PRIVACY POLICY

1. DATA CONTROLLER

The controller of your personal data is:

No Data Protection Officer (DPO) appointed.Vervox’s core activities do not meet the criteria requiring the mandatory appointment of a DPO under GDPR article 37(1) (no public authority task, no large-scale regular and systematic monitoring, no large-scale processing of special categories). For any data protection question, please contact the email address above.

2. DATA COLLECTED

2.1 Data you provide to us

2.2 Data collected automatically

2.3 Payment and subscription data

Banking data (card number, CVV, expiry date) is collected and processed exclusively by Stripe. We never have access to your full banking data. We retain billing records (invoices, Stripe customer identifiers, transaction history) for ten (10) years as required by French tax and accounting law (Code de commerce art. L123-22 and CGI art. L102 B).

As part of the Vervox subscription model, we also process the following data:

• Subscribed Plan (Creator, Pro or Business) and periodicity (monthly or yearly);
• Subscription date, renewal date, subscription status (active, suspended, cancelled) and any benefit from the Founder Offer (article 7.1bis of the T&Cs);
• Number and identifiers of Profiles created within your Workspace;
• AI Credits consumed per Profile (Plan monthly allocation + any Top-ups), with timestamps per feature used;
• Top-ups purchased (amount, date, beneficiary Profile);
• Stripe Accounting Credits generated when a Profile is deleted on a pro-rata basis.

These data are processed on the basis of contract performance (art. 6.1.b GDPR) for billing and Service delivery, and legitimate interest(art. 6.1.f GDPR) for the detection of abusive or fraudulent use (abnormal Credit consumption, unauthorised multi-accounts, credential sharing). Credit consumption traces also serve as evidence in the event of a payment dispute, in accordance with article 7.13 of the T&Cs. Retention follows the billing data retention period (10 years).

2.4 YouTube / Google API Services data

If you choose to connect your YouTube channel to Vervox, we access the following data via YouTube API Services:

Sharing and transfer: your YouTube data is shared with no third party. It is used exclusively to operate the Service (interface display, publishing videos to your own channel). It is neither sold, rented nor transferred to third parties for advertising, profiling or any other purpose not described above.

Storage: YouTube access and refresh tokens are encrypted (AES-256-GCM) before storage in our database. Only the Service accesses these tokens to perform the actions you request.

Revocation: you can disconnect your YouTube channel at any time from the Privacy section of your account settings. Disconnection immediately removes stored tokens. You can also revoke Vervox’s access from your Google permissions management page.

Compliance: Vervox’s use of data received via Google APIs complies with the Google API Services User Data Policy, including Limited Use Requirements.

2.5 TikTok data

If you choose to connect your TikTok account to Vervox, we access the following data via the TikTok API:

Sharing and transfer: your TikTok data is shared with no third party. It is used exclusively to operate the Service. It is neither sold, rented nor transferred to third parties for advertising or any other purpose not described above.

Storage: TikTok access and refresh tokens are encrypted (AES-256-GCM) before storage. Your video statistics are stored in our database to enable progress tracking over time.

Revocation:you can disconnect your TikTok account at any time from the Privacy section of your account settings. Disconnection revokes the tokens and removes Vervox’s access to your TikTok data.

Switching TikTok account: when you replace the TikTok account linked to your Vervox profile with a different account, your previous data (videos, statistics, progression snapshots) is retained in archived form — it is no longer displayed in your dashboard, but remains stored in our database for two purposes: (i) automatic restoration if you reconnect that same TikTok account later; (ii) aggregated and anonymized analysis to improve our recommendation and virality-prediction models. This retention relies on the legitimate-interest legal basis (GDPR art. 6(1)(f)). You can request permanent deletion of this archived data at any time via the “Erase my data” button in your account settings (Privacy section) or by writing to contact@vervox.app.

2.6 Competitor account public data

When you run a competitor analysis on a TikTok account that is not yours, Vervox processes only publicly available datafrom that account (public profile, public video metrics). We do not collect private or non-public data. The third-party creator’s data is processed on the legal basis of our legitimate interest in providing competitive benchmarking (GDPR art. 6(1)(f)), is not retained beyond the analysis, and is not used for direct marketing or profiling of those third parties.

2.7 Email correspondence with support

When you write to contact@vervox.app (before or after registration), we collect and store:

• your sender email address and display name (if present in the From header)
• the message subject, text body, HTML body, and any attachments
• technical headers needed for threading (Message-ID, In-Reply-To, References)
• the receipt timestamp

AI processing — Alice: every received email is analysed by our internal support tool (“Alice”). The subject and body of the message are transmitted to Anthropic (Claude Haiku) to (1) classify it automatically (category, sentiment, urgency, language, topics, short summary), and (2) on demand from the support team, draft a reply suggestion written in your language. If you write in a language other than French, the content may also be transmitted to Claude Sonnet solely to translate between your language and French, so that the (French-speaking) support team can review the suggestion before sending. Anthropic is bound by a DPA (GDPR art. 28(3)) and does not use your data to train its models.

Telegram conversational agent (founder-internal): to handle support on the go, the founder interacts with Alice via a private Telegram bot. During these conversations, the content of your email may be transmitted to Anthropic (Claude Haiku) so that Alice can reason and draft reply suggestions. Alice has manual curation tools (full-text email search by keyword, updating a thread's category / urgency / kind, archiving) which remain within the internal support scope — all these operations are audited in inbound_email_events. If the founder records their instructions by voice, the audio is transmitted to OpenAI (Whisper)for transcription before processing by Anthropic. The transcription contains the founder's instructions only (never your email content). No data about you is shared publicly; Telegram FZ-LLC only receives operational notifications already pseudonymised (sender hash, truncated subject, AI summary) — see section 5. The Telegram conversation is never read or used for marketing purposes.

Legal basis:performance of a contract (art. 6.1.b) when you are a registered User, otherwise legitimate interest in providing quality customer support (art. 6.1.f). You may object to Alice’s processing at any time by writing to the same address — your request will then be handled manually.

No automated decision-making in the sense of GDPR art. 22: Alice’s classification routes your message into our support queues; it produces no legal decision or similarly significant effect. The reply is always sent by a human (in this case the founder).

Retention: 24 months from receipt, then full erasure 6 months later (i.e. 30 months maximum). See section 6.

Pseudonymisation on account deletion: if you delete your Vervox account, your support emails are pseudonymised (your email address + name replaced by a hashed identifier, content replaced by an erasure marker) rather than hard-deleted. This preserves the coherence of conversation threads in which you may have participated with other users while retaining no information identifying you.

2.8 Mandatory or optional nature

The data marked as mandatory at registration (email, password or Google login) is necessary to perform the contract. Without it, you cannot create an account or access the Service.

Profiling data (niche, TikTok handle, preferences) is optional but improves the relevance of generated content. Analytics cookies are optional and subject to your consent.

3. COOKIES AND TRACKERS

3.1 Strictly necessary cookies

The Service uses an authentication session cookie (authjs.session-token) essential to its operation, as well as an attribution cookie (__vx_utm, duration: 1 hour) allowing us to link your registration to its acquisition source. These cookies do not require your consent.

3.2 Analytics cookies

With your consent, we use PostHog to analyse Service usage (pages visited, clicks, user journey). PostHog may also record browsing sessions (with inputs masked) in order to improve user experience. When you are logged in, your analytics data may be associated with your account (email, name, plan) to personalise our product tracking.

3.3 Audience measurement (Vercel Analytics)

We use Vercel Analytics to measure Site performance and traffic. This service collects aggregated and anonymised data (pages visited, visit duration, country of origin) without using cookies and without collecting identifying personal data. In line with guidance from data protection authorities (notably the French CNIL), this tracker does not require prior consent.

3.4 Monitoring cookies

Sentry collects technical information in the event of an error (stack traces, browsing context) to maintain Service stability. In case of an error, a session recording may be captured to facilitate diagnosis.

3.5 Server-side product event tracking

Certain events related to Service operation (registration, email verification, onboarding, payment, cancellation) are logged server-side via PostHog on the legal basis of legitimate interest (GDPR art. 6.1.f). These events do not depend on cookies and serve exclusively to improve the user journey and ensure proper Service operation.

3.6 Managing your preferences

You can accept or refuse non-essential cookies via the consent banner shown on your first visit. You can change your preferences at any time from the Privacy section of your account settings. Your choice is kept for six (6) months, after which the banner will be presented to you again.

4. PURPOSES AND LEGAL BASES

For Brazilian residents, legal bases under LGPD art. 7 follow the same mapping (contract performance, legitimate interest, consent, and compliance with legal obligation).

5. SUB-PROCESSORS AND INTERNATIONAL TRANSFERS

Your data may be transmitted to the following sub-processors, each bound by a Data Processing Agreement (DPA) signed in accordance with GDPR art. 28(3):

Transfers to the United States are governed by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for DPF-certified sub-processors, and by the European Commission’s Standard Contractual Clauses (SCCs) (implementing decision 2021/914) as a layered safeguard in all cases.

For UK residents, transfers are governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.

You can obtain a copy of the applicable safeguards (SCCs, DPAs) by writing to contact@vervox.app.

6. RETENTION PERIODS

Upon account deletion, all your personal data and generated content are removed from our database, except for billing records which we are required to retain for 10 years under French tax and accounting law. Data held by our sub-processors is deleted according to their own retention policies.

Special case for support emails: emails you sent to contact@vervox.app are pseudonymised on account deletion (your address + name replaced by a hashed identifier, content replaced by an erasure marker) rather than hard-deleted, in order to preserve the coherence of any conversation threads you may have participated in with other users. No information directly identifying you remains after pseudonymisation. Definitive erasure occurs at the latest at the end of the retention period above (30 months from message receipt).

7. SECURITY AND BREACH NOTIFICATION

7.1 Security measures

• Encryption of data in transit (HTTPS/TLS)
• Password hashing (bcrypt)
• OAuth token encryption (AES-256-GCM at rest)
• Principle of least privilege for sub-processor access
• Regular software dependency updates and vulnerability scanning
• Error monitoring (Sentry) for anomaly detection
• Restricted administrative access

7.2 Personal data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, Vervox will notify the competent supervisory authority (CNIL for France) within 72 hours of becoming aware of the breach, as required by GDPR art. 33.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR art. 34 (and equivalent provisions of UK GDPR, CCPA §1798.82 and LGPD art. 48).

8. AUTOMATED DECISION-MAKING AND PROFILING

The Service uses artificial intelligence to generate content suggestions (scripts, ideas, carousel text) based on your profiling inputs. These AI-generated suggestions are not automated decisions producing legal effects or similarly significantly affecting you within the meaning of GDPR art. 22. They are suggestions you may freely accept, modify or reject.

You may disable the AI profiling at any time via the “AI Profiling” toggle in the Privacy section of your account settings.

9. CHILDREN’S PRIVACY

The Service is intended for Users aged 16 and over. We do not knowingly collect personal data from individuals under 16, regardless of whether local law permits lower ages (e.g., 13 in the United Kingdom, 14 in Spain or Italy, 15 in France, 16 in Germany).

For United States residents, we comply with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501-6506): we do not knowingly collect personal information from children under 13, and our age threshold of 16 is stricter than COPPA’s.

If you are a parent or guardian and believe your child has provided personal data to Vervox, please contact contact@vervox.app for immediate deletion.

10. YOUR RIGHTS (EU GDPR / UK GDPR)

Under the EU GDPR and UK GDPR, you have the following rights:

• Access (art. 15): obtain a copy of your data
• Rectification (art. 16): correct inaccurate data
• Erasure (art. 17): request deletion of your data
• Restriction (art. 18): temporarily restrict processing
• Portability (art. 20): receive your data in a structured, machine-readable format
• Objection (art. 21): object to processing based on legitimate interest
• Withdrawal of consent (art. 7(3)): withdraw consent at any time for processing based on it, without affecting the lawfulness of prior processing
• Not to be subject to automated decisions (art. 22): see section 8 — we do not make such decisions

10.1 How to exercise your rights — self-service

If you have a Vervox account, most rights are directly accessible from the Privacy section of your account settings:

• Access & Portability — “Export my data” button (structured JSON format)
• Erasure — “Delete my account” in the Danger Zone (cascading deletion of all data, Stripe customer and third-party tokens)
• Rectification — Edit your profile fields directly
• Withdrawal of consent — “AI Profiling” and “Analytics cookies” toggles
• Third-party access revocation — Disconnect TikTok / YouTube buttons

10.2 How to exercise your rights — by email

If you do not have a Vervox account but we process your data (e.g., your public content was analysed by a Vervox user), or for requests not self-serviceable (restriction of processing, data in a specific non-JSON format), email contact@vervox.app. We respond within 30 days as required by GDPR art. 12(3), extendable by two months for complex requests. We may verify your identity before responding.

10.3 Right to lodge a complaint

You have the right to lodge a complaint with your local supervisory authority:

• France — CNIL: www.cnil.fr
• United Kingdom — ICO: ico.org.uk
• Germany — BfDI: www.bfdi.bund.de
• Italy — Garante per la protezione dei dati personali: www.garanteprivacy.it
• Spain — AEPD: www.aepd.es
• Other EU/EEA countries: your national supervisory authority

10.4 Proof of acceptance of the Terms

Acceptance of the Terms of Sale, the Terms of Service, and this Privacy Policy is materialised by the creation of your Vervox account. The exact date and time of your registration are automatically recorded in our systems at the moment of account creation and constitute formal proof of your acceptance pursuant to Article 6(1)(b) GDPR (legal basis: performance of a contract).

This information can be obtained on simple request to contact@vervox.app, as part of the right of access provided by Article 15 GDPR.

11. CALIFORNIA RESIDENTS — VOLUNTARY PRIVACY RIGHTS

Vervox does not currently meet the statutory thresholds under California Civil Code §1798.140(d) to qualify as a “business” subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We voluntarily honour the following CCPA-style rights for California residents.

11.1 Rights granted

• Right to know what personal information we collect
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — Vervox does not sell your personal information and does not share it for cross-context behavioural advertising
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right
• Right to non-discrimination — we do not discriminate against California residents solely for exercising their CCPA rights, in compliance with Cal. Civ. Code §1798.125

11.2 How to exercise

If you have a Vervox account, most rights are self-service via the Privacy section of your account settings (see section 10.1).

For requests not self-serviceable, or if you don’t have an account but we process your data as a California resident, email contact@vervox.app with the subject “California Privacy Request”. We respond within 45 days, extendable once by 45 additional days if necessary. We may verify your identity before responding. You may also contact the California Attorney General at oag.ca.gov/privacy/ccpa.

12. BRAZILIAN RESIDENTS — LGPD

Under the Brazilian General Data Protection Law (Lei 13,709/2018, LGPD), and consistent with our GDPR practices, Brazilian residents have rights including access, correction, anonymisation/blocking/deletion, portability, information about sharing, and withdrawal of consent (LGPD art. 18).

If you have a Vervox account, these rights are self-service via the Privacy section of your account settings (see section 10.1). For requests not self-serviceable, email contact@vervox.app with the subject “LGPD Request”. We respond within 15 days as required by LGPD art. 19.

Encarregado (DPO) — exemption: Vervox qualifies as a small-scale processing agent under ANPD Resolution CD/ANPD 2/2022 and is exempt from the mandatory appointment of an Encarregado. For data protection questions, please use the contact email above.

You may also contact the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd.

13. MODIFICATION OF THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes to our processing, our sub-processors, the applicable legal framework, or to clarify provisions.

13.1 Substantial modifications

Modifications are considered substantial when they have a direct and significant effect of:

• adding a new category of personal data collected;
• adding a new sub-processor;
• extending existing retention periods;
• modifying the legal bases under article 6 GDPR;
• introducing an international transfer to a country without an adequacy decision;
• reducing the rights you have under GDPR.

Such modifications will be notified to you by email prior to their entry into force, within a reasonable timeframe adapted to the nature of the modification, and in any event at least fifteen (15) days. You may oppose them by exercising the rights provided in section 10.

13.2 Other modifications

Modifications not falling under section 13.1 (notably drafting corrections, clarifications, descriptive updates related to the evolution of the Service, operational or technical adjustments without impact on the processing of your data) may enter into force immediately and will be published on this page with an updated “Last updated” date.

13.3 Acceptance

Continued use of the Service beyond the effective date of a modification constitutes acceptance. Failing opposition expressed by email to contact@vervox.app before that date, you are deemed to have accepted the new conditions.

14. GOVERNING LAW AND LANGUAGE

This Privacy Policy is governed by French law, without prejudice to the mandatory local protections that apply to you based on your country of residence (EU GDPR, UK GDPR, CCPA/CPRA, LGPD, and any other applicable law).

In case of discrepancy between the English and French versions, the French version (“Politique de Confidentialité”) prevails as the authoritative text.

15. CONTACT

For any question:

Email: contact@vervox.app