Short version: we collect the minimum needed to run the site, answer inquiries, process payments via Stripe, and deliver VANTA/Bedrock. We do not sell personal information. We do not share it for cross-context behavioral advertising. Bedrock local workspace content stays on your device. Details below, plus how to access, correct, delete, or port your data (GDPR / CCPA / Mexico LFPDPPP ARCO).
Covers voltifyagency.com, store checkout, consultation/contact forms, newsletter, VANTA cloud service, Bedrock licensing/update/support flows, and APIs. Product supplements: VANTA Privacy (cloud analysis, AI sub-processors, abuse-prevention signals) and Bedrock Privacy (local-first). Where they conflict for that product, the product policy controls.
We do not sell or rent personal information and do not share it for behavioral advertising. We share only with:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Stripe, Inc. (payments) | Checkout, invoicing, fraud screening | PCI DSS L1; data minimized; Stripe Privacy |
| Vercel / hosting & CDN | Serve site, logs, DDoS protection | SOC 2; DPA/SCCs where required |
| Supabase (VANTA backend) | Auth, database, storage | RLS tenant isolation; encryption |
| AI sub-processors (VANTA cloud only) | Generate your requested analysis | Listed in VANTA Privacy §5; no training by default beyond our stated improvement basis |
| Cal.com / email providers | Bookings, transactional email | Processor terms; opt-out honored |
| Authorities | Lawful requests, safety, rights protection | Narrow disclosure; challenge overbroad requests |
Business transfers: in a merger/acquisition, data transfers with notice and continued protection.
Essential cookies keep the site working (load balancing, consent memory, auth sessions where used). Non-essential analytics run only after Accept in our banner (reject leaves you strictly essential). We honor DNT as reject. Full list and controls: Cookie Policy. Withdraw anytime via the Legal Hub "Cookie settings" reset.
| Data | Retention |
|---|---|
| Leads / inquiries | 24 months after last contact, then delete/anonymize |
| Accounts | Life of account + 30 days recovery |
| Transactions / invoices | 7 years (tax/accounting) |
| Security/API logs | 90 days rolling |
| Marketing consents | Until withdrawn + 3 years proof |
| Abuse-prevention signals (free tier) | Memory-cached ≤24h, not persisted except hashed enforcement counters |
We operate from Mexico and use US/EU infrastructure. EU/EEA/UK → third-country transfers rely on adequacy decisions or SCCs/UK IDTA with supplementary measures. Ask for transfer details at privacy@voltifyagency.com. Enterprise customers can sign our DPA.
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20, JSON/CSV), objection (21), no solely-automated legal decisions (22 — our AI outputs are advisory, not automated decisions), withdraw consent (Art. 7), complain to your supervisory authority. We respond within 30 days.
Know, delete, correct, opt-out of sale/sharing (not applicable — we do not sell/share), limit sensitive data (we do not use it beyond permitted purposes), non-discrimination. Last 12 months categories: identifiers, commercial info, internet activity, inferences. No sale in the last 12 months. Respond within 45 days; authorized agents honored with verification.
Acceso, Rectificación, Cancelación, Oposición, plus consent revocation and limitation of use/disclosure. Email privacy@voltifyagency.com with your name, contact, right asserted, and data scope; we respond within 20 business days (plus 15 for effectuation where applicable). Spanish-language requests welcome — solicitudes ARCO en español son bienvenidas.
We extend access/correction/deletion/portability/objection globally where feasible. Contact us and we will honor applicable law.
How to exercise: email privacy@voltifyagency.com (subject: "Privacy request — [right]"). We verify identity proportionately and never charge unless manifestly unfounded/excessive. Data deletion in-app: VANTA dashboard → Delete account; Bedrock → uninstall + delete local data folder (cloud sync data deleted on request).
We maintain a breach log, assess risk promptly, notify the competent authority within 72 hours where GDPR requires, and notify affected individuals without undue delay where there is high risk — describing nature, categories, consequences, and mitigations.
Not directed to under-18s. We do not knowingly collect children's data; discovered data is deleted promptly. Contact us if you believe a minor provided data.
Stripe.js, Cal.com embeds, Google Fonts, and social links have their own policies. Review them before interacting.
Material changes are emailed/bannered at least 30 days ahead where feasible; continued use after the effective date is acceptance. Prior versions available on request.
Controller: Voltify Agency · Privacy: privacy@voltifyagency.com · Security: security@voltifyagency.com · Legal: legal@voltifyagency.com · General: patricio@voltifyagency.com
Related: Terms · Refunds · Cookies · Disclaimer · DPA · Legal Hub
© 2026 Voltify Agency. All rights reserved.