Privacy Policy

1. Who this policy is for

This policy explains how voan (“voan”, “we”, “us”) handles personal data.

It covers two different groups: the accountants and firms who sign up to use voan, and the clients of those firms who receive our reminder emails and upload documents.

We wear two different hats, and it matters which one applies:

• • For your account — your name, email, firm name and how you use the app — we are the data controller.
• • For the documents and contact details your clients submit through voan, we act as a data processor on behalf of your firm. Your firm is the controller of that data, and our Data Processing Agreement governs it.

2. What we collect

Account data (you, the firm):

• • your name, email address and firm name
• • the reply-to address and branding you set for reminders
• • sign-in and security information needed to run your account
• • basic technical and usage data — IP address, browser type, and logs — so the Service works and stays secure

3. Data your clients submit

When you add a client, you enter their name and email so we can send reminders. Your clients then upload the documents you asked for. We process that client data only to run the Service for you and only on your instructions — we do not decide what to do with it.

We do not review the contents of uploaded documents, we do not sell them, and we do not use them to train AI models.

4. Why we use data, and our legal basis

Under the GDPR we rely on:

• • Performance of a contract — to give you the Service you signed up for.
• • Legitimate interests — to keep the Service secure, prevent abuse, and improve how it works, balanced against your rights.
• • Consent — only where we ask for it, such as optional product update emails. You can withdraw consent at any time.
• • Legal obligation — where we must keep certain records to comply with the law.

5. Who we share data with

We use a small number of trusted providers to run voan. They only process data to provide their service to us, under contract:

• • Supabase — database, authentication and encrypted document storage.
• • Resend — sending reminder and notification emails.
• • Vercel — hosting the application.
• • Paddle — our payment provider. Paddle is the merchant of record for purchases and acts as an independent data controller for the payment information you give at checkout; it has its own privacy policy.

5a. Connecting your own Google account

By default, reminders go out from voan's own sending infrastructure. If you would rather your clients received them from your own address, you can connect your Google Workspace or Gmail account in Settings → Email. This is optional and nothing else in voan depends on it.

When you connect, voan asks Google for one permission and only one: permission to send email on your behalf (the gmail.send scope). That scope carries no read access of any kind. voan cannot read, search, download or delete anything in your mailbox, and we never see your inbox, your sent mail, your drafts, your contacts or your calendar. The only messages we send are the document requests and reminders you set up in the app, to the clients you added.

What we store is the token Google issues so we can keep sending, encrypted at rest, together with the address you connected. We do not store the content of the messages. Once connected, Google is acting as your own email provider under your existing agreement with Google — it is not a sub-processor of ours, and the mail leaves your account rather than ours.

voan's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, we do not transfer it to third parties for advertising or any other purpose, we do not use it to train AI models, and no human at voan reads it.

You can disconnect at any time from Settings → Email, or from the third-party access page of your Google Account. Disconnecting deletes the stored token immediately, and reminders go back to voan's own sending infrastructure.

6. Where your data is stored

Your firm's database, the documents your clients upload, and the reminder emails we send on your behalf are all processed in the European Union:

• • Supabase — database, authentication and document storage, in an EU region.
• • Vercel — the application itself runs in Dublin (eu-west-1).
• • Resend — reminder email is sent from its Ireland (eu-west-1) region.
• • Google — only if you connect your own account under section 5a. The message is then handed to Google and delivered under your own Workspace or Gmail terms, on Google's own global infrastructure rather than an EU-pinned region.

6a. Transfers outside the EEA

Your data is stored in the EEA. There is one routine exception: when a client replies to a reminder with a document attached, that email reaches us through Cloudflare's global mail routing before being stored in Dublin. Our providers are also incorporated outside the EEA, so limited support or administrative access from outside the EEA remains possible. Those transfers are covered by Standard Contractual Clauses or another safeguard approved under the GDPR.

There is a second exception you choose for yourself: if you connect your own Google account under section 5a, outbound reminders are handed to Google and travel on Google's global network under your own agreement with Google rather than ours.

If you need written confirmation of the exact regions for your own compliance file, email info@voan.ai and we will send it to you.

7. How long we keep it

We keep your account data for as long as your account is open. If you close your account, we delete stored documents within 30 days, except where we are legally required to keep certain records for longer.

You can export or delete client data from within the app at any time.

8. How we protect it

Documents are stored encrypted, connections use TLS, and access is restricted to what is needed to run the Service. Each client's upload link is private to them. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise any of these, email info@voan.ai. If your request concerns documents your clients submitted, that data belongs to the firm that requested it, and we will direct the request to them as controller.

If you are unhappy with how we handle your data, you can complain to the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

10. Cookies

We use only the cookies needed to keep you signed in and keep the app secure. We do not use advertising or cross-site tracking cookies.

11. Children

voan is a tool for accounting professionals and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy. If a change materially affects you, we will email you before it takes effect. The date at the top shows when it was last updated.

13. Contact

Questions about your data or this policy: info@voan.ai.