Privacy Policy

1. Data Collection & Canadian PIPEDA Compliance

GVOTS ("we", "us") operates the Generative Voice & Text Studio platform (gvots.tech). We are committed to protecting the confidentiality, integrity, and security of software architecture artifacts, voice recordings, source code, and user credentials. Our information collection practices strictly comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada and the applicable privacy statutes of the Province of Ontario. We collect only the minimum required personal and technical data: account emails, encrypted credentials, technical prompts, and ephemeral voice audio buffers.

2. Ephemeral Voice Audio Processing & Memory Sanitization

Voice recordings captured through the browser via WebM Opus audio chunks are streamed over encrypted TLS 1.3 connections to our transcription pipeline. Spoken audio buffers are retained solely in volatile RAM for the duration required to extract natural speech transcription and technical entities. Once the JSON specification response is returned to the client, binary audio buffers are immediately and irrevocably purged from server memory. Raw voice audio is never stored on persistent storage disks.

3. Customer Source Code & Architectural Confidentiality

When engineering teams upload or input source code files (.ts, .py, .go, .rs, .sql), system architectures, or technical PRDs, GVOTS treats these artifacts as strictly confidential proprietary assets. Source code buffers are processed within isolated runtime sandbox boundaries. GVOTS claims zero intellectual property or commercial interest in your code, schemas, or engineering outputs.

4. Strict Zero-Training Guarantee

We enforce an immutable, legally binding Zero Model Training Guarantee across all subscription tiers (Free Starter, Pro, and Team). Customer voice recordings, transcription buffers, uploaded architectural diagrams, database migration scripts, and generated functional specifications are strictly never used to train, retrain, fine-tune, or calibrate public, proprietary, or foundational AI models.

5. Sub-Processors & North American Cloud Storage

GVOTS operates dedicated enterprise cloud infrastructure hosted entirely within SOC2 Type II and ISO 27001-certified North American availability zones. Primary computation clusters, database storage, and inference pipelines are hosted within isolated VPC enclaves in Toronto (Canada Central) and Virginia (US East). We maintain strict Data Processing Agreements (DPAs) with infrastructure sub-processors guaranteeing zero unauthorized third-party access and zero secondary data retention.

6. Cryptographic & Enterprise Security Measures

All network communication between client web browsers and GVOTS studio clusters is protected using modern Transport Layer Security (TLS 1.3) with perfect forward secrecy. Persistent workspace states, account credentials, and quota trackers stored in cloud databases are encrypted at rest using AES-256 cryptographic standards. Session tokens and API credentials are cryptographically hashed and salted using industry-standard hashing algorithms.

7. Cookie Policy & Local Storage Persistence

GVOTS utilizes strictly necessary functional cookies and browser HTML5 localStorage to maintain authenticated user sessions, UI theme preferences (dark/light mode), and uncommitted offline workspace state. We do not deploy third-party advertising tracking cookies, behavioral tracking pixels, or cross-site data brokers. Users may clear local storage or cookies at any time via browser settings without impairing core export capabilities.

8. Data Retention Schedules & Automated Deletion

Active accounts retain workspace specifications until the user explicitly deletes them via the Studio sidebar. If an account is closed or inactive for greater than 12 months, all associated workspaces, message logs, and credential hashes are permanently sanitized from backup archives within 30 days. Voice audio buffers are purged instantaneously following transcription synthesis.

9. User Rights under PIPEDA & GDPR

Under Canadian PIPEDA and international privacy frameworks, users maintain comprehensive data sovereignty rights:

• Access & Portability: Immediate access to a machine-readable archive of all specifications via Markdown (.MD) export and Export Project Bundle (.ZIP / Multi-Artifact Archive).
• Right to Rectification: Correction of incomplete or inaccurate account profile information.
• Right to Erasure ("Right to be Forgotten"): Permanent deletion of account credentials and stored workspaces within 30 calendar days upon request.
• Consent Revocation: Revocation of permissions for technical communications without penalty.

10. Contact Information & Privacy Officer

To exercise your privacy rights, request an enterprise Data Processing Addendum (DPA), or contact our Data Privacy Officer, please email support@gvots.tech or write to: