Privacy Policy
Last updated: 4 November 2026We collect what we need to run voye: your account, the documents you write and the settings you choose. We use it to provide the service, not to sell it or to advertise to you. Text you send for an AI review is processed by our AI providers; you can have it anonymised first, but anonymisation is not guaranteed. You can access, export, correct or delete your data at any time.
1. Who we are
voye ("voye", "we", "us" or "our") is operated by [Company legal name]. We are the controller of the personal data described in this Privacy Policy within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
- Name [Company legal name]
- Address [Registered address]
- Company registration [Chamber of Commerce (KvK) number]
- VAT [VAT number]
- Email [privacy@your-domain]
2. Scope
This Privacy Policy applies to the voye website, the voye web application and any related services (together, the "Service"). It explains what personal data we process when you visit the website, create an account or use the Service, why we process it, and the rights you have.
It should be read together with our Terms of Service, our Cookie Policy and our AI and data notice.
3. The personal data we collect
- Account data. Your name, email address and a unique account identifier, received from our authentication provider when you sign up or sign in.
- Content. The documents you create or import (such as resumes, cover letters and other text), their titles, revisions, the review feedback we save for them, the audience, target role, brief and tone you set, and the layout choices you make. Content may contain personal data about you and about other people.
- Settings. Your preferences, such as whether everything sent to AI is anonymised.
- Plan and usage data. Your plan, the number of AI reviews you have used, and the dates of your passes and subscriptions.
- Payment data. When paid plans are available, payments are handled by [payment provider]. We receive a record of each payment (amount, date, plan and status) and do not receive or store your full card details.
- Technical data. Your IP address, browser type, the requests your browser makes to our servers, timestamps, request identifiers and error reports, collected in server logs for security and operation.
- Communications. The feedback you send us through the Service and the emails you exchange with us.
Some data stays on your device and is not received by us unless you send it. Your knowledge base (the files and notes you add to it) is stored in your browser; only the passages a review needs are sent with that review. See our Cookie Policy for what is stored on your device.
4. Why we use your data and our legal bases
We process your personal data only where we have a legal basis under Article 6 of the GDPR:
- To provide the Service (creating your account, storing and displaying your documents, running the reviews, edits and exports you ask for): performance of our contract with you (Article 6(1)(b)).
- To manage plans and payments and to keep the records tax and accounting law requires: performance of contract and compliance with a legal obligation (Article 6(1)(b) and (c)).
- To keep the Service secure and working (preventing abuse, investigating errors, monitoring performance): our legitimate interest in operating a secure and reliable service (Article 6(1)(f)).
- To improve the Service using the feedback you choose to send us and aggregated usage information: our legitimate interest in improving voye (Article 6(1)(f)).
- To communicate with you about your account, changes to the Service or to these documents, and replies to your questions: performance of contract and our legitimate interest (Article 6(1)(b) and (f)).
- To comply with the law and to establish, exercise or defend legal claims: legal obligation and legitimate interest (Article 6(1)(c) and (f)).
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You may object to this processing at any time (see section 11).
We do not sell your personal data, we do not use it for advertising, and we do not use your Content to train AI models.
5. AI processing and anonymisation
When you ask for an AI review, an AI edit, a drafted letter, an import or AI formatting, the relevant text is sent to our AI providers (see section 7) to produce the result. It is processed only to return that result to you.
You can switch on "Anonymise everything sent to AI" in the Service. Names, contact details and places are then detected in your browser and replaced by labels before the text is sent. Detection is designed mainly for English, Dutch, German, French, Spanish, Italian, Portuguese, Latvian, Arabic and Chinese, and is less reliable in other languages. We make every reasonable effort to make this detection accurate, but it is not guaranteed to find every personal detail. Please read our AI and data notice before relying on it.
The AI features do not make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR. Suggestions are proposals: nothing in your document changes until you apply it.
6. Special categories of data and data about others
The Service is not designed to process special categories of personal data (such as health, religious beliefs, political opinions, sexual orientation, ethnic origin, trade-union membership, biometric or genetic data) or data about criminal convictions. We ask you not to include such data in your Content unless you need to. If you choose to include it, you do so on your own initiative, and we process it only to provide the Service as you instruct; you can remove it at any time.
If your Content contains personal data about other people (for example a referee's name and contact details), you are responsible for having a lawful basis to share that data with us and for informing those people where the law requires it.
8. International transfers
Some of our providers are located outside the European Economic Area (EEA). Where personal data is transferred to a country that the European Commission has not recognised as providing an adequate level of protection, we rely on appropriate safeguards: the EU-U.S. Data Privacy Framework where the recipient is certified under it, or the Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where necessary. You can request a copy of the relevant safeguards by contacting us.
9. How long we keep your data
- Account data, Content and settings: for as long as your account exists. When you delete a document, it is removed from our active database; when you delete your account, we delete your account data and Content.
- Copies in backups: deleted from backups within [30] days.
- Payment and invoice records: for [7] years, as required by tax and accounting law.
- Server logs and error reports: up to [30] days, unless needed longer to investigate a security incident.
- Communications and feedback: for as long as needed to handle them, and no longer than [2] years after the last contact.
Text sent to an AI provider is processed to produce the result and is not kept by us beyond the result we save to your document. The AI providers' own retention is governed by their terms; we choose providers and settings intended to minimise it.
10. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS), secure session cookies, access controls and the separation of each user's data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority and, where required, you.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- restrict our processing of your data;
- receive the data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability);
- object to processing based on our legitimate interests;
- withdraw any consent you have given, at any time, without affecting the lawfulness of processing before the withdrawal.
You can view, export and delete your documents in the Service yourself, and delete your account from your Profile page, which also deletes your sign-in at our authentication provider. To exercise any other right, email [privacy@your-domain]. We will respond within one month, which may be extended by two further months for complex requests; we will tell you if that happens. We may ask you to verify your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where an alleged infringement took place. Our lead supervisory authority is [Autoriteit Persoonsgegevens (the Dutch Data Protection Authority)]. We would appreciate the chance to address your concern first.
12. Children
The Service is not intended for children under 16 years of age, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. If we make material changes, we will notify you by email or in the Service before they take effect.
14. Contact
For any question about this Privacy Policy or the way we handle your personal data, contact us at [privacy@your-domain].
- Name [Company legal name]
- Address [Registered address]
- Company registration [Chamber of Commerce (KvK) number]
- VAT [VAT number]
- Email [privacy@your-domain]