Privacy policy

The controller for Voicedot account, website, billing, support, security and marketing data is Good Sheet Sp. z o.o.

For privacy questions, deletion requests or account-specific requests, use the support route. If a different request route is shown inside your Voicedot workspace, use that route for workspace-specific requests.

Good Sheet Sp. z o.o.
Krępicka 1/6, Wrocław, Poland
KRS: 0000510335
District Court Wrocław-Fabryczna, VI Commercial Division of the National Court Register
NIP: 6793100885
REGON: 123126326

Good Sheet acts as controller when it decides why and how data is processed for the Voicedot website, customer accounts, billing, product analytics, security, support, onboarding, marketing and legal administration.

When a customer installs the Voicedot widget on their own website, the customer normally acts as controller because they decide why visitor feedback is collected and how it will be used. Voicedot acts as processor and processes visitor messages on the customer’s behalf to provide the service.

The data depends on whether someone visits Voicedot, uses an account or sends a widget message.

Voicedot website visitors

• IP address or shortened network identifiers.
• Browser, device and operating-system information.
• Pages viewed, referral source and timestamps.
• Cookie or consent preferences.
• Information submitted through forms or support requests.

Customers and workspace users

• Name and email address.
• Account login or magic-link information.
• Workspace, project and domain information.
• Widget configuration and product settings.
• Team invitations and membership information.
• Billing plan, subscription status and Stripe billing identifiers.
• Support messages and attachments a customer chooses to send.
• Your time zone, reported by the browser after your first sign-in, so that emails arrive at a reasonable hour and the dates in them are in your time. We keep the first time zone reported and use it for emails only.
• Email settings, including an unsubscribe from activation emails.

Visitors using a widget

• Visitor or session identifier.
• Optional email address if provided.
• Voice audio when a visitor records a message.
• Generated transcript and final submitted text.
• Page URL, path, origin or title needed for context.
• Pin coordinates and minimized anchor metadata.
• Widget version, rate-limit and submission-status metadata.

Emails from Voicedot

• A log of sent emails: which email, when, a hash of the recipient’s address, the account and project (when there are any) and the delivery status. The full address is not stored in the log.
• Clicks on buttons in activation emails: which button and when. Links in transactional emails and the new sign-in link in a reminder do not go through our redirect.
• Whether, after an activation email, the step it was about was taken, for example installing the widget: within 72 hours of a click in the email or, without a click, within 7 days of sending.
• We do not track opens: emails contain no tracking pixels or images.

Service delivery

Voicedot operates accounts, workspaces, widget configuration, message capture, transcription, inbox, routing and billing. The legal basis is contract performance or steps taken before entering into a contract.

Emails

Transactional emails are part of the service and arrive as long as you use it. For the account owner, the legal basis for sending them is the performance of the contract. We send a team invitation and the instructions for a developer at the customer’s request, in the customer’s and our legitimate interest. We send the team’s reply to the author of a comment on behalf of the customer, who is the controller of that conversation.

• A sign-in link.
• A confirmation of a sign-up requested by an AI agent.
• A team invitation.
• Instructions and updates about installing the widget.
• Notifications about new comments, according to the settings in the dashboard.
• The team’s reply to the author of a comment.
• Information about the trial and payments.

Activation emails are reminders and tips that help you get Voicedot running, for example when an account has no working widget yet, or when the widget works but no comment from someone else has arrived yet. If you request a sign-in link during onboarding and do not open it, we may send one email with a new link about a day later. We send activation emails without separate marketing consent, on the basis of our legitimate interest in helping you use the service you signed up for. They arrive on a working day, at a similar time of day as your sign-up, or in the morning if you signed up in the evening or at night. They never arrive more often than every two days. Each has a footer saying why it arrives and a link to a page where you unsubscribe with one button. Replies go to Piotr Synowiec, the founder of Voicedot, and for emails to people invited to a team, to our support.

Clicks in activation emails, and whether a step followed them, help us judge which emails help. The legal basis is our legitimate interest in improving the service.

Customer-controlled visitor messages

Visitor message data is processed under the customer’s documented instructions and, where applicable, the Data Processing Addendum. The customer is normally responsible for choosing the lawful basis for collecting the visitor message.

Security, support and operations

Logs, rate-limit data, technical metadata and security events are used to prevent abuse, diagnose errors and protect accounts. Support history and workspace context are used to answer questions and troubleshoot issues.

Billing, law and product improvement

Billing and accounting data is used to administer subscriptions and comply with tax or legal duties. Product analytics and aggregated usage patterns are used to improve the service. Where law requires consent for non-essential analytics or cookies, Voicedot relies on consent.

Where necessary and proportionate, Good Sheet processes limited account and benefit-use facts and documented abuse decisions to prevent deliberate account rotation, repeated trials and allowance circumvention and to review specific website restrictions. The basis is our legitimate interest in protecting the Service and its users, subject to your rights and reasonable expectations. A shared IP address, email alias, local hostname or hosting parent alone does not establish abuse. Restrictions for deliberate circumvention are subject to human review and a support route for correction or genuine ownership transfer; you may object to processing based on legitimate interests as described in Your rights.

The customer decides why feedback, questions or inquiries are collected, whether the widget asks for an email address, whether pinning is enabled, how the customer will respond and how the message will be used inside their own workflow.

Voicedot processes the message to provide the service. This may include receiving audio or text, creating a transcript, storing the final message, attaching page or pin context, delivering the conversation to the customer, applying categories or routing rules, preventing abuse and maintaining the service.

If the author of a comment left an email address, the team can reply by email. The author’s reply to such an email passes through our email provider and is added to the conversation in the dashboard.

If you have questions about why a specific website collected your message, contact that website owner first. If you need help identifying or deleting a message processed by Voicedot, use the support route with enough information to identify the message.

A visitor can record a message only after taking a deliberate action. Browser microphone permission is requested by the browser and recording should not start before that action.

When voice is used, Voicedot creates a transcript. A generated transcript may be reviewed or edited before submission where the widget flow supports this. The final submitted text is the owner-facing message in the conversation.

Do not include passwords, payment-card details, health information or other sensitive personal data in a Voicedot message unless the website owner has a separately appropriate process for receiving that information.

Pin context may include

Safe page path, relative position, viewport information and minimized anchor metadata.

Pin context is designed not to collect

• Password field values.
• Input, textarea or select values.
• Full page HTML.
• Arbitrary page text.
• Cookies or local-storage content.
• Full query strings or URL fragments unless required and safe.
• Payment-card details typed into the page.

Saved page view

When a visitor pins a note, the widget keeps a copy of the page view at that moment in the browser: layout, visible text, styles and scroll position, and, where this feature is enabled, images and fonts. The capture reaches Voicedot only together with the sent message; if the note is not sent, the capture is discarded. It is used to restore, on a frozen view, the place where the visitor left the note. It is separate from pin context and may contain text visible on the page.

Form field values, editable areas and elements the website owner marks as private are replaced with masking characters in the capture, first in the browser and again on the server. The widget itself, scripts and hidden form fields are not captured.

Hetzner hosts Voicedot’s app. Other flows include Cloudflare proxying, private R2 storage and encrypted backups, deployment through Appliku, AI processing, payments, outgoing email and, when configured, incoming replies. Activation or marketing messages depend on enabled communications. The alternative SES transport and operator alert channels operate only when configured.

Google sign-in, Cal.com bookings and feedback delivery to a selected Slack channel depend on user choice and configuration. The data scope and distinction between these services and infrastructure providers are described in the providers and subprocessors list. Applicable service terms and agreements determine legal roles and transfer arrangements.

If you authorize an external agent connection through MCP, the agent receives comments only from the projects chosen when connecting, to an extent that depends on the address mode. On a private address (such as localhost) it may receive the full context of a note or conversation: comments, team replies, internal notes and review-round comments, with the author’s role and time. On a team address (such as staging. or beta.) it receives only threads handed over from the inbox, as they were handed over, and on a public site only the team’s decision attached at handover and the spot on the page, without the content of the visitor’s messages. Author labels may contain partially masked email addresses; this masking does not make information anonymous. The agent does not receive recordings, the HTML of saved views or sign-in data. The agent is a separate service whose data-processing terms should be checked before granting access.

Personal data may also be disclosed where required by law, court order, supervisory authority request, legal claim or a transaction involving Voicedot, subject to applicable safeguards.

Some providers may process data outside the European Economic Area.

Where personal data is transferred internationally, Voicedot uses available safeguards such as European Commission Standard Contractual Clauses, provider data-processing terms, supplementary measures, EU-region configuration where available and other mechanisms recognized by applicable law.

Use the Subprocessors page for the most specific provider and region information.

Voicedot keeps data only as long as needed for the relevant purpose.

Account and workspace data

Data is retained while the account remains active. After account deletion, production data is deleted or deactivated according to the account-deletion process, subject to legal, billing, security and backup retention.

Unfinished accounts

We may delete an account that was never put to use. This applies only to an account where all of the following are true:

• No project has ever had an installed widget or a signal from a working widget.
• There is no comment from the widget (comments in a preview do not count).
• The account has never had a subscription or a payment and has not started a trial.
• No other people are in its projects, and the owner is not an active member of someone else’s project.

At the earliest on the 31st day after the first sign-in we send an email with the planned deletion date. We delete the account no sooner than 7 days after sending it, and only if the conditions are still met. The “Keep my account” button in that email pauses the deletion for 30 days. This email also arrives after an unsubscribe from activation emails, because it concerns the account. We also delete such an account sooner on request to support@voicedot.ai.

We delete the account and its projects together with their data. What remains is a record without the email address: a hash of the address (irreversible without our key), the former account number, who deleted it (you or the schedule), the date and the number of projects, plus entries in the email log detached from the account.

Emails

We keep the log of sent emails, email clicks and the records of deleted accounts for 24 months, then delete them. When we check new emails before sending them, we store the subject and content of the email that would have gone out; we delete this after 30 days. We keep an unsubscribe record (a hash of the address, its source and date) until you switch reminders back on yourself. Technical delivery receipts, without the email’s content, are deleted after 90 days.

Visitor conversations and final text

Conversations and final text remain available to the customer while the workspace is active. We delete them at the customer’s request sent to support@voicedot.ai or when applicable retention rules require deletion.

Audio recordings

People reviewing feedback cannot play back or download the original voice recording. Audio is processed to produce the transcript and kept in private storage for no longer than 30 days after upload to support investigation of abuse and security incidents. It is then deleted from Voicedot’s storage.

Logs, billing and backups

Logs and security records may be retained for abuse prevention, troubleshooting and legal purposes. Billing, invoice, tax and legal records may be retained as long as required by law. Deleted data may remain in encrypted backups until those backups are overwritten according to the backup schedule.

A snapshot preserves the page view associated with a feedback message. These saved page views are stored privately in Cloudflare R2 for 90 days from capture by default, and then removed. The account owner can choose 30 days, a year or two years instead. Written feedback and discussions are separate: deleting audio or a snapshot does not by itself delete the conversation.

Where a minimal abuse-prevention record is necessary, we may retain a pseudonymized identifier for the exact normalized account email and minimum consumed-benefit facts for up to 12 months after account deletion. For a documented public-website restriction, the minimum target, reason, decision date and expiry may be retained until the restriction ends, no later than 12 months from that decision. These records exclude visitor message bodies, raw audio, full transcripts, login credentials and full page captures; they do not preserve a deleted account as a usable account. Pseudonymization is not anonymization. Records are deleted when no longer necessary and by the applicable expiry; ordinary use does not automatically extend that expiry. Separate billing, legal and backup retention rules remain unchanged.

Voicedot may use essential cookies, local storage or similar technologies to keep users signed in, protect accounts, remember preferences, support the widget and operate the service. The widget remembers the email address you enter in this browser’s localStorage so you do not have to enter it again for the same project, website origin and session. The record is valid for 14 days after the address was last saved; after that, the widget removes it on its next read. Clearing the email field removes the remembered address.

For website, tutorial and app analytics we use Plausible, running on our own server. Plausible uses no cookies and stores no identifiers in the browser, so it counts all visits without separate consent. It derives a hash that is valid for one day from the IP address and browser details to count unique visits; the IP address itself is not stored. It records the page address without query parameters, device type, browser and operating system. We do not pass it the referring page. It also counts selected actions, such as going to sign-up or sign-in or the next step of a tutorial, without anything you type.

In the app, only on the sign-in and setup pages (app.voicedot.ai/login and /onboarding), we also use Microsoft Clarity, but only with your consent. Clarity shows us how these screens are used: it records clicks, taps, scrolling and pointer movement, the page layout with masked text and images, the page address and title, the previous page’s address, the device type, browser, operating system and screen size, technical data about how the page works (load times, script errors and connection type), and Microsoft derives the country from the IP address. All screen text and the values you type are masked in your browser before a recording leaves it, and Clarity receives no identifier or email address of yours. Clarity does not run on the voicedot.ai website, in the tutorials, in the dashboard, in the widget, on presentation pages or on pages opened from a link that contains a token.

Without consent the Clarity script does not load at all. After consent, Clarity sets the _clck cookie (Clarity’s identifier for this site) and the _clsk cookie (it joins page views into one recording), and Microsoft may set its own cookies on the clarity.ms domain; we do not turn on advertising cookies. We store your choice in the vd_consent cookie for 12 months. You can change or withdraw consent at any time through the “Cookie settings” link at the bottom of these pages; withdrawing removes the _clck and _clsk cookies.

Clarity is provided by Microsoft Ireland Operations Limited. Data is stored in the Microsoft Azure cloud and may be transferred to Microsoft Corporation in the United States under Standard Contractual Clauses. Recordings are kept for 30 days, and aggregated click data and labelled sessions for up to 9 months.

The Voicedot app also records events about how it is used in its own database, such as opening the widget, sending a message, completing onboarding steps or a recording error. These events do not contain message content, transcripts or email addresses. They are necessary to check that the app works and does not break on any screen. They are therefore part of operating the service and cannot be turned off.

Analytics and error monitoring should not include raw audio, full transcripts, visitor email addresses, sensitive page text, form values or raw pin selectors.

Voicedot uses technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse or alteration.

Measures may include encrypted network transport, private storage for audio objects, server-side provider credentials, workspace-scoped access controls, authentication and session controls, rate limiting, restricted administrative access, operational logging and minimized telemetry and pin data.

Privileged access should be limited to support, security, incident response, legal necessity or customer-authorized troubleshooting. No internet service can be guaranteed to be perfectly secure.

Depending on the situation and applicable law, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing based on legitimate interests, receive or transfer a copy of your data, withdraw consent where processing is based on consent and lodge a complaint with a supervisory authority.

In Poland, you may contact the President of the Personal Data Protection Office, UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw. Current UODO contact details.

If your request concerns a message submitted through a Voicedot widget on a customer website, Voicedot may direct you to that customer or need to verify the request with them, because the customer normally controls why that message was collected.

You can unsubscribe from activation emails at any time: with the button on the page the link in the email’s footer opens, or with your email program’s unsubscribe button. Merely opening the settings page changes nothing. After you unsubscribe, activation emails stop arriving at that address, with or without an account. Transactional emails still arrive, because they are part of the service, and the email about a planned account deletion arrives despite an unsubscribe, because it concerns the account.

To delete a message sent through the widget, write to support@voicedot.ai. If you gave an email address with the message, write from that address.

If the message was anonymous, give the details that identify the exact submission: the website, the approximate time, the page and the message details.

Without an email address or another reliable identifier, Voicedot may be unable to identify and delete a specific anonymous message.

Voicedot may use automated systems to transcribe audio, prepare text, categorize messages, suggest reusable replies, route messages, detect abuse, calculate usage limits and provide product analytics.

These processes help operate the service. They do not make decisions that produce legal or similarly significant effects about you.

Some data is required to use Voicedot. Account email is required to create or access a workspace, billing data is required for paid plans, domain or project information is required to install the widget and microphone access is required only if a visitor chooses to record a voice message.

Voicedot is not designed for children. Customers should not intentionally use Voicedot to collect personal data from children unless they have an appropriate legal basis, notice, consent process and configuration for that use case.

Voicedot may update this Privacy Policy when the product changes, providers change, legal requirements change or clarification is needed. The latest version will be available on this page.

TermsSubprocessorsDPASupport

For agent-assisted setup, we process the email address and website origin you provide, the registration request and setup identifiers, email-verification state, and a record of your explicit acceptance and separate identity-handoff choice. That acceptance record includes the Terms and Privacy Policy versions presented to you and its timestamp.

We send a verification email to the requested address. Email verification alone does not create a signed-in browser session. The agent can receive separate, limited installation authority; if you explicitly permit identity handoff, it can also obtain a private one-use sign-in link for you. The identity authorisation expires within sixty minutes of verification and is not extended by later use. The sign-in link expires within fifteen minutes and no later than that authorisation.

The browser removes the link credential from its visible URL before making page requests. Opening or reviewing the page does not consume the link or sign you in; deliberate protected form submission is required. Credential checks use hashes rather than storing the issued plaintext token, and credentials are excluded from ordinary diagnostic output. Share a handoff link only with the intended person; do not place it in public reports, code repositories or logs.

You can withdraw the setup authorisation. Expiry, withdrawal and changes to the bound email, owner, website or current setup are checked before authority is used. These setup permissions do not grant the agent access to visitor feedback or authorise feedback submission, purchases or paid renewal. The rest of this Privacy Policy applies to the underlying account, widget and feedback services.