Voidhash Privacy Policy
Version 1.0 · Effective from 14 October 2026
This Privacy Policy explains how Voidhash s.r.o. processes personal data as a controller: when you visit voidhash.com, create an account, work in the Voidhash dashboard, buy a Voidhash plan or contact us. It also explains what happens if you use an app or website of a company that uses Voidhash (section 6). This policy is also available in Czech; both versions have the same content.
1. Who we are and how to reach us
1.1 The controller of your personal data is Voidhash s.r.o., ID No. (IČO) 23738944, with its registered office at Chudenická 1059/30, Hostivař, 102 00 Prague 10, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 432083 ("Voidhash", "we", "us").
1.2 Contacts:
| For | Contact |
|---|---|
| Privacy and data protection, exercising your rights | legal@voidhash.com |
| Security vulnerabilities and incidents | legal@voidhash.com |
| Legal matters and contracts | legal@voidhash.com |
| Post | Voidhash s.r.o., Chudenická 1059/30, 102 00 Praha 10, Czech Republic |
1.3 We have not appointed a data protection officer. For any data protection matter, contact us at legal@voidhash.com.
2. About this policy
2.1 This policy applies to personal data we process for our own purposes (as a controller) about:
- (a) visitors to voidhash.com, including the documentation;
- (b) people who sign up for and use the Voidhash dashboard ("Dashboard");
- (c) team members invited to a Voidhash organization by someone else;
- (d) representatives and billing contacts of our customers and prospective customers;
- (e) anyone who contacts us, sends us feedback or reports content or a security issue.
2.2 This policy does not cover:
- (a) personal data of End Users that our Customers process using the Service — we process it on the Customer's behalf as a processor; see section 6;
- (b) self-hosted installations of the open-source Voidhash Community edition — whoever operates the installation is responsible for the data in it;
- (c) websites and services of third parties, including sign-in providers you choose (section 4.1(c)).
2.3 Terms used in this policy:
- "Service" means the hosted Voidhash cloud service, including the Dashboard, API and SDK endpoints;
- "Customer" means the business that has an account with us and uses the Service;
- "End User" means a person who uses a Customer's app or website;
- "Customer Data" means data that a Customer or its apps send to the Service, including End User data; "Customer Content" means paywalls, flows, components, images and other content a Customer creates or uploads;
- "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).
2.4 Related documents: Terms of Service (voidhash.com/legal/terms), Data Processing Addendum (voidhash.com/legal/dpa), list of subprocessors (voidhash.com/legal/subprocessors), SDK data and End User privacy (voidhash.com/legal/sdk-data) and Cookie Policy (voidhash.com/legal/cookies).
3. What we process, why, on what basis and for how long
3.1 For each purpose the tables below state the data, the legal basis under Art. 6(1) GDPR and the retention period. The legal bases are: consent (point (a)), contract — performing a contract with you or taking steps at your request before entering into one (point (b)), legal obligation (point (c)) and legitimate interest (point (f)); for each legitimate interest we name the interest itself. You can ask for our balancing test at legal@voidhash.com. Where a period ends, we delete or anonymise the data unless another purpose in this section still applies.
3.2 Visitors to voidhash.com
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the website and keeping it secure and working (serving pages, preventing attacks and abuse, fixing errors) | IP address, browser and operating system (user agent), requested address, referring address, time of request, technical error details | Legitimate interest in operating a secure and functioning website | Logs and traces: 30 days |
| Remembering choices you make in the interface (for example light or dark theme) | The chosen setting, stored only in your browser | Legitimate interest in providing the interface you set up; storage is strictly necessary for a feature you requested (see the Cookie Policy) | Until you change the setting or clear your browser storage |
| Answering enquiries you send us by email (for example to sales@voidhash.com) | Name, email, company, role, content of the message and anything you choose to include | Steps taken at your request before entering into a contract; otherwise legitimate interest in answering enquiries | 2 years after our last interaction, unless a contract follows (then 3.5) |
We do not use analytics, advertising or social media cookies, tracking pixels or third-party scripts on voidhash.com, and our fonts are hosted by us. If this changes, we will ask for your consent first and update this policy and the Cookie Policy.
3.3 Signing up and using the Dashboard
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating your account and signing you in (email and password, or GitHub, Google or Microsoft through our authentication provider WorkOS) | Email, name, profile picture (from the sign-in provider or uploaded by you), email verification status, sign-in method, account identifiers, records of sign-in and account events received from WorkOS; your password is handled by WorkOS | Contract | For the life of the account; deleted within 30 days after the account is closed, except the record of acceptance of the Terms and records under 3.5 and 3.8 |
| Admitting you to the Service while access is limited (waitlist) | Email, name, organization | Steps taken at your request before entering into a contract | Until access is granted or you ask us to remove you; at most 12 months |
| Proving that the contract was concluded and which version of the Terms of Service was agreed | Record of your acceptance of the Terms of Service: user identifier, email at the time of acceptance, version of the Terms, time of acceptance, IP address, user agent, and whether you accepted at sign-up or in the Dashboard | Contract; legitimate interest in being able to prove the contract and to establish, exercise or defend legal claims | For the life of the account and 4 years after the contract ends |
| Providing the Service: organizations, projects, roles and collaboration | Organization membership, role, invitations you send (invitee email), your name and picture shown to collaborators, including live presence in the real-time editor | Contract | For the life of the account or of the organization, as applicable |
| API keys and integrations | Key name, creator, creation time, time of last use, request counts | Contract; legitimate interest in protecting accounts from misuse of keys | Until the key is deleted, at the latest with the project |
| Audit log of changes in a project | Your user identifier, the changed item, the action, the change made and its time (no IP address) | Legitimate interest of the Customer and of us in accountability and in investigating mistakes and misuse | For the life of the project |
| Publishing components to other Customers | Publisher details shown to other Customers with the component | Contract | While the component is published |
| Service messages (email verification, invitations, security alerts, billing notices, notices of changes to our terms) | Email, name | Contract; legal obligation where the law requires us to notify you | For the life of the account |
| Usage notices (informing account owners and administrators when an organization reaches 80% and 100% of a plan limit) | Name, email, organization, usage figures | Contract | Notice records: for the life of the account |
| Operating, debugging and securing the Dashboard and API | IP address, user agent, request details, user and organization identifiers in logs and traces | Legitimate interest in running a reliable and secure service | 30 days |
We store your IP address in our application database only in the record of your acceptance of the Terms of Service described above. Otherwise it passes through our hosting and network providers (Cloudflare, Railway), appears in technical logs and traces kept for 30 days, and is processed by WorkOS when you sign in.
3.4 Team members invited by someone else
If a colleague or your organization added you, we did not obtain the first data about you from you (Art. 14 GDPR). The source is the person who invited you or, for Enterprise single sign-on and user provisioning (SSO/SCIM), your organization's identity provider connected through WorkOS.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Inviting you to an organization | Your email entered by the inviting person, the inviter's identity, the role and organization | Legitimate interest of the Customer and of us in letting the Customer give its staff and contractors access | Until accepted or revoked; unaccepted invitations are deleted after 90 days |
| Provisioning your access via SSO/SCIM (Enterprise) | Name, email, directory identifier, groups and roles | Legitimate interest of the Customer in managing access centrally | While your access is provisioned |
| Your use of the Dashboard | As in 3.3 | Contract, where you accepted our Terms yourself; otherwise legitimate interest of the Customer and of us in providing the Service the Customer ordered | As in 3.3 |
Administrators of your organization can see your name, role and changes you make, including in the audit log.
3.5 Customer contacts, contracts and billing
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Concluding and performing the contract, including Enterprise order forms | Name, role, business email and phone, company, company ID and VAT number, signatures, correspondence | Contract, where you are the contracting party; otherwise legitimate interest in dealing with the Customer through its representatives | For the term of the contract and 4 years after it ends |
| Billing and collecting payments for Voidhash plans (through Autumn and Stripe) | Plan, billing contact name and email, billing address, tax identifiers, customer identifiers at Autumn and Stripe, payment status, invoices; card details are entered directly with Stripe and never reach Voidhash | Contract; legal obligation (accounting and tax) | Invoices and accounting records: 10 years; other billing data: term of the contract and 4 years after it ends |
| Keeping accounting and tax records | Invoices and accounting records containing your data | Legal obligation under Act No. 563/1991 Coll., on Accounting (Section 31) and, where applicable, Act No. 235/2004 Coll., on Value Added Tax (Section 35) | 5 or 10 years as these acts require |
| Recovering overdue amounts | Billing data and related correspondence | Legitimate interest in recovering our claims | Until the claim is settled or time-barred and any proceedings end |
The usage figures we bill for (events and tracked revenue) are business metrics of the Customer's account, not data about you.
3.6 Support and feedback
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering support requests | Name, email, organization and project identifiers, content of the request, attachments and technical details you provide | Contract, for Customers; otherwise legitimate interest in answering requests | 3 years after the request is closed |
| In-app feedback | Message, email, name, user agent and the page you sent it from; routed to our internal Slack workspace | Legitimate interest in improving the Service based on what users tell us | 3 years |
3.7 Marketing and communication
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Sending Customers emails about our own similar products and services (product news, new features, offers) | Email, name | Legitimate interest in direct marketing (recital 47 GDPR), relying on Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services; you can opt out in every email | Until you opt out or the account is closed |
| Following up with prospective customers who contacted us or met us | Name, business email, company, role, history of our interactions | Legitimate interest in offering our services to interested businesses | 2 years after the last interaction |
| Publishing your name, quote or photo as a customer reference | The details you approve | Consent | Until you withdraw consent |
| Keeping a record of opt-outs so we stop contacting you | Email, date of opt-out | Legitimate interest in respecting your objection | As long as needed to honour it |
We do not use advertising pixels or retargeting, and we do not give your data to advertising networks.
3.8 Security, abuse prevention and legal claims
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Protecting the Service and accounts against attacks, account takeover and misuse | IP address, user agent, request logs, sign-in events (WorkOS), security signals of our network provider (Cloudflare) | Legitimate interest in the security of the Service, our Customers and their End Users | Logs: 30 days; sign-in records kept by WorkOS under its own retention rules |
| Preventing abuse of the Free plan and circumvention of billing and enforcing our Acceptable Use Policy | Account and organization data, usage patterns, related correspondence | Legitimate interest in preventing fraud and keeping the Service fair | For the life of the account; for accounts terminated for abuse up to 2 years after closure |
| Handling notices of illegal content and our decisions on them | Notifier's name and email, the notice, our decision and statement of reasons, complaints | Legal obligation under Regulation (EU) 2022/2065 (Digital Services Act) | 3 years after the case is closed |
| Documenting security incidents and personal data breaches | Description of the incident, affected accounts and data, measures taken | Legal obligation (Art. 33(5) GDPR); legitimate interest in learning from incidents | 5 years |
| Handling your requests under data protection law | Your identity, the request and our response | Legal obligation (Art. 12 to 22 and Art. 5(2) GDPR) | 3 years after the request is handled |
| Establishing, exercising and defending legal claims and responding to authorities | Data relevant to the matter | Legitimate interest in protecting our rights; legal obligation where an authority orders it | For the limitation period and any proceedings |
3.9 AI features
3.9.1 Where the Dashboard offers AI features, such as generating a paywall from a description or an assistant, and when you use our integration for AI agents (MCP), we process your instructions (prompts), images you upload, the relevant content of your project (for example paywall definitions and product names), the generated output, your user identifier and the time of the request. AI features are optional.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Generating paywalls and other content and answering your requests in AI features | As in 3.9.1 | Contract | Outputs you keep become part of the project; prompts and other inputs only as long as needed to provide the feature; at the AI provider only as long as needed to produce the output and meet its legal obligations |
3.9.2 For AI features we send these inputs to OpenAI, L.L.C. or Anthropic, PBC (both USA), depending on the feature. They process them only to produce the output for us and do not use this data to train their models. We do not use Customer Data, Customer Content or End User data to train AI or machine-learning models, and we do not permit our AI providers to do so. If you connect your own AI agent through the agent integration, its provider receives data under your own arrangement with it.
3.9.3 AI output is marked as AI-generated in the interface. It can be inaccurate, so please review it before publishing. Do not include personal data of End Users in your instructions.
3.10 Anonymised statistics
3.10.1 We create aggregated statistics that do not identify any person, Customer or End User — for example overall event volumes, performance of the Service and platform-wide benchmarks such as typical paywall conversion rates. We use them to run, improve and present the Service.
3.10.2 For data we control, the legal basis is our legitimate interest in improving the Service. For Customer Data, we create such statistics on the Customer's documented instruction in the Data Processing Addendum. Once data is anonymised it is no longer personal data and we may keep it indefinitely; the source data is kept only for the periods stated above. We do not sell this data and do not try to re-identify anyone from it.
4. Where we get data from
4.1 Most data comes from you. We also receive data from:
- (a) the person who invited you, or your organization (section 3.4);
- (b) WorkOS, our authentication provider, and, for Enterprise customers, your organization's identity provider (name, email, directory identifiers, groups);
- (c) the sign-in provider you choose (GitHub, Google or Microsoft): name, email, profile picture and whether your email is verified. These providers are separate controllers under their own privacy policies;
- (d) Autumn and Stripe: payment status and customer identifiers for our billing;
- (e) Cloudflare: technical and security information about requests.
5. Mandatory and voluntary data
5.1 To create an account, you must provide an email address and accept the Terms of Service, which you do by signing up. To buy a paid plan, you must provide billing details; we need them to perform the contract and meet accounting and tax obligations. Without this data we cannot provide the Service.
5.2 Technical data in logs is collected automatically because the website and Service cannot be delivered or secured without it.
5.3 Everything else is voluntary: profile picture, feedback, support requests, customer references and use of AI features.
6. If you use an app that uses Voidhash (End Users)
6.1 Companies that build apps and websites ("app developers") use Voidhash to sell and manage in-app purchases and subscriptions, show paywalls, run experiments, send push notifications and analyse how their apps are used. If you use such an app, the app developer is the controller of your personal data and decides what is collected and why. We process that data only on the app developer's behalf and on its instructions as a processor, under our Data Processing Addendum.
6.2 Depending on how the app developer sets up the app, this data can include an app-specific user identifier, an email or name the developer provides, information about the device and app (model, OS version, language, time zone, app version), IP address and approximate location derived from it (country, region, city, time zone), how you use the app and its paywalls, your purchases and subscriptions, and a push notification token. Our SDKs do not read advertising identifiers (IDFA, GAID) or other device identifiers (IDFV, Android ID). Details are at voidhash.com/legal/sdk-data.
6.3 IP addresses. The Service receives the full IP address of your device with every request from the app and stores it with the events. It is used (a) to derive your approximate location (country, region, city and time zone); (b) to protect the Service, the app developer and you against security threats, fraud and abuse; and (c) where offered, to recognise the same End User across the app developer's own apps and websites, for example to connect a purchase made on the web with the app. The IP address is not used to link your activity across apps of different app developers.
6.4 Purchases and analytics. Processing your purchases — validating transactions with Apple, Google or Stripe, restoring purchases and granting access to what you bought (entitlements), including the identifiers and on-device storage this requires — is part of the service you requested from the app and runs without consent. Revenue reporting for the app developer (revenue, subscriptions, refunds) is calculated on our servers from those same transactions and needs no additional data from your device. Usage analytics — automatic events such as app opens and screen views, custom events, paywall views and interactions, and profile traits — may require your consent depending on where you live and how the app developer uses it. The app developer decides whether consent is needed, asks for it and switches usage analytics on or off accordingly, using the controls described at voidhash.com/legal/sdk-data.
6.5 How long data is kept. The retention period depends on the app developer's plan: 3 years on Free, 5 years on Grow, or as agreed for Enterprise. Usage events are kept for at least that period from when each event occurred; afterwards we may delete them or replace them with aggregated statistics that no longer identify you. Aggregated reports remain available while the app developer's account exists. Purchases, subscriptions and entitlements are kept while the app developer's account exists, because your access and the app's revenue history depend on them. Profiles with no activity for longer than the retention period may be deleted. The app developer can erase your data at any time, and when its contract with us ends the data is deleted as set out in the Data Processing Addendum.
6.6 To find out how your data is used or to exercise your rights, please contact the developer of the app — see the app's privacy policy or its listing in the App Store or Google Play. The app developer can access, export, correct and delete your data in the Service.
6.7 If you contact us instead, please tell us which app it concerns. We will forward your request to the app developer without undue delay and let you know that we did. We cannot decide on the request ourselves unless the law requires it. We use your contact details only to forward the request and keep a record of it (3 years; legal basis: our legal obligation to assist controllers under Art. 28(3)(e) GDPR and our legitimate interest in documenting how we handled the request).
6.8 We do not sell End User data, use it for our own advertising or combine data across app developers to profile End Users. Beyond the app developer's instructions, we only create anonymised statistics as described in 3.10 and use data as necessary to secure the Service and calculate usage for billing, as permitted by the Data Processing Addendum.
7. Who receives your data
7.1 We use the following service providers, which process personal data on our behalf under data processing agreements:
| Recipient | Purpose | Location |
|---|---|---|
| WorkOS, Inc. | Authentication, sign-in, organizations, single sign-on | USA |
| Railway Corporation | Hosting of the application and its cache | USA — Virginia (us-east4) |
| PlanetScale, Inc. | Primary database | USA — US East |
| Cloudflare, Inc. | Content delivery, DNS, encryption (TLS), network security, file storage, real-time collaboration | Global network for traffic; file storage (R2) in the USA (eastern North America) |
| Axiom, Inc. | Logs, traces and monitoring (30-day retention) | USA |
| Autumn (useautumn.com) | Subscription billing and usage metering for Voidhash plans | USA |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payment processing | Ireland, USA |
| Slack Technologies, LLC | Internal routing of in-app feedback | USA |
| Resend, Inc. | Email delivery (service emails, including usage notices) | USA |
| OpenAI, L.L.C. | Generating paywall content and assistant responses from your prompts and the content you provide (only when you use AI features) | USA |
| Anthropic, PBC | Generating paywall content and assistant responses from your prompts and the content you provide (only when you use AI features) | USA |
Transfers to recipients outside the European Economic Area are described in section 8.
7.2 The current list of subprocessors that process Customer Data, including End User data, is at voidhash.com/legal/subprocessors.
7.3 Other recipients:
- (a) other members of your organization, and other Customers where you publish components (3.3);
- (b) sign-in providers you choose, as separate controllers (4.1(c));
- (c) our professional advisers (lawyers, accountants, auditors), who are bound by confidentiality;
- (d) courts, public authorities and law enforcement, where the law requires us to disclose data;
- (e) a buyer or successor in a merger, acquisition or sale of our business, who will continue to process data under this policy; we will inform you in advance.
7.4 We do not sell your personal data.
8. Transfers outside the European Economic Area
8.1 Our hosting is in the United States. Our application, database, analytics store, logs and file storage run in the eastern United States (Virginia and the US East region), and our network provider Cloudflare carries traffic through its global network. Data you give us is therefore transferred to and stored in the USA, and some service providers may access it from other countries.
8.2 Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. The Data Privacy Framework is based on the European Commission's adequacy decision (EU) 2023/1795 and the Standard Contractual Clauses on its decision (EU) 2021/914. We combine them with supplementary measures such as encryption in transit and at rest, access restrictions and data minimisation.
8.3 If the Data Privacy Framework stops applying to a recipient, we will rely on the Standard Contractual Clauses. You can ask for a copy of the relevant safeguards at legal@voidhash.com.
9. Retention overview
| Data | How long we keep it |
|---|---|
| Account and organization data | For the life of the account; deleted within 30 days after it is closed |
| Contracts, records of acceptance of the Terms of Service and related correspondence | 4 years after the contract ends |
| Invoices and accounting records | 5 or 10 years as required by law (3.5) |
| Technical logs and traces | 30 days |
| Audit log | For the life of the project |
| Support requests and feedback | 3 years |
| Marketing | Until you opt out or withdraw consent; prospects 2 years after the last interaction |
| Security incident records | 5 years |
| Backups | Deleted on their regular rotation |
| End User data (processed for Customers) | As described in 6.5 |
10. How we protect data
Data is encrypted in transit, and our hosting providers encrypt stored data. Credentials that Customers give us for app stores and other integrations are additionally encrypted by our application, and webhooks we send to Customers are signed (HMAC) so that the recipient can verify them. Access to production systems is restricted to authorised personnel. Customer data is separated by organization and project. Please report vulnerabilities to legal@voidhash.com.
11. Your rights
11.1 Under the GDPR you have the right to:
- (a) access your personal data and receive a copy (Art. 15);
- (b) have inaccurate data corrected (Art. 16);
- (c) have your data erased (Art. 17), for example when we no longer need it;
- (d) restrict processing (Art. 18), for example while we check its accuracy;
- (e) data portability (Art. 20) — receive data you gave us on the basis of consent or contract in a structured, machine-readable format or have it sent to another controller;
- (f) object to processing based on legitimate interest (Art. 21), see 11.2;
- (g) withdraw consent at any time (Art. 7(3)), see 11.3;
- (h) lodge a complaint with a supervisory authority (Art. 77), see 11.5.
11.2 Right to object
You may object at any time to processing of your personal data for direct marketing, including profiling related to it. We will then stop using your data for that purpose — no reasons are needed. Use the unsubscribe link in any marketing email or write to legal@voidhash.com.
You may also object, on grounds relating to your particular situation, to processing based on our legitimate interest (sections 3.2 to 3.10). We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
11.3 Withdrawing consent does not affect processing carried out before the withdrawal. You can withdraw it in the same way you gave it, through the unsubscribe link, or at legal@voidhash.com.
11.4 Send requests to legal@voidhash.com or by post (1.2). You can change many details yourself in the Dashboard. We respond without undue delay and within one month; for complex or numerous requests we may extend this by two more months and will tell you why. Exercising your rights is free; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse. We may ask you to confirm your identity.
11.5 You may lodge a complaint with the Czech supervisory authority, or with the authority in the EU country where you live, work or where the alleged infringement occurred:
Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic; posta@uoou.gov.cz; +420 234 665 111; https://uoou.gov.cz.
We would appreciate the chance to resolve your concern first at legal@voidhash.com.
12. No automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Automatic security measures, such as rate limits or blocking of suspicious traffic, can temporarily restrict access; if that happens to you, contact legal@voidhash.com and a person will review it.
13. Children
The Service is intended for businesses. You must be at least 18 years old to create an account, and we do not knowingly collect personal data of children as a controller. If you believe a child has given us personal data, contact legal@voidhash.com and we will delete it. Customers whose apps are used by children are responsible for the related legal requirements in their apps.
14. Cookies
voidhash.com uses only cookies and browser storage that are strictly necessary for the website and Dashboard to work or that remember settings you choose. None of them requires consent, so we do not ask for it. We use no analytics, advertising or third-party tracking cookies; if we ever introduce non-essential cookies, we will first ask for your opt-in consent and update this policy. Details are in the Cookie Policy at voidhash.com/legal/cookies.
15. Notice for California residents
15.1 For End User data we act as a "service provider" (processor) for our Customers. For personal information we collect for ourselves, in the past 12 months we collected these categories under the California Consumer Privacy Act (CCPA): identifiers (name, email, IP address, account identifiers), commercial information (plan and billing history), internet or other electronic network activity (logs and use of the Dashboard), professional information (company and role) and account login credentials (handled by WorkOS). We collect them for the purposes in section 3, disclose them to the recipients in section 7 and keep them for the periods in section 9.
15.2 We do not sell or share personal information (including for cross-context behavioral advertising), have not done so in the past 12 months, and do not use sensitive personal information for purposes other than providing the Service.
15.3 You have the right to know and access, delete and correct your personal information, and not to be discriminated against for exercising these rights. Send requests to legal@voidhash.com; we will verify your identity. You may use an authorised agent, who must provide proof of authorisation.
16. Notice for United Kingdom residents
For people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply in the same way as described in this policy. Transfers from the UK rely on the UK Extension to the Data Privacy Framework or the UK Addendum to the Standard Contractual Clauses. You may complain to the Information Commissioner's Office (ico.org.uk).
17. Changes to this policy
We will update this policy when our processing changes. We will inform you of material changes by email or in the Dashboard at least 14 days before they take effect, unless a change is required by law or urgently needed for security. The date of the current version is stated at the top; previous versions are available on request at legal@voidhash.com.