Privacy Policy

Who is responsible for your data

Jscriptech, MB (company code 305972924), V. Nagevičiaus g. 3, Vilnius, Lithuania, provides DingVoice. Contact privacy@dingvoice.com about personal data. We act as controller for account administration, our billing and legal records, service security, support, and our own optional analytics and marketing.

For personal data in business records that customers upload or connect, the customer normally decides the purposes and acts as controller; we act as processor under our Data Processing Agreement. If the customer is itself a processor, we act as its subprocessor. Requests about an employer's, supplier's, or client's workspace records should normally go to that organization; we assist it where appropriate.

Data we collect and sources

Depending on the features you use, we receive data from you, authorized workspace users, connected providers, your browser or device, and support communications:

• Account and contact data: name, email, authentication identifiers, workspace membership, and account preferences
• Mobile notification data: push registration tokens, device identifiers where supplied, platform and app version, linked to your account and workspace; delivery providers also process app installation identifiers, notification content, and delivery metadata
• Business data: invoices, receipts, expenses, customer and vendor contacts, documents and images, payroll inputs, and other records you or your users provide
• Billing data: subscription status, payment references, billing contact and address, and transaction metadata from Stripe, RevenueCat, and app stores
• Bank integration data: connection identifiers or tokens, account information, and transaction data when you connect an account through Plaid
• Technical and security data: IP addresses, device/browser information, access logs, errors, and support correspondence; optional analytics may include usage events and pseudonymous identifiers, which can still be personal data
• Sign-up source: the campaign and referral parameters (utm_* and ref) in the link you first arrived by, and that page's path, kept in a first-party cookie for up to 90 days and saved on your account when you sign up

Purposes and legal bases

Where we are controller, we use account, contact, and billing data to enter into and perform our contract with you. If you represent a business, our legitimate interests in managing that business relationship support processing your work contact details. Some data is necessary to create an account or supply a requested feature; without it the relevant service may be unavailable.

We process records needed to meet applicable legal obligations, including accounting, tax, and lawful authority requests. We rely on legitimate interests for proportionate fraud prevention, service security, troubleshooting, responding to inquiries, and establishing or defending legal claims, taking account of your rights and expectations.

Optional analytics and non-essential tracking rely on your consent where required. Marketing requiring consent is sent only with that consent; you may withdraw it or unsubscribe. Withdrawal does not affect processing already lawfully performed. We do not sell personal information.

Business records processed for customers are handled on their documented instructions under the DPA; those customers are responsible for their own legal basis, transparency, and authorizations. This policy does not grant us a general right to use customer accounting documents for unrelated purposes.

Marketing communications

We send product news, tips, and offers by email only with your consent, given by ticking the optional box at sign-up. The legal basis is consent (GDPR Art. 6(1)(a)). The box starts unticked, and leaving it unticked does not affect your account.

Service and billing messages, such as receipts, trial and payment notices, and security alerts, are part of providing the service and are sent without marketing consent (GDPR Art. 6(1)(b)).

Every marketing email has an unsubscribe link. You can also withdraw consent at any time by writing to privacy@dingvoice.com. Withdrawing stops marketing email only; service messages continue while you have an account, and earlier lawful processing is not affected.

OCR, AI, and connected features

When you submit receipts or documents to an enabled extraction feature, document images, text, and relevant accounting or personal data may be processed through Google Vision, Google Vertex AI, and Anthropic models available through Vertex AI, depending on configuration. AI assistance is not limited to public listing copy. Submit only the information needed for the feature and review extracted results for errors.

Mobile notifications use Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service. These providers process routing identifiers, notification titles and bodies, and associated message data. Installation identifiers may be generated when the app initializes; permission to display alerts is separate from that processing.

Bank linking, payments, authentication, email, and SMS also involve the providers used for those features. Some providers, such as payment providers or banks, may act as independent controllers for their own compliance and account purposes under their privacy notices. Not every provider receives every category of workspace data.

Providers and recipients

The register below identifies providers and purposes, including feature-dependent processing. Providers act as processors or subprocessors where they process on our or a customer's instructions; their independent controller activities are governed by their own notices. The DPA explains authorization and change notices for subprocessors processing customer personal data.

Access is limited to personnel and providers who need it for their duties. We may also disclose data to professional advisers subject to appropriate duties, authorities where legally required, or a successor in a business transfer subject to applicable data protection requirements and notice where required.

Retention and deletion

We keep account and business data for the time needed to supply the service and carry out authorized export or deletion instructions. The period depends on the type of record, account activity, customer instructions, billing and tax requirements, security needs, and any dispute or legal hold. A Free account can remain active without a paid subscription.

Accounting and billing records may need to be retained for statutory periods; security logs are kept only as needed for investigation and protection, and support records as needed to resolve requests and related claims. We assess these purposes rather than promising immediate deletion of every record. Contact privacy@dingvoice.com for the criteria relevant to a particular record.

Deletion requests may involve automated tasks, retries, and support follow-up across services and providers. Backup copies may persist until their retention cycle expires and remain protected from ordinary use; legally required records remain restricted to the applicable purpose. Where anonymization is used, the resulting data must no longer identify a person. We explain applicable exceptions when responding to a request.

International transfers

DingVoice is hosted in the United States. Providers may also process data in other countries according to the service used. We do not currently offer EU-only data residency; do not rely on EU data residency for compliance purposes.

Transfers outside the EEA require a valid mechanism where data protection law applies. Depending on the recipient, this may be an applicable adequacy decision or properly executed Standard Contractual Clauses with any necessary transfer assessment and supplementary measures. A provider's name on this page is not proof of certification, an executed safeguard, or authorization for every transfer. We must establish the required protection before a restricted transfer takes place.

Contact privacy@dingvoice.com for information about the destinations and safeguards applicable to your data and to request a copy, subject to necessary redactions protecting confidential information. Applicable UK or other local transfer requirements must also be met where relevant.

Your rights and requests

Subject to applicable law and its conditions, you may request access, correction, erasure, restriction, or portability of your personal data. You may object to processing based on legitimate interests and to direct marketing, and withdraw consent at any time without affecting earlier lawful processing. These rights can be limited by another person's rights or applicable retention duties.

Available account and workspace exports can be downloaded directly from Settings by authorized users. You can also request a portable export or deletion through Settings or privacy@dingvoice.com. The scope depends on the records held, your access rights, and the legal right being exercised; an export is not a guarantee that every record from every external provider is immediately available.

We verify identity and authority proportionately before releasing or deleting records. We respond within the period required by law, generally one month under GDPR; complex or multiple requests may justify a permitted extension, which we explain within the initial period. Our operational target is to address verified support requests within 30 days, subject to those legal requirements. Requests concerning customer-controlled workspace data may need the customer's decision or instructions.

You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI), whose information is at vdai.lrv.lt, or another competent supervisory authority, including where you live or work. Contacting us first is optional and does not limit that right.

Security, children, and changes

We use technical and organizational safeguards appropriate to the risks, as described on our Security page and in the DPA. No online service can eliminate all security risks; report concerns to security@dingvoice.com.

DingVoice accounts are intended for adults using the service for business. If you believe a child has supplied account data without proper authority, contact us. Customers remain responsible for lawful processing of any individuals' information in their business records.

We update this policy when practices or legal requirements change and give additional notice of material changes where required. Optional tracking choices are described in the Cookies Notice. Privacy inquiries and rights requests: privacy@dingvoice.com, or Jscriptech, MB at the mailing address above.

Subprocessor register