Privacy Policy

This Privacy Policy describes how SAKA LLC, doing business as Vooshly ("we," "us," or "our"), collects, uses, discloses, and protects your personal data when you use the Vooshly platform, website, and related services (collectively, the "Service").

We are committed to complying with the Maryland Online Data Privacy Act (MODPA), the California Consumer Privacy Act (CCPA), and other applicable data-protection laws. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

We collect the following categories of personal data:

2.1 Account Information

• Name — provided during signup or via Google OAuth.
• Email address — used as your primary identifier.
• Authentication credentials — passwords are managed by our authentication provider; we do not store plaintext passwords.
• Profile avatar — optionally provided by you or your Google account.

2.2 User-Generated Content

• Media files — audio and video files you upload or import via URL for processing.
• Transcripts — generated from your uploaded media.
• AI-generated assets — text posts, video clips, audiograms, and other content produced by our pipeline on your behalf.
• Brand voice data — writing samples, voice profile descriptions, and brand summaries you provide to customize AI-generated outputs.

2.3 Usage & Analytics Data

• Product analytics — we use PostHog to record feature-usage events (e.g., job creation, asset downloads). Events are associated with your account identifier.
• Theme preference — your light/dark mode selection is stored in your browser's local storage.
• Session data — our authentication and analytics providers may store session tokens in local storage and cookies to maintain your session.

2.4 Data We Do Not Collect

We do not collect sensitive data as defined by the Maryland ODPA, including: biometric identifiers, precise geolocation, health information, financial account numbers, Social Security numbers, or data revealing racial or ethnic origin, religious beliefs, or sexual orientation. We do not perform facial recognition or voice biometrics on uploaded media.

We process your personal data for the following purposes:

• Service delivery — to create your account, authenticate you, process your media, generate content assets, and display results.
• Personalization — to apply your brand voice settings to AI-generated outputs.
• Communication — to send transactional emails (e.g., job-completion notifications, account updates) via our email infrastructure.
• Analytics & improvement — to understand how the Service is used and to improve features, reliability, and performance.
• Security & fraud prevention — to detect and prevent unauthorized access, abuse, or security incidents.
• Legal compliance — to comply with applicable laws, regulations, and lawful requests.

We share personal data with the following categories of service providers solely to operate and deliver the Service. We do not sell your personal data.

4.1 Cloud Infrastructure

The Service runs on Google Cloud Platform. Your media files, transcripts, and generated assets are stored in Google cloud storage. Your account and job data are stored in a secure database accessible only via private networking. All data is encrypted at rest and in transit using Google-managed encryption.

4.2 Authentication

Account authentication is provided by Firebase Authentication (Google). Firebase receives your email, name, and OAuth credentials to manage your identity and issue session tokens.

4.3 Transcription Providers

Audio extracted from your uploaded media may be sent to the following third-party transcription providers: Soniox and AssemblyAI. These providers process your audio solely to return a text transcript and do not retain your data beyond the processing window.

4.4 AI / Large Language Model Providers

Transcript text and your brand voice context are sent to AI providers to generate text assets (social posts, show notes, newsletters, etc.). Clip selection also sends short excerpts of your media to Google Gemini: still frames from your video as images, short audio segments, and for visually-driven sources a low-resolution video window of a few seconds. We may use the following providers:

• Google Gemini
• OpenAI
• DeepSeek (China-based provider)
• Kimi / Moonshot AI (China-based provider)

When a China-based provider is used, your transcript text and brand voice context may be processed on servers located outside the United States. Media excerpts stay narrower: frames, audio segments, and video windows go only to Google Gemini, and never to the China-based providers. We do not send account credentials, email addresses, or other directly identifying information to any AI provider.

4.5 Stock Media

Search queries (not personal data) may be sent to Unsplash and Pexels to source stock images for generated media assets.

4.6 Email

Transactional and lifecycle emails are delivered through Cloudflare Email Service over encrypted SMTPS. Your email address and message content are shared with Cloudflare solely for delivery, deliverability, and abuse prevention. Marketing messages include an unsubscribe mechanism; opting out of marketing does not disable important account or processing notifications.

4.7 Analytics

We use PostHog to collect product-usage analytics. PostHog receives your account identifier and interaction events. PostHog may set cookies and use local storage to maintain session continuity. You can opt out of analytics tracking by enabling your browser's "Do Not Track" setting.

We do not sell your personal data. We do not share your personal data with third parties for their own marketing or advertising purposes. We do not use your data for targeted advertising beyond the product analytics described in Section 4.7.

We may disclose personal data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Vooshly, our users, or the public.

If you are a Maryland resident, you have the following rights:

• Right to confirm — you may confirm whether we are processing your personal data.
• Right to access — you may request a copy of the personal data we hold about you.
• Right to correct — you may correct inaccurate personal data via your profile settings.
• Right to delete — you may request deletion of your personal data (see Section 8).
• Right to data portability — you may request your data in a portable, commonly used format.
• Right to opt out — you may opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Vooshly does not currently engage in any of these activities.

To exercise any of these rights, contact us at [email protected]. We will respond within 45 days of receiving your verified request. If we need additional time, we will notify you of the extension and the reason.

You will not be discriminated against for exercising your privacy rights.

We retain your personal data as follows:

• Account data — retained for as long as your account is active.
• Uploaded media & generated assets — retained for as long as your account is active so you can access and re-download your content.
• Notifications — unread notifications are automatically deleted after 90 days; read notifications after 30 days.
• Analytics data — retained in accordance with our analytics provider's data-retention policies.

Upon account deletion, we will delete or de-identify your personal data within 30 days, except where retention is required by law.

You may request deletion of your account and all associated data by contacting us at [email protected]. Upon receiving a verified deletion request, we will permanently remove your account, uploaded media, generated assets, brand voice data, and all related records within 30 days.

A self-service account deletion feature is planned for a future release.

We implement the following technical and organizational measures to protect your data:

• Encryption in transit — all data transmitted between your browser and our servers uses HTTPS/TLS. Internal service-to-service communication is encrypted.
• Encryption at rest — all stored data (database, file storage) is encrypted using Google-managed encryption keys.
• Authentication — industry-standard token-based authentication is enforced on every API request.
• Access control — users can only access their own data. Administrative functions require verified admin credentials.
• Private networking — our database is accessible only via private networking and is not exposed to the public internet.
• Secrets management — all API keys and credentials are stored in a dedicated secrets management service. No secrets are hardcoded in source code.

The Service uses the following client-side storage mechanisms:

• Authentication — uses IndexedDB and local storage to persist your session token so you remain signed in.
• Analytics — uses cookies and local storage to maintain a session identifier for product analytics.
• Theme preference — your light/dark mode selection is stored in local storage.
• Dashboard state — your active dashboard tab is stored in session storage for navigation continuity.

We do not use cookies for advertising or cross-site tracking.

The Service is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at [email protected] and we will promptly delete it.

Your data is primarily stored and processed in the United States on Google Cloud Platform infrastructure. As described in Section 4.4, transcript text and brand voice context may be processed by AI providers located outside the United States, including providers based in China. No directly identifying personal information (name, email, credentials) is sent to these providers.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service and updating the "Effective Date" above. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: