Privacy Policy

1. What data we collect

• Account data: name, email address, a hashed password, organization name and your role.
• Conversation and meeting data: transcripts, audio files you choose to upload, meeting metadata such as timestamps and participants, and the notes, action items and follow-up drafts generated from them.
• Employee record data: the profile and HR information your organisation has chosen to store in VooVr.
• Derived wellness signals: where your organisation uses them, VooVr derives wellness and attrition-risk signals from signals your organisation already holds — overtime hours, days absent, changes in performance rating, missed deadlines and engagement survey results — and, where conversation analysis is enabled, from the transcript itself. Each signal comes with the reasons behind it, so it stays explainable. Signals are suggestions for a person to review. VooVr does not make employment decisions from them.
• Security and audit data: sign-in times, actions taken inside the service, and the network information needed to keep sessions secure, including your IP address (used for approximate location in your security settings and sign-in alerts) and device or browser details.
• Communication data: verification codes, password-reset messages, reminders we send you, and any support correspondence with us.

We do not ask for sensitive personal categories — health, biometrics, or union membership — and we do not want them uploaded.

2. How we use it

• To provide the service: storing meeting and conversation records, turning speech into text, and generating summaries, action items and follow-up drafts.
• To authenticate users, enforce role-based access controls, and keep sessions secure.
• To send transactional messages you have asked for, such as verification codes and reminders.
• To meet legal obligations, including responding to data-subject requests and maintaining audit records.
• To investigate and respond to abuse of the service, and to fix defects you report to us.

We do not use your data to build advertising profiles, and we do not run third-party advertising or analytics trackers on our pages.

3. How we keep your data safe

In short: your personal details are locked, not just stored.

• Your name and email are encrypted. Someone looking at the raw database would see scrambled characters, not your details.
• Your password is never stored as-is. We keep only a one-way hash.
• Employee records get the same protection. Personal details in each profile are encrypted with their own key.
• Everything in transit is protected with TLS.
• Only the right people get in: role-based access, activity logs, and optional authenticator-app sign-in.

Encryption detail: AES-256-GCM, per-record keys wrapped with Google Cloud KMS. Application records are stored in MongoDB, and files on the service's own storage.

Meeting transcripts and audio files are protected by encrypted connections and strict access controls. They are not individually field-encrypted, and we'd rather tell you that plainly.

Access is limited to people who need it for their role, and sensitive actions inside the service are logged with who performed them and when. We review the list of sub-processors as part of our release process.

4. Who else receives your data

We do not sell personal data. We share only what each recipient needs to do its job, and only with providers processing data on our instructions.

• AI and speech providers — the transcript text of a conversation, or an audio file you submit, so the provider can return text, a summary or spoken audio. Ordinary analysis requests do not include names, email addresses, phone numbers, employee IDs, department labels, IP addresses or document contents.
• Transactional email — your email address and the content of the message.
• WhatsApp, if you use it — the phone number you provide and the content of the message.
• Infrastructure and encryption — our database and hosting providers, and Google Cloud KMS for key wrapping.
• Sign-in with Google, if you use it — the identifier, name and email address Google returns to us at sign-in.
• This website's fonts — the request your browser makes to the Google Fonts CDN.
• When compelled by law — we disclose the minimum necessary.

The current list, with exactly what each provider receives, is on our Sub-processors page. Some of those providers process data outside your country, including DeepSeek for conversation analysis; we keep the scope narrow so less data leaves your environment.

5. Cookies and local storage

We set one strictly necessary cookie: the session cookie that keeps you signed in and holds your CSRF token. It is HttpOnly, SameSite=Lax, and marked Secure when served over HTTPS. No advertising or analytics cookies are set. We also use your browser's local storage for preferences such as your theme, your language, and the fact that you dismissed the cookie notice — those stay on your device and are not sent to us.

Full details are in our Cookie Policy.

6. Your rights

You're in control of your data. Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your account and associated data.
• Portability — receive your data in a structured, machine-readable format.
• Object or restrict — object to processing, or ask us to limit how we use your data.
• Withdraw consent — where processing relies on consent, withdraw it.

Send requests to voovrhr@gmail.com. We will confirm your identity before acting, and we aim to respond within 30 days. Access and deletion are currently handled by our team on request rather than through a self-service button, so please allow a little time.

If you are in the EEA or UK and are unhappy with our response, you can complain to your local data protection authority.

7. Data retention

We're publishing this section as the system works today, including where we are still deciding.

• Retention period — we're still setting a fixed schedule. Until then, nothing is deleted automatically, and we delete your account and data whenever you ask.
• Deletion on request — we delete your account and associated data when you ask, other than records we are required to keep for legal reasons.
• Activity logs — still being confirmed.

We'll update this section, and the date at the top of the page, when the schedule is final.

8. Security and privacy changes

We may update this policy as the product changes. The “Last updated” date at the top of the page shows when it last changed, and material changes will be communicated through the application or by email.

9. Contact

Questions about this policy or about the data we hold, email voovrhr@gmail.com. You can also write to us about our sub-processors or our Terms of Service.