Privacy Policy

1. Who we are

This Privacy Policy explains how VOTLI ("we", "us", "our") collects and processes personal data in connection with the VOTLI platform available at votli.app and related services (the "Service").

The data controller for information you provide to us as a VOTLI customer is Lameen, registered at [Registered Address]. For questions, contact [email protected].

2. Scope

This policy covers personal data we process as a controller — i.e., data about VOTLI's own customers, website visitors, and prospects. When our customers use VOTLI to host waitlists, support, deletion requests or other end-user facing features, VOTLI acts as a processor on their behalf. In that case, our customers are the controllers, and their own privacy policies apply. See our Data Processing Addendum for those terms.

3. What we collect

3.1 Account data

When you sign up for VOTLI we collect:

• Your name and email address (via our single sign-on provider, WorkOS).
• Your team / workspace name.
• Authentication identifiers and session information.

3.2 Billing data

If you purchase a paid plan, our payment provider collects and processes your billing information (card details, billing address, tax identifiers). We do not store full card numbers on our servers. We retain invoices and payment records for tax and accounting purposes.

3.3 Content you create

Apps, pages, waitlist subscribers, support tickets, deletion requests, custom domains, API keys, and any text or media you upload. This content belongs to you; we process it to provide the Service.

3.4 Usage and technical data

• IP address, browser user-agent, device and operating system information.
• Pages visited, features used, timestamps, and error logs.
• Cookies and similar technologies — see our Cookie Policy.

3.5 Communications

Emails, support tickets, contact form submissions, and any other correspondence you send us.

4. How we use personal data

We process personal data for the following purposes:

• Provide and operate the Service — creating accounts, hosting your apps and pages, delivering features.
• Billing and payments — processing subscriptions, issuing invoices, preventing fraud.
• Support — responding to your questions and troubleshooting issues.
• Security and abuse prevention — detecting malicious activity, rate limiting, protecting the integrity of the Service.
• Product improvement — understanding how features are used so we can improve them.
• Legal compliance — meeting tax, accounting, and regulatory obligations.
• Marketing — sending product updates to existing customers, and launch announcements to people who explicitly joined our waitlist. You can opt out at any time.

5. Legal bases (EU / UK users)

Under the GDPR and UK GDPR we rely on the following legal bases:

• Contract — to deliver the Service you signed up for.
• Legitimate interests — to secure, operate, and improve the Service; to market to existing customers.
• Consent — for non-essential cookies and waitlist marketing emails. You can withdraw consent at any time.
• Legal obligation — for tax, accounting, and law-enforcement requests.

6. How we share personal data

We share personal data only with:

• Sub-processors — vendors that help us operate the Service (hosting, email, analytics, authentication, payments). See our full Sub-processors list.
• Your team members — other users you invite into your workspace.
• Authorities — when compelled by a valid legal order or to protect rights, property, or safety.
• Successors — if VOTLI is acquired or merged, personal data may transfer to the acquirer under equivalent terms.

We do not sell personal data, and we do not use your content to train third-party AI models without your explicit instruction.

7. International transfers

Some of our sub-processors are based outside the EEA / UK. When personal data is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

8. Retention

• Account data — while your account is active, then deleted within 90 days after closure (subject to legal hold).
• Content — retained while the hosting workspace exists. On closure, content is deleted within 90 days.
• Billing records — retained for up to 10 years for tax and accounting compliance.
• Security and audit logs — up to 12 months.
• Support correspondence — up to 3 years.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (where we're not required to retain it).
• Port your data to another service.
• Object to or restrict certain processing.
• Withdraw consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected]. We respond within 30 days.

10. Security

We protect personal data with TLS in transit, encryption at rest where supported, role-based access controls, and regular backups. No system is perfectly secure, but we take reasonable technical and organisational measures to reduce risk.

11. Children

VOTLI is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will notify customers of material changes by email and update the "Last updated" date at the top of this page.

13. Contact

Questions, complaints, or requests: [email protected].