Privacy policy

This policy explains what personal data Vott holds, why, who else sees it, how long it is kept, and what you can make us do about it. We have tried to write it so that every sentence is true of the product as it runs today — where something is not built yet, we say so instead of implying otherwise.

The short version

• The AI employees are AI. What you say to them is processed by AI systems — ours and our providers' — because that is how the answers are made.
• We do not record calls. We keep your chat conversations for 12 months so they are there on any device — you can delete them at any time — plus short memory notes an AI employee writes after a conversation, your tasks and their results, and your account details.
• We do not sell your data, share it for advertising, or train AI models on it.
• Our database is in Germany. Some of our providers process data in the United States and Singapore; section 7 explains how that is protected.
• Paid plans are not on sale yet. Before they open, this policy will name who processes payments.
• You can ask us to see, correct or delete your data at privacy@vott.work.

---

1. Who we are

Vott is operated by Novon Tech LLP, a limited liability partnership registered in the Republic of Kazakhstan (BIN 260840013395), with its registered office at 208/5 Navoi Street, office 6, Almaty 050043, Kazakhstan. We are the controller of the personal data this policy describes.

Privacy questions and requests: privacy@vott.work.

2. What this policy covers — and what it does not

It covers the website at vott.work, the Vott web application, the AI employees you chat and talk to, our emails, and your dealings with us.

It does not cover:

• Personal data about other people that a business customer puts into Vott. For that data, the customer is the controller and we process it on their behalf under our Data Processing Addendum, which business customers can ask for at legal@vott.work; the customer's own privacy notice applies.
• Payments. When paid plans open, the payment provider named at checkout will process your payment under its own privacy notice.
• Google's own processing when you choose to sign in with Google.

3. What we collect

3.1 Your account

• Email address, and the identifier our sign-in provider assigns to your account.
• Your password is never seen by us. Sign-in is handled by Supabase, which holds your credentials and gives us a signed token.
• If you sign in with Google, Google shares your name, email address and profile picture with our sign-in provider. We use them only to create and identify your account; we do not ask Google for access to anything else in your Google account, we do not use Google data for advertising, and we do not share it with anyone except our sign-in provider.

• Plan: which plan your account is on and when it renews.

3.2 Your profile (optional)

If you add them in Settings: your name, your company and your preferred language.

3.3 Conversations with AI employees

• Chat. Your messages are sent to AI providers to produce the replies. We keep the conversation — what you wrote and what the AI employee answered — so that it is still there in another tab or on another device. Each message is deleted automatically 12 months after it was sent. You can delete your whole chat history at any time in Settings, and closing your account deletes it too. We do not keep the AI employee's internal instructions or tool activity with it.
• Calls. When you talk to an AI employee, your voice is streamed in real time to an AI provider. On most calls that is OpenAI's realtime voice model, which listens and answers in speech; when it needs to look something up or act for you, the words of your request go on to our language model. On the other calls your voice goes to a speech-recognition service that turns it into text, and a voice detector on our server sends it only the stretches that contain speech. We do not record calls, and we do not keep call audio, video or transcripts.
• Your camera is never used — Vott asks your browser for the microphone only. The video you see is the AI employee's, and it is generated.
• The calls themselves are not kept. When a call ends, its transcript is used once to write memory notes and is then discarded.
• Memory notes. At the end of a chat or call, an AI model reads the conversation once and writes a few short notes — for example your name, how you like to work, details of your project, and decisions you made — so the AI employee is useful next time. We store each note with its kind, an importance score and a numerical index used to search it. Memory notes are separate from your chat history: deleting the chat history does not delete them (see section 5).

3.4 Tasks and results

When you give an AI employee work, we store the task — its title, your brief in your own words, its status and priority — and, once it has run, the result and any files it delivered to you. We also record technical details of each run (which model ran it, how long it took, how much it cost us).

3.5 Usage records

We count what your account uses — tasks, call minutes, and the amount of AI processing each request needed — and keep a ledger of your allowances. These records hold numbers and dates, not the content of your conversations.

3.6 Payments

Paid plans are not on sale yet, so we hold no payment data. Before they open, this section will say what the payment provider shares with us.

3.7 Notifications and emails

• In-product notifications — for example that a task finished or failed — are stored with their type and whether you have read them.
• Account emails (confirming your address, resetting your password) are sent through our email provider.
• When you write to us, we keep the correspondence to deal with your request.

3.8 Newsletter

If you enter your email address in the sign-up field on our website, we store it with where and when you gave it. We have not sent anything to that list yet; before we do, we will ask you to confirm your address, and every email will contain an unsubscribe link (see section 14).

3.9 Technical data

• Abuse protection. The newsletter field is open to anyone, so we count attempts per network address to stop automated flooding. Each attempt is stored with the network (IP) address and a timestamp, and deleted automatically after one hour.
• Request log. Our server writes one line per AI request: time, which AI employee and channel, which model, internal identifiers, timings, token counts and error codes. It contains no message text, briefs, transcripts or audio, and no IP addresses. Our web server keeps no access log.
• Call connections. Our call provider and our video-avatar provider connect directly to your browser, so they see your IP address and basic connection data. Our call provider keeps call metadata (such as when a call started and ended, and connection quality) for 30 days, and may keep samples of call audio for up to 12 months to improve its noise and voice processing.
• Visit statistics. To know how many people visit vott.work and how they find it, we count visits to our public pages — the home page, help, the blog, the legal pages and the sign-in and sign-up pages — with Umami, a statistics tool that runs on our own server in Germany. Nobody else receives this data. For each page view it records the page address (without any query details except campaign tags), the page title, the address of the page that sent you (without its query details), your browser, operating system, type of device, screen size and language, and the country, region and city worked out from your IP address. The IP address itself is not stored. To count unique visitors, the server turns your IP address and browser details into a one-way code that changes every month. It sets no cookies and writes nothing to your browser's storage. The screens of the app after you sign in are not counted, and neither is any visit from a browser that sends Global Privacy Control or Do Not Track.
• Session recordings and heatmaps — only if you accept. Our banner asks whether you agree to two more things on our public pages. If you accept, Umami, on the same server, also records how you use those pages: what the page showed and how you moved through it — mouse movements, clicks, scrolling and window size — with everything you type into fields hidden. It also collects where on each page people click and how far they scroll (heatmaps). Nothing is recorded on the screens of the app after you sign in: there the recording is switched off and nothing is sent.
• Google Analytics — only if you accept. If you accept, Google Analytics, a service of Google, also records the public pages you view (with the same clean addresses as above), how you arrived, how long you stay, your device, browser and approximate location. It recognises your browser by its cookies (section 11). Google receives your IP address to estimate your location and says it does not store it. We have turned off Google's advertising features, Google signals and sharing this data with Google's other products. Google processes this data in the United States.

You can change your answer at any time under Cookie settings. If you withdraw it, we delete Google Analytics' cookies in your browser and stop both. Recordings already made are deleted 30 days after they were made, and what Google Analytics already received is kept for 14 months (section 8).

4. Why we use it, and our legal bases

If you are in the EU, the UK or a country with similar law, we need a legal basis for each use:

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

5. How the AI works with your data

• AI providers do the processing. To answer you, your messages, the relevant memory notes and the AI employee's instructions are sent to a language-model provider; to speak, the reply is sent to a voice provider; on a call, your voice and the AI employee's instructions go to a realtime voice model; to show the AI employee on a video call, its voice is sent to an avatar provider. Section 6 lists who they are.
• No training. We do not use your data to train or fine-tune AI models. We configure our providers so that they do not train on it either, wherever their terms allow us to.
• What you control. You can delete your chat history yourself in Settings. To delete an AI employee's memory notes about you, write to privacy@vott.work — there is no button for that yet.
• AI can be wrong. Memory notes are written by an AI and can contain mistakes. Tell us and we will correct or delete them.

6. Who else sees your data

We share personal data only with the providers that run parts of Vott for us, and only what each needs for its part. We put data processing terms in place with each of them; our Subprocessors page lists every provider, what it receives, where, and where those terms stand. In summary:

• Hosting and database: Hetzner Online (Germany).
• Website analytics, only if you accept it: Google (United States).
• Sign-in: Supabase (data stored in Frankfurt, Germany).
• AI language models, search over memory notes, and speech recognition: Alibaba Cloud (Singapore) and Groq (United States).
• Realtime voice on calls: OpenAI (United States).
• Backup language model, used when our main one is unavailable, and for building software projects: OpenRouter (United States), which passes the request to the model's provider.
• Voices: Cartesia (United States).
• Calls: LiveKit (United States).
• Video avatars: LemonSlice (United States).
• Email: Resend (United States).

We also share data:

• with Google, if you choose Google sign-in;
• with authorities, when the law requires it, and to protect our rights, our users or the public;
• with a buyer or successor, if our business is sold or reorganised, under this policy.

We never sell personal data, and we never share it for targeted advertising.

7. International transfers

We are based in Kazakhstan. Our database is in Germany. Some of our providers process data in the United States and Singapore. None of these countries is recognised by the EU as offering adequate protection except where a specific arrangement applies, so, for data of people in the EU, the UK and Switzerland, the safeguard is the European Commission's standard contractual clauses (with the UK addendum where needed) in each provider's data processing terms or, where a US provider is certified, the EU-US Data Privacy Framework. Our Subprocessors page shows, provider by provider, whether those terms are already in place or still being arranged. You can ask us for a copy of the relevant safeguards at privacy@vott.work.

8. How long we keep it

We may keep data longer where the law requires it or to establish, exercise or defend legal claims.

9. Security

• Sign-in tokens are verified on every request; we never hold passwords.
• Each customer's data is separated by the database itself, not only by our code: the database enforces per-account access rules.
• API keys for our providers stay on our servers and never reach your browser.
• All traffic to vott.work is encrypted in transit.
• Only the founder has administrative access to production.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct it;
• delete it;
• restrict or object to how we use it, including any use based on our legitimate interests;
• receive it in a portable format;
• withdraw consent where we rely on it — for example for the newsletter — without affecting what we did before;
• complain to a data protection authority — in the EU, the authority in the country where you live or work; in the UK, the Information Commissioner's Office.

People in California and other US states with privacy laws also have rights to know, delete and correct, and not to be discriminated against for using them.

How to exercise them. Email privacy@vott.work from the address on your account. We may ask you to confirm your identity. We answer within one month (the law allows us to extend that by up to two further months for complex requests, and we will tell you if we do). You can delete your chat history yourself in Settings, and cancel a paid plan there too. The rest is manual today: deleting memory notes, closing an account and exporting its data are done by us on request, not by a button.

11. Cookies and similar technologies

Without asking, we use only what the service needs to work, plus our own count of visits to the public pages, which sets no cookies and writes nothing to your browser (section 3.9). We use no advertising cookies. Google Analytics and the recording of our public pages run only if you accept them in our banner, and you can change your answer at any time under Cookie settings.

Items in your browser's storage stay on your device; of the items above, only the cookies are sent to our servers. Web fonts are served from vott.work itself. On the sign-in and sign-up pages, the Sign in with Google button loads from Google's own site, and Google's privacy policy applies to it. The visit statistics and recording scripts load from stats.vott.work, which is our own server; Google Analytics loads from Google's site only after you accept it.

12. If you are in Kazakhstan

We are a Kazakh company, and the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" applies to our processing. If you are a citizen or resident of Kazakhstan:

• Cross-border transfer. Your data is stored in Germany and processed by the providers listed in section 6 in the European Union, the United States and Singapore. We ask for your consent to this transfer when you create your account, and you can withdraw it by closing your account.
• Your rights under that law include knowing whether we hold your data and what it is, having it corrected or blocked, having it deleted, and withdrawing consent. Write to privacy@vott.work.

13. Children

Vott is a work tool for people aged 18 and over, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

14. Newsletter

We send the newsletter only if you signed up for it. Every email will contain an unsubscribe link, and you can also unsubscribe by writing to privacy@vott.work.

15. Changes to this policy

When we change this policy, we publish the new version here with a new effective date. If a change is material, we tell you by email or in the product before it takes effect.

16. Contact

Novon Tech LLP · BIN 260840013395 · 208/5 Navoi Street, office 6, Almaty 050043, Kazakhstan · privacy@vott.work