Privacy Policy

1. Who We Are

Voxa is operated by Myk Kym Inc ("we", "us", "our"). We are the data controller for the personal data processed through this service. For questions about how we handle your data, contact us at [email protected].

2. What We Collect

Data	Purpose	Basis
Name, email	Account creation, delivery	Contract
Company name, industry	Project brief, generation context	Contract
Brief details (brand values, audience, constraints)	Name generation input	Contract
Payment data (via Stripe)	Processing payment	Contract
IP address, browser info	Security, abuse prevention	Legitimate interest

We do not collect special category data. We do not use cookies for tracking or advertising.

3. How We Use Your Data

• To generate your naming proposal (processing your brief through our AI pipeline)
• To deliver your proposal by email
• To process your payment via Stripe
• To communicate about your order (confirmation, delivery, support)
• To improve our service (aggregate, anonymised analysis only)

4. Third-Party Processors

We share your data with the following processors, each under appropriate data processing agreements:

Processor	Purpose	Data Shared
Anthropic (Claude API)	AI name generation and analysis	Brief content (no personal identifiers sent unless included in brief)
Stripe	Payment processing	Payment details, email, name
Google (Gmail API)	Proposal delivery by email	Your email address, proposal PDF

We do not sell your data. We do not share data with advertisers or data brokers.

5. Data Retention

• Project data (briefs, proposals, candidates): retained for 12 months after delivery, then deleted.
• Account data (name, email): retained while your account is active, then deleted within 30 days of a deletion request.
• Payment records: retained for 7 years as required by accounting regulations.
• Server logs: retained for 90 days, then deleted.

6. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data (we will provide a copy within 30 days)
• Rectify inaccurate data
• Erase your data ("right to be forgotten"), subject to legal retention requirements
• Restrict processing in certain circumstances
• Port your data to another service in a machine-readable format
• Object to processing based on legitimate interest

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Data Security

We protect your data with:

• Encryption in transit (TLS 1.3)
• Encrypted storage for payment data (handled by Stripe, PCI DSS compliant)
• Access controls limiting data access to essential systems only
• No card details stored on our servers (Stripe Checkout handles all card processing)

8. International Transfers

Your data may be processed outside the UK by our third-party processors (Anthropic and Stripe are US-based). These transfers are protected by Standard Contractual Clauses and the processors' compliance with applicable data protection frameworks.

9. Children

Voxa is a business service not directed at individuals under 18. We do not knowingly collect data from children.

10. Changes

We may update this policy as our service evolves. Material changes will be communicated by email to active clients. The effective date at the top reflects the latest revision.

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

12. Contact

For all privacy-related enquiries: [email protected].