Privacy policy

The controller for Voicedot account, website, billing, support, security and marketing data is Good Sheet Sp. z o.o.

For privacy questions, deletion requests or account-specific requests, use the support route. If a different request route is shown inside your Voicedot workspace, use that route for workspace-specific requests.

Good Sheet Sp. z o.o.
Krępicka 1/6, Wrocław, Poland
KRS: 0000510335
District Court Wrocław-Fabryczna, VI Commercial Division of the National Court Register
NIP: 6793100885
REGON: 123126326

Good Sheet acts as controller when it decides why and how data is processed for the Voicedot website, customer accounts, billing, product analytics, security, support, onboarding, marketing and legal administration.

When a customer installs the Voicedot widget on their own website, the customer normally acts as controller because they decide why visitor feedback is collected and how it will be used. Voicedot acts as processor and processes visitor messages on the customer’s behalf to provide the service.

The data depends on whether someone visits Voicedot, uses an account or sends a widget message.

Voicedot website visitors

• IP address or shortened network identifiers.
• Browser, device and operating-system information.
• Pages viewed, referral source and timestamps.
• Cookie or consent preferences.
• Information submitted through forms or support requests.

Customers and workspace users

• Name and email address.
• Account login or magic-link information.
• Workspace, project and domain information.
• Widget configuration and product settings.
• Team invitations and membership information.
• Billing plan, subscription status and Stripe billing identifiers.
• Support messages and attachments a customer chooses to send.

Visitors using a widget

• Visitor or session identifier.
• Optional email address if provided.
• Voice audio when a visitor records a message.
• Generated transcript and final submitted text.
• Page URL, path, origin or title needed for context.
• Pin coordinates and minimized anchor metadata.
• Widget version, rate-limit and submission-status metadata.

Service delivery

Voicedot operates accounts, workspaces, widget configuration, message capture, transcription, inbox, routing and billing. The legal basis is contract performance or steps taken before entering into a contract.

Customer-controlled visitor messages

Visitor message data is processed under the customer’s documented instructions and, where applicable, the Data Processing Addendum. The customer is normally responsible for choosing the lawful basis for collecting the visitor message.

Security, support and operations

Logs, rate-limit data, technical metadata and security events are used to prevent abuse, diagnose errors and protect accounts. Support history and workspace context are used to answer questions and troubleshoot issues.

Billing, law and product improvement

Billing and accounting data is used to administer subscriptions and comply with tax or legal duties. Product analytics and aggregated usage patterns are used to improve the service. Where law requires consent for non-essential analytics or cookies, Voicedot relies on consent.

The customer decides why feedback, questions or inquiries are collected, whether the widget asks for an email address, whether pinning is enabled, how the customer will respond and how the message will be used inside their own workflow.

Voicedot processes the message to provide the service. This may include receiving audio or text, creating a transcript, storing the final message, attaching page or pin context, delivering the conversation to the customer, applying categories or routing rules, preventing abuse and maintaining the service.

If you have questions about why a specific website collected your message, contact that website owner first. If you need help identifying or deleting a message processed by Voicedot, use the support route with enough information to identify the message.

A visitor can record a message only after taking a deliberate action. Browser microphone permission is requested by the browser and recording should not start before that action.

When voice is used, Voicedot creates a transcript. A generated transcript may be reviewed or edited before submission where the widget flow supports this. The final submitted text is the owner-facing message in the conversation.

Do not include passwords, payment-card details, health information or other sensitive personal data in a Voicedot message unless the website owner has a separately appropriate process for receiving that information.

Pin context may include

Safe page path, relative position, viewport information and minimized anchor metadata.

Pin context is designed not to collect

• Password field values.
• Input, textarea or select values.
• Full page HTML.
• Arbitrary page text.
• Cookies or local-storage content.
• Full query strings or URL fragments unless required and safe.
• Payment-card details typed into the page.

Voicedot’s application hosting is provided by Hetzner in Nuremberg, Germany. We also use specialist providers for AI processing, storage, payments and transactional email. Their processing locations and transfer arrangements are described in the provider information and applicable agreements.

OpenAI may be used for transcription or AI-based content processing, and Stripe may be used for billing and payment processing. Other provider names, regions and transfer details should be read from the current Subprocessors page when verified.

Personal data may also be disclosed where required by law, court order, supervisory authority request, legal claim or a transaction involving Voicedot, subject to applicable safeguards.

Some providers may process data outside the European Economic Area.

Where personal data is transferred internationally, Voicedot uses available safeguards such as European Commission Standard Contractual Clauses, provider data-processing terms, supplementary measures, EU-region configuration where available and other mechanisms recognized by applicable law.

Use the Subprocessors page for the most specific provider and region information.

Voicedot keeps data only as long as needed for the relevant purpose.

Account and workspace data

Data is retained while the account remains active. After account deletion, production data is deleted or deactivated according to the account-deletion process, subject to legal, billing, security and backup retention.

Visitor conversations and final text

Conversations and final text remain available to the customer while the workspace is active. They are deleted when the customer deletes them or when applicable retention rules require deletion.

Audio recordings

People reviewing feedback cannot play back or download the original voice recording. Audio is processed to produce the transcript and kept in private storage for no longer than 30 days after upload to support investigation of abuse and security incidents. It is then deleted from Voicedot’s storage.

Logs, billing and backups

Logs and security records may be retained for abuse prevention, troubleshooting and legal purposes. Billing, invoice, tax and legal records may be retained as long as required by law. Deleted data may remain in encrypted backups until those backups are overwritten according to the backup schedule.

A snapshot preserves the page view associated with a feedback message. These saved page views are stored privately in Cloudflare R2 for up to 90 days from capture and then removed. Written feedback and discussions are separate: deleting audio or a snapshot does not by itself delete the conversation.

Voicedot may use essential cookies, local storage or similar technologies to keep users signed in, protect accounts, remember preferences, support the widget and operate the service.

Analytics is disabled in this preview. Optional session analytics requires separate consent before the tool is loaded.

Analytics and error monitoring should not include raw audio, full transcripts, visitor email addresses, sensitive page text, form values or raw pin selectors.

Voicedot uses technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse or alteration.

Measures may include encrypted network transport, private storage for audio objects, server-side provider credentials, workspace-scoped access controls, authentication and session controls, rate limiting, restricted administrative access, operational logging and minimized telemetry and pin data.

Privileged access should be limited to support, security, incident response, legal necessity or customer-authorized troubleshooting. No internet service can be guaranteed to be perfectly secure.

Depending on the situation and applicable law, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing based on legitimate interests, receive or transfer a copy of your data, withdraw consent where processing is based on consent and lodge a complaint with a supervisory authority.

In Poland, you may contact the President of the Personal Data Protection Office, UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw. Current UODO contact details.

If your request concerns a message submitted through a Voicedot widget on a customer website, Voicedot may direct you to that customer or need to verify the request with them, because the customer normally controls why that message was collected.

If you provided an email address with the message, use the confirmation or manage route provided with the message where available.

If you stayed anonymous, deletion may require a one-time receipt token or enough information to identify the exact submission, such as the website, approximate time, page and message details.

Without an email address, receipt token or other reliable identifier, Voicedot may be unable to identify and delete a specific anonymous message.

Voicedot may use automated systems to transcribe audio, prepare text, categorize messages, suggest reusable replies, route messages, detect abuse, calculate usage limits and provide product analytics.

These processes help operate the service. They do not make decisions that produce legal or similarly significant effects about you.

Some data is required to use Voicedot. Account email is required to create or access a workspace, billing data is required for paid plans, domain or project information is required to install the widget and microphone access is required only if a visitor chooses to record a voice message.

Voicedot is not designed for children. Customers should not intentionally use Voicedot to collect personal data from children unless they have an appropriate legal basis, notice, consent process and configuration for that use case.

Voicedot may update this Privacy Policy when the product changes, providers change, legal requirements change or clarification is needed. The latest version will be available on this page.

Terms · Subprocessors · DPA · Support