Privacy Policy

1. Data we collect

• Account data: email address, password (stored as a hash by our authentication provider, never readable by us), first and last name, username, and date of birth (used to determine whether purchases require parental consent).
• Project data: your prompts, the source code generated or edited in your projects, project names and settings, and the compiled artifacts needed to deliver your downloads.
• Billing data: your plan, subscription status, credit balance, and Stripe customer/subscription identifiers. Full payment card details are collected and stored exclusively by Stripe — they never reach our servers.
• BYOK keys: if you use the BYOK plan, your AI provider API key, stored encrypted in a dedicated vault and readable only by our server-side functions.
• Communications: feedback and support messages you send us, and the emails we exchange.
• Technical data: IP address, browser/user-agent, timestamps, and request logs generated by our hosting and infrastructure providers for security and reliability purposes.
• Anonymous visit statistics: page viewed, referrer domain, country, and device type. No IP address, no cookies, and no persistent identifier are stored — these statistics cannot be linked back to you.
• Local preferences stored in your browser (language, editor conveniences) — see the Cookie Policy.

2. Why we process it (purposes and legal bases)

• To provide the Service — creating your account, generating and compiling plugins, storing projects, delivering downloads: performance of a contract (art. 6(1)(b) GDPR).
• To handle payments, subscriptions, and invoicing: performance of a contract and legal obligations (art. 6(1)(b) and (c)).
• To verify age and collect parental consent for purchases by minors: legal obligation and contract validity (art. 6(1)(b) and (c)).
• To keep the Service secure — preventing abuse, fraud, and attacks; rate limiting; investigating incidents: legitimate interest (art. 6(1)(f)).
• To improve the Service using aggregate or anonymized usage information: legitimate interest (art. 6(1)(f)).
• To send service communications (confirmation emails, billing notices, material changes to terms): performance of a contract. We do not send marketing emails without your consent.

3. AI processing of your prompts and code

To generate plugins, your prompts and relevant project code are sent from our servers to third-party AI model providers (depending on plan and routing: for example OpenRouter, NVIDIA, Google, and other inference providers). They process this content to produce the output and per their own terms; we select providers and configure the integration to limit processing to what the generation requires. We do not use your private projects or prompts to train AI models, and we do not sell your data. If you use BYOK, generations run through the provider your key belongs to, under the agreement between you and that provider.

4. Who processes data on our behalf

We use a small set of processors, bound by data processing agreements:

• Supabase — database, authentication, and encrypted key vault.
• Vercel — website and API hosting.
• Render — plugin build/compilation servers.
• Stripe — payment processing and billing portal.
• Resend — transactional email delivery.
• AI inference providers — generation of code from your prompts (see Section 3).

We do not share your personal data with anyone else, except if required by law or to protect our legal rights.

5. Transfers outside the EU

Some of our providers process data in the United States or other countries outside the European Economic Area. Where that happens, transfers rely on safeguards recognized by the GDPR: adequacy decisions (including the EU-U.S. Data Privacy Framework where the provider is certified) and/or Standard Contractual Clauses.

6. How long we keep data

• Account and project data: for as long as your account exists. Deleting your account triggers cascade deletion of your profile, projects, and stored keys.
• Billing records: retained as required by tax and accounting law (in Italy, up to 10 years), even after account deletion.
• Technical logs: kept for short periods (typically days to a few weeks) by our infrastructure providers for security and debugging.
• Support communications: kept for as long as useful to handle the request and any follow-up.

7. Your rights

Under the GDPR you can, at any time:

• access your data and obtain a copy (art. 15);
• rectify inaccurate data (art. 16) — name, username, and birth date are editable in your account settings;
• erase your data (art. 17) — you can delete your account directly from the app, or ask us;
• restrict or object to processing based on legitimate interest (art. 18 and 21);
• receive your data in a portable format (art. 20);
• lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (garanteprivacy.it), or the authority of your country of residence.

To exercise any right, write to team@voxen.it from the email associated with your account. We reply within 30 days.

8. Security

Data is encrypted in transit (TLS). API keys are stored encrypted in a dedicated vault and are never exposed to the client. Database access is governed by row-level security so each user can only reach their own data; plan and credit changes happen exclusively server-side. Passwords are hashed by our authentication provider and are never visible to us.

9. Minors

The Service is intended for users aged 14 and over (the age of digital consent in Italy). Purchases by users under 18 require the consent of a parent or legal guardian, collected at checkout. If we learn that data of a child under 14 was collected without the required consent, we will delete it.

10. Cookies and local storage

Voxen uses only technical cookies and local storage — no advertising or profiling trackers. The details are in the Cookie Policy.

11. Changes to this policy

If we change this policy in a way that meaningfully affects you, we will notify you by email or in the app before the change takes effect. The "last updated" date at the top always reflects the current version.

12. Contact

For any question about this policy or your data: team@voxen.it.