Privacy Policy
Effective: 2026-09-29 · This policy mirrors our internal Record of Processing Activities (GDPR Art. 30).
Vouli IQ is operated by Vouli IQ Technologies Private Limited (India). For customer personal data processed on behalf of a customer, Vouli IQ acts as a processor and the customer is the controller; for our own account, billing and security data, and for enquiries and chats on our website, we act as a controller.
What we collect
- Account & identity (name, work email, role) provided at sign-up via our authentication provider.
- Organisation profile and assessment content you enter, and the AI-generated outputs we produce for you.
- Billing contact and subscription records (card data is handled by our payment provider; we never store it).
- Standard server logs and error traces (with PII masked at source) for security, audit and reliability.
- If you contact us through our website: your name, work email, organisation and message, so we can reply.
- Messages you type into the chat assistant on our website are sent to our AI provider to answer you. We do not store the chat unless you ask us to follow up and send it with your enquiry.
Lawful bases
We rely on the following GDPR Art. 6 lawful bases, by purpose:
- Consent (GDPR Art. 6(1)(a)): Product usage analytics; Product analytics; Internal AI quality improvement; Anonymous peer benchmarking; Product & marketing communications.
- Performance of a contract (GDPR Art. 6(1)(b)): Account & identity management; AI maturity assessments & strategy content; Billing & subscription management; Transactional & notification email; Essential service processing.
- Legal obligation (GDPR Art. 6(1)(c)): Billing & subscription management; Security & audit logging.
- Legitimate interests (GDPR Art. 6(1)(f)): Error & performance monitoring; Security & audit logging; Website enquiries, demo and report requests; Website chat assistant (Ask Vouli); Public API request logging.
How we process data (Record of Processing Activities)
| Activity | Lawful basis | Recipients | Retention |
|---|---|---|---|
| Account & identity management | Performance of a contract (Art. 6(1)(b)) | Authentication provider (Clerk); Hosting provider (Vercel) | Life of the subscription; deleted within 30 days of erasure request or account closure. |
| AI maturity assessments & strategy content | Performance of a contract (Art. 6(1)(b)) | Hosting provider (Vercel); Database (Supabase); LLM providers under no-train terms | Life of the subscription; included in export and erasure. |
| Product usage analytics | Consent (Art. 6(1)(a)) | Product analytics provider (PostHog) | Rolling 12 months, then aggregated. |
| Error & performance monitoring | Legitimate interests (Art. 6(1)(f)) — service security & reliability. | Error monitoring provider (Sentry) | 90 days. |
| Billing & subscription management | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). | Payment provider (Dodo Payments, merchant of record) | As required by tax and accounting law (typically 6–7 years). |
| Transactional & notification email | Performance of a contract (Art. 6(1)(b)). | Email provider (Resend) | Delivery logs retained 30 days. |
| Security & audit logging | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). | Internal only | Minimum 1 year; hash-chained for integrity. |
| Website enquiries, demo and report requests | Legitimate interests (Art. 6(1)(f)) — answering a request the person made. | Database (Supabase); Email provider (Resend); Bot protection provider (Cloudflare), only when bot protection is enabled; Our team’s messaging and CRM tools, where connected: Slack, Microsoft Teams, Discord, Google Chat or Zapier | Kept while we follow up on the enquiry; deleted on request to privacy@vouliiq.com. No automatic deletion schedule applies yet. |
| Website chat assistant (Ask Vouli) | Legitimate interests (Art. 6(1)(f)) — answering a question the visitor chose to ask. | LLM provider (Anthropic) under no-training terms; Hosting provider (Vercel) | We do not store the chat. It is kept only if the visitor asks us to follow up and sends it with the enquiry (see Website enquiries). |
| Public API request logging | Legitimate interests (Art. 6(1)(f)) — service security & reliability. | Internal only | 90 days, then deleted automatically; only daily totals without personal data are kept after that. |
Our current sub-processors (hosting, authentication, database, email, error monitoring, product analytics, LLM providers under no-training terms, and our payment merchant of record) are listed at /legal/subprocessors. We notify customers before engaging a new one.
Your rights
Subject to applicable law (GDPR / UK GDPR / India DPDP), you may request access, rectification, erasure, portability (machine-readable export), restriction, and objection, and may withdraw consent at any time. Erasure and export are available in-product under Data Protection; an erasure request schedules deletion and is executed (cascade delete across our systems) within 30 days. Consent toggles take effect immediately.
International transfers
Where personal data leaves the EEA/UK (e.g. LLM inference, certain sub-processors), transfers are made under the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, with a transfer-impact assessment on file. LLM providers operate under no-training contractual terms.
Data residency
All customer data is stored today in AWS ap-northeast-1 (Tokyo, Japan) via Supabase. Dedicated EU (eu-central-1) and India (ap-south-1) residency cells are on the Enterprise roadmap and are offered only once a cell is live; until then, all customer data is held in the Tokyo cell.
Contact & representatives
Privacy enquiries and data-subject requests: privacy@vouliiq.com. Controller: Vouli IQ Technologies Private Limited, India. An India DPDP Grievance Officer and, where required for EU/UK data subjects, a GDPR Art. 27 / UK representative are contactable via the same address.