Privacy Policy

Last updated: 2026-05-27

Information we collect

When you sign up

• Email address and name, managed by our authentication provider Clerk.
• If you sign in with Google, we receive your Google account's email and basic profile info — the same data we'd collect if you signed up with a password.

While using the service

• YouTube video URLs you add to projects.
• Project metadata: project names, descriptions, AI-generated topic labels, your pinned and archived choices.
• Questions you ask and the AI answers we generate in response.
• Display-title overrides, chat clear markers, and similar workspace preferences.

Automatically, as you use the service

• Transcript text we fetch from YouTube or generate via speech-to- text for each video you add. Cached so you can search and re- query without re-fetching.
• Usage counters: videos added, AI questions asked, projects created. Used to enforce plan limits and surface your usage on the Billing page.
• Standard server logs (IP address, user agent, request path) for security and debugging. Retained 30 days.

Billing information

We do not store payment card details. Stripe (PCI-DSS compliant) processes all payments. We only retain your Stripe customer ID and subscription status.

How we use your information

• Provide the service: index transcripts, generate AI answers, surface citations, render your workspace.
• Process payments and manage subscriptions via Stripe.
• Send transactional emails you've opted into (“video ready”, “video failed”), respond to support requests, and send important service notices.
• Aggregate, anonymized usage patterns help us understand which features are used and what to build next.
• Enforce plan limits and prevent abuse of the service.

We do not use your content to train AI models. The questions you ask and the videos you submit are not fed into LLM training pipelines — they're sent to the LLM as one-time queries with surrounding context and discarded by the provider after the response is generated.

Who we share your information with (sub-processors)

We use a small set of third-party sub-processors to operate the service. Each only receives the data they need for their specific job.

We do not share your data with advertisers, data brokers, or any party not listed above.

Zoom integration

LaVoix offers an optional Zoom integration that lets you import Zoom Cloud Recordings directly into a project. The integration is opt-in per user — connecting your Zoom account is entirely your choice. Until you click Connect on the Account page, LaVoix has no access to your Zoom account and we receive zero data from Zoom.

What we receive from Zoom when you connect

• An OAuth access token + refresh token bound to the two scopes you approved (user:read:user and cloud_recording:read:list_user_recordings).
• Your Zoom account's id + email, used to display “Connected as <email>” in your LaVoix account settings.
• Metadata about your Cloud Recordings (titles, dates, durations, file URLs) — fetched on-demand when you open the “From Zoom” tab in the Add Videos dialog. We do not bulk-cache your recording library.
• For recordings you specifically select: the recording's MP4 video file and (if available) the VTT transcript Zoom auto-generated. We never download recordings you haven't explicitly picked.

How Zoom data is stored

• OAuth tokens are encrypted at rest in our database using AES-256-GCM with a server-only encryption key. Tokens are never logged, never exposed to client-side code, and never visible in our admin interfaces.
• Downloaded recordings + transcripts live in your LaVoix project's Supabase Storage allocation, treated exactly the same as any other video content in your projects.
• Zoom account email + id are stored in plaintext (no encryption needed — they aren't secrets) and used only to render the settings UI.

What we don't do with Zoom data

• We do not use your Zoom recordings or transcripts to train AI models. See the “How we use your information” section above — the same no-training policy applies to all content in LaVoix, including Zoom-imported content.
• We do not share your Zoom recordings, transcripts, or tokens with third parties beyond the sub-processors listed above (Supabase for storage, OpenAI for embeddings, Anthropic for Q&A generation — each receives only the data it needs for its specific job).
• We do not use your OAuth tokens to access any Zoom resource outside the explicit scopes you granted. The only API calls we make are GET /v2/users/me and GET /v2/users/{userId}/recordings plus the download URLs returned by the latter.

How to disconnect

You can revoke the Zoom integration at any time from either side:

• From LaVoix: Open /dashboard/account → Connected accounts → Zoom → Disconnect. LaVoix calls Zoom's revoke endpoint to invalidate the grant server-side AND deletes your encrypted tokens from our database immediately.
• From Zoom: Sign in at marketplace.zoom.us → Manage → Added Apps → Remove. Zoom revokes the grant and LaVoix removes your stored tokens on receipt of Zoom's deauthorization notification.

Disconnecting does not delete recordings you've already imported into your LaVoix projects — those remain in your project storage and stay searchable + askable. To delete an imported recording specifically, remove it from the project via its kebab menu (Remove video). Deleting your LaVoix account purges the OAuth tokens, your project storage, and everything else attached to the account.

See the Zoom integration guide for step-by-step screenshots and the full add / use / remove walkthrough.

Cookies

LaVoix uses essential cookies only — authentication session cookies set by Clerk to keep you signed in. We do not use advertising cookies, marketing trackers, or cross-site tracking pixels.

Data retention and deletion

We retain your data for as long as your account is active. You can delete your account at any time via Settings → Security → Delete account. When you delete your account:

• Your projects, videos, transcripts, and Q&A history are removed from our database within 30 days.
• Your Stripe customer record is retained as Stripe requires for tax / compliance, but no further charges are processed.
• Anonymized aggregate usage data may persist for service- improvement purposes.

You can also request a portable data export at any time by emailing support@lavoix.ai.

Your rights

Depending on your jurisdiction (e.g. GDPR, CCPA), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most can be done directly in your account settings)
• Delete your data (via account deletion or by request)
• Export your data in a portable format
• Object to certain processing
• Opt out of marketing communications (we send transactional emails only by default — there's no marketing list to opt out of)

To exercise any of these rights, email support@lavoix.ai. We respond within 30 days.

International data transfers

Our infrastructure is hosted in the United States (Supabase, Vercel). By using LaVoix.ai you consent to your data being processed in the US. We use sub-processors that comply with applicable data-transfer frameworks (Standard Contractual Clauses where required).

Security

We implement industry-standard security practices:

• Encryption in transit (TLS 1.2+) on all connections
• Encryption at rest for database storage (managed by Supabase)
• Application-level encryption (AES-256-GCM) for sensitive stored credentials — OAuth tokens (e.g. Zoom) are encrypted before they touch the database, with the encryption key held only in our server environment
• Row-Level Security enabled on every public-schema database table, locking down the publicly-exposed Supabase REST API for anonymous and authenticated roles
• Access controls limiting who can query the production database
• Regular dependency updates for security patches

No security system is impenetrable. We can't guarantee absolute security, but we take reasonable measures and notify users promptly if we become aware of a security incident affecting their data.

Children

LaVoix.ai is not intended for users under 13 (or 16 in the EEA). We don't knowingly collect data from children below these ages. If you believe a child has provided us data, please contact support@lavoix.ai and we'll delete it.

Changes to this policy

We may update this policy as the service evolves. For material changes we'll notify you via email at least 30 days before the change takes effect. Continued use of the service after the change means you accept the updated policy.

Contact us

Questions about this policy or your data?

• Email: support@lavoix.ai
• Business address: [to be added once incorporated]