Privacy Policy
Effective: 2026-06-01 · This policy mirrors our internal Record of Processing Activities (GDPR Art. 30).
Vouli IQ is operated by Vouli IQ Technologies Private Limited (India). For customer personal data processed on behalf of a customer, Vouli IQ acts as a processor and the customer is the controller; for our own account, billing and security data we act as a controller.
What we collect
- Account & identity (name, work email, role) provided at sign-up via our authentication provider.
- Organisation profile and assessment content you enter, and the AI-generated outputs we produce for you.
- Billing contact and subscription records (card data is handled by our payment provider; we never store it).
- Standard server logs and error traces (with PII masked at source) for security, audit and reliability.
Lawful bases
We rely on the following GDPR Art. 6 lawful bases, by purpose:
- Performance of a contract (GDPR Art. 6(1)(b))
- Consent (GDPR Art. 6(1)(a))
How we process data (Record of Processing Activities)
| Activity | Lawful basis | Recipients | Retention |
|---|---|---|---|
| Account & identity management | Performance of a contract (Art. 6(1)(b)) | Authentication provider (Clerk); Hosting provider (Vercel) | Life of the subscription; deleted within 30 days of erasure request or account closure. |
| AI maturity assessments & strategy content | Performance of a contract (Art. 6(1)(b)) | Hosting provider (Vercel); Database (Supabase); LLM providers under no-train terms | Life of the subscription; included in export and erasure. |
| Product usage analytics | Consent (Art. 6(1)(a)) | Product analytics provider (PostHog) | Rolling 12 months, then aggregated. |
| Error & performance monitoring | Legitimate interests (Art. 6(1)(f)) — service security & reliability. | Error monitoring provider (Sentry) | 90 days. |
| Billing & subscription management | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). | Payment provider (Lemon Squeezy, merchant of record) | As required by tax and accounting law (typically 6–7 years). |
| Transactional & notification email | Performance of a contract (Art. 6(1)(b)). | Email provider (Resend) | Delivery logs retained 30 days. |
| Security & audit logging | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). | Internal only | Minimum 1 year; hash-chained for integrity. |
Our current sub-processors (hosting, authentication, database, email, error monitoring, product analytics, LLM providers under no-training terms, and our payment merchant of record) are listed at /legal/subprocessors. We notify customers before engaging a new one.
Your rights
Subject to applicable law (GDPR / UK GDPR / India DPDP), you may request access, rectification, erasure, portability (machine-readable export), restriction, and objection, and may withdraw consent at any time. Erasure and export are available in-product under Data Protection; an erasure request schedules deletion and is executed (cascade delete across our systems) within 30 days. Consent toggles take effect immediately.
International transfers
Where personal data leaves the EEA/UK (e.g. LLM inference, certain sub-processors), transfers are made under the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, with a transfer-impact assessment on file. LLM providers operate under no-training contractual terms.
Data residency
All customer data is stored today in AWS ap-northeast-1 (Tokyo, Japan) via Supabase. Dedicated EU (eu-central-1) and India (ap-south-1) residency cells are on our roadmap and provisioned for Enterprise customers on request; until a customer’s dedicated cell is live, their data is held in the Tokyo cell.
Contact & representatives
Privacy enquiries and data-subject requests: privacy@vouliiq.com. Controller: Vouli IQ Technologies Private Limited, India. An India DPDP Grievance Officer and, where required for EU/UK data subjects, a GDPR Art. 27 / UK representative are contactable via the same address.