Privacy Policy.

BasedVox LLC, an Arizona limited liability company trading as Guruvox, is the data controller responsible for personal information collected through the Guruvox service. For any privacy questions, requests, or complaints, contact us at admin@basedvox.com.

Mailing address: BasedVox LLC, 4539 N 22nd St, Suite B, Phoenix, AZ 85016, United States. Entity details on public record at the Arizona Corporation Commission.

Information you provide directly. Your name, email address, phone number, brand or organisation name, website or handle, contact number, the letter of intent, the answers you supply on our voice questionnaire, and any material you upload for us to ingest into your voice corpus (existing posts, articles, brand documents).

Authentication data. When you sign in with Google, we receive your Google account's verified email address, display name, unique Google user ID, and profile photo URL from Google.

Payment data. Payments are handled by a PCI-DSS-compliant third-party payment processor. Guruvox does not receive or store your full credit-card number, expiry, or CVC; we store only a processor-issued customer identifier and last-four digits of the card on file.

Credentials we create for you. Where you opt in during setup, we may create an email account, a business messaging number, and platform accounts on your behalf. We store the associated credentials (passwords, two-factor authentication seeds, session tokens) encrypted at rest using symmetric encryption.

Content we author on your behalf. Drafts, published posts, comments, articles, and ads we produce for you are stored in our system, along with your approve / reject decisions on each draft.

Operational metadata. Information about the device on which you install the Guruvox app (operating system, hostname, IP address as seen at install time, browser version), and about your remote-access sessions with us (session start / end time, initiating operator, session logs).

Usage data. Server-side logs of how you use the my.guruvox.com portal (pages viewed, actions taken, timestamps), and per-platform performance data (engagement counts, publication timestamps).

Communications. Any correspondence between you and our team (email threads, in-portal chat messages, notes).

We use the information above to: (a) deliver the service (write, publish, moderate, respond); (b) authenticate you and provide access to your account; (c) charge you and manage your subscription; (d) sign in on your behalf to third-party platforms and act on your behalf on those platforms; (e) provide customer support; (f) monitor and improve service quality; (g) comply with legal obligations; (h) detect, investigate, and prevent fraudulent or abusive activity; (i) enforce our Terms of Service.

We do not use your personal information for advertising, and we do not sell or rent your personal information to third parties.

To deliver the service, we engage a small number of vetted third-party service providers ("processors") who process personal information on our behalf. We select processors based on their security posture, data-handling reputation, and applicable compliance certifications. Every processor is bound by a written data-processing agreement that requires them to protect your information, to use it solely for the purpose we specify, and to notify us of any incident affecting your information.

Our processors fall into the following categories:

Authentication and identity. Providers that verify your sign-in identity and manage session security.

Payment processing. A PCI-DSS-compliant provider that handles subscription billing, refunds, and payment-method tokenisation.

Hosting, storage, and infrastructure. Enterprise cloud providers that host our application, store our databases, run our search and retrieval systems, and provide network services.

Transactional email delivery. A provider that delivers account-related email (welcome, receipts, security notices) on our behalf.

Endpoint management and remote access. An enterprise endpoint-management provider we use to install, configure, and maintain the software on your designated workstation, subject to the informed consent you give under our Terms of Service.

Content-generation infrastructure. Large-language-model providers we access through an aggregator, used to draft content on your behalf. Content sent to these providers is processed for the sole purpose of returning a drafted response and, under our contractual terms with them, is not used to train their models.

Publishing destinations. Every third-party platform (social network, news publisher, community-group platform) on which we publish your content on your behalf. Content sent to these platforms is public by design; those platforms have their own privacy policies which govern their handling of that content.

Public availability of specifics. We do not publish the specific identities of our processors on this page. The concrete vendor stack changes as we evaluate new providers and retire old ones, and publishing it invites social-engineering and supply-chain reconnaissance. If you require the specific identity of the processor handling any category above (for example, to satisfy your own vendor-risk assessment or regulatory reporting), email admin@basedvox.com and we will provide it under a mutually acceptable confidentiality obligation.

Active subscription. For as long as you are a paying subscriber, we retain the information described in Section 2, plus your full history of drafts and published content, so we can continue delivering the service.

After termination. If your subscription ends, we retain your application record, subscription history, credentials we created for you, draft history, and published-content history for 12 months to support billing, audit, dispute resolution, and legal-hold obligations. After 12 months, we purge this information from our production systems.

Earlier purge on request. You may request earlier purge at any time via admin@basedvox.com. We will complete the purge within 30 days unless a legal obligation requires longer retention (in which case we tell you why).

Server logs and backups. Server logs are retained for up to 30 days for operational and security purposes. Encrypted backups may retain snapshots of your information for up to 60 days beyond the primary retention period, after which they are overwritten.

We take security seriously and apply industry-standard technical and organisational measures to protect your information, including: encryption in transit (TLS 1.2 or higher) and at rest (symmetric encryption for high-sensitivity fields such as credentials, plus provider-level encryption at the storage layer); role-based access controls; least-privilege access for our operational team; audit logging of privileged operations; two-factor authentication on internal admin surfaces; regular dependency updates; and reliance on infrastructure providers that maintain SOC 2, ISO 27001, or equivalent independent security attestations.

However, no system is perfectly secure. We cannot guarantee absolute security of information transmitted over the internet or stored electronically. In the event of a security incident affecting your personal information, we will notify you and, where required, applicable regulators within the timeframes required by law.

You are responsible for maintaining the security of the Google account you use to sign in to Guruvox. Report any suspected unauthorised access to admin@basedvox.com immediately.

Guruvox is operated from the United States. If you are located outside the United States, your information will be transferred to, stored in, and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for transfers from the United Kingdom, the UK Addendum to the SCCs issued by the ICO, as our transfer mechanism. If you would like a copy of the executed transfer safeguards that apply to your data, contact admin@basedvox.com.

Subject to the laws of your jurisdiction, you have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; delete your information (subject to legal-hold obligations); restrict or object to certain processing; portability of your information to another service; and withdraw consent where processing is based on consent.

To exercise any of these rights, contact admin@basedvox.com. We will respond within 30 days.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.

California residents (CCPA / CPRA). If you are a California resident, in addition to the rights above you have the right to know the categories of personal information we collect and the purposes for which we use them (Section 2), the right to know and to request deletion of specific pieces of personal information we hold about you, the right to correct inaccurate information, and the right to non-discrimination for exercising any of these rights. We do not sell or share your personal information for cross-context behavioural advertising, so no "Do Not Sell or Share My Personal Information" mechanism is required; if this ever changes, we will update this policy and provide the link. To exercise your California rights, email admin@basedvox.com; we may need to verify your identity before responding.

The Guruvox customer portal at my.guruvox.com uses a small number of first-party cookies to maintain your signed-in session (an HMAC-signed session cookie set after Google Sign-In). We do not use third-party advertising, analytics, or tracking cookies on our marketing site guruvox.com or on the portal.

The Guruvox app installed on your machine stores a small amount of local data (studio pairing, per-platform session state) on your device. This data is not transmitted to third parties beyond our own service.

Guruvox is not intended for anyone under 18. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child under 18, we will delete it. If you believe a child has provided us with personal information, contact admin@basedvox.com.

We may update this Privacy Policy from time to time. Material changes will be notified to you at the email address on file at least 14 days before they take effect. Non-material changes (clarifications, formatting) may be made without notice; the "Last updated" date at the top of this page always reflects the current version.

BasedVox LLC · admin@basedvox.com

Mailing address: BasedVox LLC, 4539 N 22nd St, Suite B, Phoenix, AZ 85016, United States. Entity details on public record at the Arizona Corporation Commission.