Privacy Policy

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Company (referred to as either “the Company,” “We,” “Us,” or “Our” in this Privacy Policy) refers to Voc Hotline, Seattle, WA.
• Cookies are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to: Washington, United States.
• Device means any device that can access the Service, such as a computer, a cell phone, or a digital tablet.
• Personal Data (or “Personal Information”) is any information that relates to an identified or identifiable individual.
• Service refers to the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company — third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform Service-related services, or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
• Website refers to Voc Hotline, accessible from https://voc-hotline.org/.
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.

HIPAA and Client Information

Voc Hotline does not represent that voc-hotline.org complies with the Health Insurance Portability and Accountability Act (HIPAA) or other health-privacy laws. We are not a covered entity or business associate under HIPAA in connection with Your use of the Service, and We do not enter into Business Associate Agreements for use of the website.

If You are a vocational rehabilitation counselor, healthcare provider, or other professional who works with client information, You must not use the Service to process, transmit, or store PHI or other client PII. Ask general, de-identified questions only (for example, about a rule or procedure — not about a named individual or specific claim). You are solely responsible for ensuring that Your use of the Service complies with Your employer's policies, professional obligations, and applicable privacy laws.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. This includes:

• Email address (required to create and access Your Account).
• Name (an optional display name You may provide).

Content You submit

When You use the assistant, We store the questions You ask and the answers You receive so We can provide the Service, maintain Your conversation history, enforce usage limits, and review and improve answer quality. Please do not enter client personally identifiable information (PII) or protected health information (PHI) into the assistant. The Service is not HIPAA compliant and is not intended for use with client-identifying or health-related information. The app detects common PII patterns and prompts You to redact them before sending, but You remain responsible for the content You submit.

Payment information

During the industry beta, the Service is offered at no charge. If We introduce billing in the future, payment processing may be handled by Stripe, our payment Service Provider. In that case, card details would be entered on Stripe's systems; We would not store full card numbers and would retain only a Stripe customer identifier to manage Your account.

Security information

To secure Your Account, We store a hashed (not plaintext) password, encrypted two-factor authentication secrets and backup codes, passkey credentials You register, and session records used to enforce concurrent-session limits.

Usage Data

Usage Data is collected automatically when using the Service and may include information such as Your Device's Internet Protocol address (IP address), browser type and version, the pages of the Service that You visit, the time and date of Your visit, and other diagnostic data (for example, server access logs used for security and troubleshooting).

Tracking Technologies and Cookies

We use only essential, first-party cookies that are necessary to operate the Service. In particular, We use session cookies to authenticate You and keep You signed in, and to protect against fraudulent use of accounts. Without these cookies, the services You have asked for cannot be provided. We do not use advertising, remarketing, or third-party analytics tracking cookies. You can instruct Your browser to refuse cookies, but some parts of the Service may not function as a result.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including to deliver answers grounded in official guidelines, monitor usage, and operate, secure, and troubleshoot the Service.
• To manage Your Account, including authenticating You at login, securing Your account with two-factor authentication, preventing account sharing, and enforcing concurrent-session limits.
• For the performance of a contract, namely providing the Service and managing Your account and access during the industry beta.
• To contact You by email for account and Service-related communications (such as verification and password resets), about continued access or beta discounts you may be eligible for, and for important security or Service updates.
• To maintain Your conversation history so You can revisit and, if You choose, share Your conversations.
• To improve the Service, including reviewing thumbs-down feedback, correcting guidance, identifying usage trends, and evaluating and improving answer quality.
• To manage Your requests, to attend to and manage Your requests to Us.
• For business transfers, We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, in which Personal Data held by Us is among the assets transferred.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not sell Your Personal Data, and We do not use it for third-party advertising.

Sharing of Your Personal Data

We may share Your Personal Data in the following situations:

• With Service Providers who process data on Our behalf to operate the Service — for example, our payment processor (Stripe), our transactional email provider (Postmark, which processes account emails in the European Union), the AI and embeddings providers used to generate answers, and our hosting and database providers.
• With other users, when You choose to share a conversation. A shared conversation is accessible to anyone with the link until You revoke it.
• For business transfers, in connection with any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business.
• For legal reasons or with Your consent, as described in the Disclosure section below.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, and to comply with our legal obligations, resolve disputes, and enforce our agreements and policies. Where possible, We apply shorter retention periods and reduce identifiability by deleting, aggregating, or anonymizing data. We apply different retention periods to different categories of data:

• Account information (email, name) is retained for the duration of Your account relationship and, after account closure, for up to 24 months to resolve disputes or comply with legal obligations.
• Conversation history. During the industry beta, saved conversations are retained through the beta end date and for a limited window afterward unless You delete them or close Your account. After the beta, retention periods may change; We will update this policy when they do.
• Question and answer logs used for service quality, monitoring, and abuse prevention are retained for approximately 30 days and then automatically deleted, except where We must retain specific records for security or legal reasons.
• Usage Data and server logs (such as IP addresses and access times) are retained for up to 24 months for security monitoring, fraud prevention, and troubleshooting.

We may retain Personal Data beyond these periods where required by law, where the data is necessary to establish or defend legal claims, at Your explicit request, or where residual copies remain in encrypted backups scheduled for routine deletion. When retention periods expire, We securely delete or anonymize Personal Data. You may request information about how long We will retain Your Personal Data by contacting Us.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This information may be transferred to — and maintained on — computers located outside of Your state, province, country, or other governmental jurisdiction where data protection laws may differ. Where required by applicable law, We will ensure international transfers are subject to appropriate safeguards, and We will take all steps reasonably necessary to ensure Your data is treated securely and in accordance with this Privacy Policy.

Delete Your Personal Data

You have the right to delete, or request that We assist in deleting, the Personal Data We have collected about You. The Service gives You the ability to delete certain information from within Your account, and You may update or amend Your information by signing in and visiting Your account settings. You may also contact Us to request access to, correction of, or deletion of any Personal Data You have provided. Please note that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of the Company, prevent or investigate possible wrongdoing in connection with the Service, protect the personal safety of users of the Service or the public, or protect against legal liability.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We use commercially reasonable measures to protect it — including hashing passwords, encrypting two-factor secrets and backup codes at rest, and requiring two-factor authentication — but no method of transmission over the Internet or method of electronic storage is 100% secure, and We cannot guarantee its absolute security.

Children's Privacy

Our Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 16 without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click a third-party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date above, and, where appropriate, by email or a prominent notice on the Service. You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

Contact Us

If You have any questions about this Privacy Policy, You can contact us:

• By email: privacy@voc-hotline.org
• By visiting this page on our website: https://voc-hotline.org/privacy