Privacy policy

Voy Travel Inc., a Delaware corporation ("we"), operates Senti and is responsible for the personal data described here. Address: 8 The Green, Suite R, Dover, Delaware 19901, USA. Email: support@senti.now. This policy covers the website, the app, the API and our emails, and two groups of people: our customers and their teammates, and people whose public posts appear in reports.

• Your email address, to sign you in with a link and to send account emails: report finished, the alerts you set up, billing and account changes. Report emails can be turned off in Account or with the unsubscribe link; alert emails stop when you switch the rule off.
• If you choose to sign in with Google, Google shares your email address and name with us; we never receive your Google password.
• The brands, keywords, topics and campaigns you enter, and the reports you run, to provide the service.
• What you set up: alert rules, accuracy review answers and label corrections, to show them in your reports.
• Teams, invites and referrals: the email addresses you or an admin invite, whether the invite was opened and accepted, which account referred yours, and your timezone. Teammates see the shared account's brands and reports, not each other's profile details.
• Feedback and cancellation answers you send us, with the page they came from and any screenshot you attach, to improve the service. If you send feedback while signed out, the email address you choose to give, used only to tell you when it is done.
• Agency: the logo and "Prepared by" line you upload, stored by our database provider and placed only on your exports.
• API and webhooks: for each API key we store a fingerprint, its last four characters and when it was last used, never the key itself; for each webhook endpoint, the address you add, its signing secret and a log of deliveries.
• Billing: our payment provider processes your payment details; we keep only its customer id, your plan and what you bought. We never see your card number.
• Usage: aggregated, cookie-free page analytics from our hosting provider, error reports and server logs, to keep the service running and secure.
• Messages you send to our support and contact addresses, to answer them.

Reports contain public posts (text, author handle, link, public counts) collected through our social data provider from X, Instagram, Reddit and TikTok, in English, Spanish and Portuguese. We keep them to show the posts behind each number. To tell which country a post comes from, we use the post's own location or, on X, the author's public profile location; we keep that profile location and the country we read from it, and never guess a country from the language. Posts are handled the same way when a report is about a public figure or a topic. They appear in our customers' reports, in live examples and shared reports to anyone with the link, and in the CSV files and API answers our customers download, which our customers then control. Post text, author and link are removed 400 days after the post was published, and profile locations 400 days after we last looked them up; the counts, labels and countries stay. To have a post or an analysis removed sooner, write to support@senti.now.

The source is the public post on the platform, collected through our social data provider. We read the post to label its sentiment and topics about the brand, person or topic it mentions; the labels describe the post, not the person, and we do not build profiles of authors. Posts deleted from X or TikTok are found at a later refresh and left out of reports from then on. People in the EEA and UK can object to this processing, and anyone can ask for removal, by writing to support@senti.now; we remove the post's text, author and link within 30 days.

We use the data above to provide the service and the reports you ask for; send sign-in, report, alert, billing and account emails; send emails about getting started and our plans to people who signed up and haven't bought, which you can turn off in Account or with the link in each email; process payments and keep accounts; keep the service secure and prevent abuse; fix errors and improve the service with aggregated statistics; answer support requests; and meet legal obligations.

We do not sell personal information, do not share it for cross-context behavioral advertising, do not run targeted advertising, and do not use your data or the posts in reports to train AI models. Our AI providers receive only what each feature needs (post text for labeling; report figures and post identifiers for change explanations) and process it to return results to us.

Customer and account data: to perform our contract with you. Security, abuse prevention, error monitoring and aggregated analytics: our legitimate interest in running a safe and reliable service. Public posts: our legitimate interest, and our customers', in understanding public discussion of brands, public figures and public topics; we limit it to public posts, keep it only as long as stated below, and honor objections. Payment and tax records: legal obligation. Report emails you can turn off: your choice in Account. Getting-started and offer emails: your consent in the EEA, UK and Switzerland.

• Hosting and analytics, United States
• Database and sign-in, United States
• Email delivery, United States
• Payments and invoices, United States
• Security: bot check on sign-in and error monitoring, United States
• Sign-in with Google (optional), United States
• Social data provider (public posts), Israel
• AI labeling provider (receives post text only), United States
• AI analysis provider (receives report figures and post identifiers to write change explanations; no post text, author or account data), United States
• Support email inbox, United States

The names of our subprocessors are given to customers on request under the DPA. When you use the API or add a webhook endpoint, we send your report and alert data to the addresses you choose; those are your own recipients, not our processors.

Reports are private. Share on a report chooses who can open every report of its brand: Private: only you and your team; Anyone with the link: this brand's reports, including future refreshes; or Anyone, and listed in search engines. Shared links are read-only, and Private makes the brand's links stop working at once.

We also share data: with the customers whose reports include a public post, and with anyone who opens a report a customer chose to share or a live example; with authorities when the law requires it or to protect rights and safety; and with a buyer or successor if our business is sold or merged, under this policy.

Only what the service needs: the sign-in session cookies, the bot check on the sign-in form, a short-lived cookie that carries your email choice from the sign-in form until you sign in (1 day), and two short-lived cookies that remember an invite link (14 days) or a referral link (30 days) until you sign in. No advertising or tracking cookies.

Because we do not track you across sites or sell or share personal information, there is nothing to opt out of; we still treat a Global Privacy Control signal as an opt-out request.

Your account data stays while your account exists. You can delete your account yourself on the Account page: your brands, reports, campaigns, alert rules, review answers, label corrections, API keys, webhook endpoints, uploaded logo and plan are deleted at once, and any subscription is cancelled. We keep a record of each payment (amount, date and payment reference, no longer linked to your account) for our accounts, and a log of the emails we sent without your address. Our payment provider keeps payment records as the law requires.

You can download all your data at any time from Account (export), and delete your account there.

Data is encrypted in transit and at rest with our providers. Access is limited to people who need it to run the service. Keys to our providers stay on our servers, API keys are stored only as fingerprints, sign-in uses one-time email links or Google, and every table enforces per-account access. No system is perfectly secure; we will tell you without undue delay if a breach affects your data.

We and our providers process data in the United States, except our social data provider, which operates under Israeli law; the European Commission recognizes Israel as giving adequate protection. For personal data from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where it applies), or our providers' certification under the EU-US Data Privacy Framework.

Everyone can ask us for a copy of their data, its correction or deletion, by writing to support@senti.now; customers can also export and delete their data themselves in Account. We answer within 30 days, after verifying the request comes from you (for an account, from its email address). We will not treat you differently for using these rights.

US residents: depending on your state (including California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws), you have the right to know what we collect and disclose, to access, correct, delete and port it, and to opt out of the sale or sharing of personal information, targeted advertising and profiling with significant effects. We do none of these, so no opt-out is needed. An authorized agent may make a request for you with your signed permission. If we decline your request, you can appeal by replying to our answer with "Appeal"; we answer within 45 days, and if we still decline, you can contact your state attorney general.

EEA and UK residents: you also have the rights to restrict and object to processing and to complain to your data protection authority.

In the last 12 months we collected: identifiers (email, name from Google sign-in, account ids, API key fingerprints); commercial information (plans and purchases); internet activity (aggregated page analytics, server logs, use of the service); professional information (agency logo and "Prepared by" line); and, from public posts, publicly available information (post text, public handle, public profile location). Sources, purposes and retention are above. We collect no sensitive personal information as defined by California law, we do not sell or share personal information, and we disclose it for business purposes only to the provider categories listed above. California "Shine the Light": we do not disclose personal information to third parties for their direct marketing.

An AI model labels each public post's sentiment and topics, and another writes explanations of report figures. These outputs describe posts and brands. We make no decisions with legal or similarly significant effects about any person, and our terms forbid customers from using reports that way.

The service is for adults using it for work. We do not knowingly collect data from children under 13 (or 16 in the EEA and UK) as customers; write to support@senti.now and we will delete it.

We announce material changes by email or on this page at least 30 days before material changes apply. See also the terms of service, which incorporate the Common Paper Cloud Service Standard Terms Version 2.1, and the DPA, which incorporates the Common Paper DPA Standard Terms Version 1.1.