and the law lets us take up to 45 days more.

How we check who you are. We compare what you tell us with what we already hold. For your account, we'll usually ask you to write from your account's email address, or to confirm that you control it. For community posts, we may ask for your name or handle on the platform and links to the posts. We use what you give us only to check who you are and answer your request.

Asking someone to act for you. An authorised agent can make a request for you by emailing privacy@voxuno.ai with your signed permission. We may still ask you to confirm your identity with us directly, or to confirm that you gave the agent permission.

Appeals. If we turn down your request, you can appeal by replying to our answer, or by emailing privacy@voxuno.ai with the subject "Appeal". We'll answer within the time your state's law sets. If we turn down your appeal, you can contact your state's attorney general.

Removal of posts

If VoxUno has collected a post you wrote, email privacy@voxuno.ai with a link to it. If you run the site, you can also email bot@voxuno.ai.

When we remove a post, we delete the Post and its Results, and nothing more: it disappears from every Project, saved Results included. We record the deletion, with the post's link, in our audit log. We keep no block list, so the post could be collected again if it matches a Monitor again. A site's owner can stop collection from the whole site through robots.txt, as the VoxUnoBot page explains.

Our team's support access

Our team signs in to VoxUno's back-office separately from customers, with two-factor authentication. To help a customer, a member of our team can open one Project as one of its members. That access is:

• read-only: nothing can be changed during it;
• given only with a stated reason, for support;
• limited to 30 minutes at a time;
• recorded in a log that can't be changed or deleted;
• visible to the Project's Owners, who see every such access on the Project's Members tab.

Children

VoxUno is for people aged 18 and over, and we don't knowingly let anyone younger have an account. If you think someone under 18 has an account, email privacy@voxuno.ai and we'll delete it. If a public post VoxUno collected was written by a child, a parent or guardian can ask us to remove it, as described above.

Changes to this notice

When we change this notice, we change the "Last updated" date at the top. If a change is material, we'll email the Owners of every Project before it takes effect.

Contact

• Personal data, your rights and post removal: privacy@voxuno.ai
• Site owners writing about VoxUnoBot: bot@voxuno.ai
• Anything else: support@voxuno.ai

Holden Labs LLC, 522 W Riverside Ave Ste N, Spokane, WA 99201, United States.