Privacy Policy

This Privacy Policy explains how Volana ("Volana," "we," "us," or "our") collects, uses, stores, shares, and protects information when you use our website, application, and related services (together, the "Service"). It applies to everyone who visits our website or creates a Volana account.

Please read this policy alongside our Terms of Service. If you do not agree with this policy, please do not use the Service.

1. Who we are and how to contact us

Volana is an AI powered calendar and productivity assistant. Our AI assistant, Luna, helps you schedule, organize, and manage tasks across your calendar and connected tools.

If you have questions about this policy or want to exercise any of the rights described below, contact us at:

• Privacy questions: privacy@volana.app
• General support: support@volana.app
• Security concerns: security@volana.app

2. Information we collect

We collect information in three ways: what you give us directly, what we receive automatically as you use the Service, and what we receive from third parties you choose to connect.

2.1 Information you provide directly

• Account information: name, email address, password (stored as a salted hash, never in plain text), and profile details you choose to add.
• Content you create in Volana: tasks, notes, preferences you set for Luna, and any messages or instructions you send to Luna.
• Communications with us: anything you send when you contact support, report a bug, or reply to us.
• Payment information (once billing is live): handled entirely by our merchant of record (see Section 6). We do not store your full card number on our own servers.

2.2 Information collected automatically

• Usage data: pages and features you use, actions you take (such as creating or moving a task), timestamps, and general session activity. Used to understand what is working and what is confusing so we can improve the product.
• Device and log data: browser type, operating system, IP address, and similar technical identifiers that are generated automatically by any web request.
• Cookies and similar technologies: see our separate Cookie Policy for the full list of cookies, their purpose, and how to control them. In short: strictly necessary cookies keep you signed in, and (only with your consent, or automatically respecting your browser's Global Privacy Control signal) analytics cookies help us understand usage patterns in aggregate.

2.3 Information from connected services

When you connect a third-party account to Volana, we receive the data needed to provide that integration, and only that data. Currently supported connections:

• Google Calendar: event titles, times, locations, descriptions, attendees, and calendar metadata for the calendars you choose to connect. We request Google Calendar access (rather than access to your entire Google Account) so Luna can list your calendars and read, create, update, and delete events on the ones you connect.
• Task and project tools: ClickUp, Asana, Linear, GitHub, Slack, and Notion, when you choose to connect them. We receive task, project, channel, or page data only from the workspaces and permissions you explicitly authorize during that connection's setup.

You control these connections. You can disconnect any of them at any time from your account settings, which revokes our access token for that service immediately.

2.4 Information we do not collect

We do not knowingly collect information from children under 13, and Volana is not directed at children. We do not collect government identification numbers, biometric data, or precise geolocation.

3. How we use your information

We use the information described above for the following purposes:

• Providing the Service: running Luna's scheduling, task management, and calendar features, including reading and writing to your connected calendars and tools when you ask Luna to take an action.
• Operating and securing your account: authentication, fraud prevention, abuse detection, and enforcing our Terms of Service.
• Improving the product: understanding aggregate usage patterns to prioritize fixes and new features. Where this involves cookies or similar tracking, it is subject to your consent choices described in our Cookie Policy.
• Communicating with you: service notifications, security alerts, responses to support requests, and (only if you opt in) product updates.
• Complying with legal obligations: responding to lawful requests, enforcing our agreements, and protecting the rights and safety of Volana and our users.

We do not use your personal information for purposes incompatible with the ones listed above without first updating this policy and, where required by law, obtaining your consent.

4. How Luna uses artificial intelligence, in detail

Because Luna is an AI assistant that reads and acts on your calendar and task data, we want to be specific about exactly what happens to your information when you use it, rather than describing this in vague terms.

4.1 What gets sent to AI providers

When you interact with Luna, the relevant content is sent to one or more third-party AI model providers we contract with, so that Luna can generate a response or take an action. Depending on your request, this content may include:

• Calendar event details, such as titles, times, locations, descriptions, and attendees.
• Task and subtask descriptions, notes, and your instructions or messages to Luna, including saved preferences Luna uses to personalize its help.
• Content from a connected integration when you bring it into a request, such as the text of a Slack message or an item from a connected app that you ask Luna to turn into a task or act on.
• Files you attach in a Luna conversation, such as an image or PDF, when you ask Luna about them.

We use a small set of established AI model providers, and Luna's architecture can route or fall back across them to maintain reliability. We keep the current list of these providers, and what each one processes, on our Subprocessors page, which we update when our providers change. Regardless of which provider processes a given request, the same privacy commitments in this section apply.

4.2 What we do not do with this data

• We do not use your calendar, task, or message content to train our own models without your separate, explicit opt-in consent. If we ever introduce a feature that would use your content for model training, we will present a clear, specific consent screen before enabling it, and it will remain off unless you affirmatively turn it on.
• We do not sell your personal information to data brokers or third parties.
• We do not use your Google Calendar data, or data from any connected integration, for advertising or ad targeting.

4.3 What our AI providers do with this data

Our agreements with the AI providers we use govern how they may process data we send through their APIs. As of this policy's effective date, our understanding of their API-tier data handling is:

• Content sent through their commercial API is not used to train their general-purpose models by default.
• Content may be retained briefly for abuse monitoring and safety purposes, consistent with each provider's own API terms.

The current providers are listed on our Subprocessors page. We encourage you to review each provider's own API and data-usage terms, and we re-check those terms periodically, since they can change.

4.4 Luna's autonomous actions

Luna can take actions on your behalf when you authorize it to, such as moving a task, finding a free slot, or updating a calendar event. These actions are performed using the access you have granted through your connected accounts, and are logged so you can review what Luna did and undo actions where supported. Luna's suggestions and automated actions are provided to assist you, not to make binding decisions about you, and you remain responsible for reviewing scheduling changes before relying on them. See the AI Disclaimer in our Terms of Service for more detail.

4.5 Google user data and Limited Use

Volana's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means the data we access from your Google Calendar is used only to provide and improve the user-facing features you ask Luna for, such as reading, creating, moving, and organizing your events. We do not use Google Calendar data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. When Calendar content is sent to an AI provider, it is solely to fulfill the specific request you made in that moment, under the commitments described in this Section 4. We do not transfer or sell Google user data for advertising, and we do not let humans read it except with your consent, for security purposes, to comply with applicable law, or as strictly necessary to operate the Service consistent with this policy.

5. How we share information

We share information only in the following circumstances:

• Service providers who help us operate Volana, under contracts that limit their use of your data to providing services to us. See our Subprocessors page for the current list, which includes our hosting provider, database provider, AI model providers described above, and our email delivery provider.
• The third-party services you connect, to the extent necessary to provide the integration you set up (for example, writing an event back to your Google Calendar when Luna schedules something for you).
• Legal and safety reasons, if we believe disclosure is necessary to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Volana, our users, or the public.
• Business transfers, if Volana is involved in a merger, acquisition, financing, or sale of assets, in which case your information may be transferred as part of that transaction. We will notify you of any such change and any resulting choices you have.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Payment information

Once billing is enabled, payments are processed by a merchant of record (such as Paddle or Lemon Squeezy). These providers collect and process your payment details directly; Volana does not receive or store your full card number. Please review our payment processor's own privacy policy for details on how they handle payment data, which we will link here once billing goes live.

7. Data retention

We retain different categories of data for different periods, based on what is necessary for the purpose it was collected for:

If you delete your account, we delete or anonymize your personal information within 30 days, except where we are legally required to retain it longer (for example, financial records related to a payment).

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your personal information, subject to certain legal exceptions.
• Portability: receive your data in a structured, commonly used format.
• Opt out of sale or sharing: we do not sell or share personal information as defined under California law, so there is nothing to opt out of today, but we will maintain this mechanism proactively as described in Section 9.
• Withdraw consent: where we rely on your consent (such as optional analytics cookies), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Non-discrimination: we will not penalize you, charge you a different price, or provide a different level of service because you exercised any of these rights.

How to exercise these rights

• Account deletion: available directly in your account settings under Privacy and Data.
• Data export: available directly in your account settings, or by emailing privacy@volana.app if you need a manual export while this feature is being built out.
• All other requests: email privacy@volana.app. We will respond within the time required by applicable law (generally 30 to 45 days depending on jurisdiction), and may need to verify your identity before fulfilling certain requests.

9. California privacy rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives California residents specific rights. Volana's current size means we may not meet the CCPA's applicability thresholds (based on revenue, the number of California consumers whose data we process, or the share of revenue from selling personal information), but we are providing these disclosures proactively and will keep them current as we grow:

• Categories of personal information collected: identifiers (name, email), commercial information (subscription/billing status), internet activity (usage data), and the calendar/task content described in Section 2.
• Sources: directly from you, automatically through your use of the Service, and from the third-party integrations you connect.
• Business purposes for collection: providing and improving the Service, as described in Section 3.
• Categories of third parties we disclose to: service providers listed on our Subprocessors page.
• Sale or sharing: we do not sell or share personal information as those terms are defined under the CCPA.
• Sensitive personal information: we do not collect sensitive personal information as defined under the CCPA (such as government IDs, precise geolocation, or health data) beyond what may incidentally appear in calendar event text you choose to sync, which we do not separately process or analyze for that purpose.

Global Privacy Control: our website automatically detects and honors the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid request to opt out of any sale or sharing of your personal information and disable non-essential cookies by default, consistent with the mechanism in our Cookie Policy.

To exercise your California rights, use the methods in Section 8, or the "Do Not Sell or Share My Personal Information" link in our website footer.

10. European and UK privacy rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK law give you the rights listed in Section 8, plus the right to lodge a complaint with your local data protection authority.

Legal basis for processing: we process your personal information under the following legal bases:

• Performance of a contract: processing needed to provide the Service you signed up for (account management, Luna's core functionality).
• Legitimate interests: for security, fraud prevention, error monitoring (Sentry), and product analytics, balanced against your rights and interests.
• Consent: for optional analytics and personalization cookies, and for any future AI model training use as described in Section 4.2.
• Legal obligation: where processing is required to comply with the law.

International data transfers: Volana is based in the United States, and our service providers may process data outside the EEA/UK. Where we transfer personal information out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or equivalent mechanisms recognized under UK law, with the providers who process that data on our behalf.

11. Do Not Track and browser signals

Some browsers offer a "Do Not Track" (DNT) signal. There is no common industry standard for how to interpret DNT, so we do not currently respond to DNT signals differently from normal browsing. We do, however, automatically honor the Global Privacy Control (GPC) signal as described in Section 9, since GPC has a defined technical specification we can reliably act on.

12. Children's privacy

Volana is not directed at, and is not intended for use by, children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, contact privacy@volana.app.

13. Security

We use industry-standard measures to protect your information, including encryption of data in transit (TLS) and at rest, per-user data isolation in our database architecture, and access controls limiting which systems and personnel can access user data. OAuth tokens for the services you connect, including your Google Calendar, Zoom, and the app integrations (ClickUp, Asana, Linear, GitHub, Slack, Notion), are additionally encrypted at the application layer using AES-256-GCM, and access tokens for all connected services are never returned to the browser or written to logs. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to continuously improve our practices. See our Security page for more detail, and our security.txt file if you are a security researcher who has found a vulnerability.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, meaning changes that affect what data we collect or how we use or share it, we will notify you by email and, if you have optional consent-based data uses enabled, we will ask you to reconfirm your consent where required. We will always update the "Last updated" date at the top of this policy. Continued use of the Service after an update means you accept the revised policy, except where your affirmative consent is separately required by law.

15. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at privacy@volana.app.