Voxtya

Privacy Policy

Last updated: October 9, 2026

In summary

  • Your data stays yours and is never sold
  • We collect only what's necessary for the service
  • Your database is hosted in the EU; transfers outside the EU are safeguarded
  • You can delete your account and data at any time

1. Who we are

Voxtya is a SaaS platform dedicated to managing the online presence of local businesses (customer reviews, websites, social media, bookings, AI search visibility). The service is operated from France and available at voxtya.com. For any question regarding the publisher, contact us at contact@voxtya.com.

2. What data we collect

As part of our service, we collect the following data:

  • Account data: Email, name, password (encrypted), profile picture.
  • Business data: Your business name, address, opening hours, photos, business category, Google Business Profile link.
  • Review data: Customer reviews fetched from your Google listing and the other platforms you connect, and replies generated or published by you.
  • Payment data: Stripe handles your card details exclusively. Voxtya never stores your card numbers.

3. Why we collect this data

We use your data only to:

  • Provide our review management service
  • Generate automated replies to your reviews
  • Send you alerts and reports
  • Improve our service
  • Contact you for customer support
  • Handle billing

4. How long we keep your data

Your data is kept for the entire duration of your subscription, then for 3 years after your subscription ends (legal obligations). You can request deletion of your data at any time.

5. Who we share your data with

Your data is never sold to third parties. To provide the service, we use the following processors:

Processor Purpose Processing location
Supabase Database and accounts (authentication) EU (Paris, France)
Vercel Hosting and running the application EU (Paris, France) for application servers; delivery through points of presence worldwide (Vercel Inc., a US company)
Groq Artificial intelligence: drafting review replies, posts and recommendations United States
OpenAI Backup artificial intelligence and reading menu photos United States
Brevo Sending emails (confirmations, alerts, reports, review requests) EU (France)
PostHog Audience measurement and service improvement EU (project hosted in Europe)
Stripe Subscription payments and billing (PCI DSS Level 1) EU (Ireland), with possible transfers to the United States
Google Public data from your listing (Places API), connection to your Google account and listing (OAuth), web fonts United States and EU
DeepL Translating your website content EU (Germany)
Unsplash Searching stock photos (only keywords are sent) United States
Meta, TikTok, LinkedIn Publishing to your social networks, only if you connect them (OAuth) EU (Ireland) and United States

Each processor only accesses the data it needs for its task and is bound by a data processing agreement (Article 28 GDPR). For transfers outside the European Union, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework.

6. Where we store your data

Our database (Supabase) and application servers (Vercel) are hosted in Paris, in the European Union. Some processors handle data outside the EU, mainly in the United States (Groq and OpenAI for artificial intelligence, Google, Unsplash). These transfers are covered by the European Commission’s Standard Contractual Clauses. We use industry-standard security protocols (SSL/TLS encryption, regular backups, etc.).

7. Your rights

Under GDPR, you have the following rights:

  • Right of access: You can request a copy of all data we hold about you.
  • Right to rectification: You can correct any inaccurate data directly from your account.
  • Right to erasure: You can delete your account and all your data at any time from your settings.
  • Right to object: You can object to a specific processing by contacting us.
  • Right to portability: You can export a complete copy of your data at any time from your account.
  • Right to restriction: You can request restriction of processing in certain cases.

To exercise these rights, contact us at: contact@voxtya.com

8. Cookies

We use cookies and local storage that are essential to the service (authentication, language preferences). We also measure audience with PostHog (project hosted in the EU): page views, clicks and anonymized session recordings in which typed fields are masked. We do not use advertising cookies. You can configure your browser to refuse cookies.

On the websites our customers build with Voxtya (business website, booking, quote, review, menu and wheel pages), PostHog audience measurement works without any cookie or browser storage: page views and clicks on key buttons (book, call, directions, reviews…), with no session recording, no visitor identification, no IP address kept, and the browser’s “Do Not Track” setting is respected. These statistics help the business and Voxtya improve the website.

9. Security

We take your data security very seriously. Our measures include:

  • Encryption of data in transit (HTTPS) and at rest
  • Secure authentication with password hashing
  • Restricted access to personal data
  • Regular encrypted backups
  • Continuous system monitoring

10. Changes to this policy

We may modify this privacy policy. In case of significant changes, we will notify you by email at least 30 days before changes take effect.

11. Contact

For any question regarding your personal data:

You can also lodge a complaint with the CNIL (French Data Protection Authority) if you believe your rights are not respected.