Privacy Policy

1. Data we collect

• Account: your name, email address and, if you sign in with Google, your Google account ID and profile picture. Passwords are handled by our authentication provider and never stored in plain text.
• Workspace content: brand name, website, competitors, prompts, and the results we generate for them.
• Free tools: the website or brand you enter into a free check or report.
• Google Search Console: if you connect it, the search query and page data Google provides for the sites you choose.
• Billing: Paddle handles payment. We receive your subscription status, plan, customer and transaction IDs, never your card details.
• Technical: IP address, browser and device information in server logs, and anonymous page-view statistics.

2. Why we use it

• To provide the Service: running your prompts against AI engines, showing results, sending alerts and the Monday digest (performance of a contract).
• To bill paid plans through Paddle (performance of a contract).
• To keep the Service secure and working, and to improve it (legitimate interests).
• To send product news, only if you opt in; you can unsubscribe at any time (consent).
• To meet legal and tax obligations (legal obligation).

3. Who processes it

We use these providers only as needed to run the Service:

• Vercel: website hosting and cookieless page-view analytics (USA).
• Supabase: database and authentication.
• GitHub: runs scheduled jobs that collect AI answers (USA).
• OpenRouter and the AI engines it routes to (such as OpenAI, Google, Anthropic, Perplexity): receive your prompts, brand and competitor names to generate answers. We don't send them your account details.
• Resend: sends alert and digest emails (USA).
• Paddle.com: payment processing and Merchant of Record (UK).
• Google: sign-in with Google and Search Console, if you use them (USA).

We do not sell personal data or use it for advertising.

4. International transfers

Some providers are outside the UK and EEA. Where they are, we rely on the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Account and workspace data: while your account is open, then deleted within 90 days of closure.
• Free reports: kept so their shareable link keeps working. Email us to have one deleted.
• Billing records: 7 years, for tax law.
• Server logs: up to 30 days.

6. Your rights

Under UK and EU GDPR you can ask to access, correct, delete, restrict or export your personal data, object to processing based on legitimate interests, and withdraw consent at any time. Email ananda@anovoxlabs.com; we reply within 30 days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

7. Cookies

We use only cookies needed to keep you signed in. Our analytics are cookieless, and we load no advertising or cross-site tracking scripts. Paddle sets its own cookies during checkout.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Each workspace's data is isolated by row-level security in the database, and access to production systems is restricted. More on our security page.

9. Children

Anovox is a business service and isn't directed at anyone under 18.

10. Changes

If we change this policy materially, we'll email account holders before the change takes effect and update the date above.

11. Contact

Email ananda@anovoxlabs.com.

Ascot Technology Limited (company no. 08966734, registered in England and Wales)
341 Rayners Lane, Pinner, HA5 5EN, United Kingdom