Privacy Notice

Who is responsible

Lenny Letcher, sole proprietor, based in Phoenix, Arizona, United States, is responsible for deciding how Votum uses personal information. Address: Postal/business address not yet provided; city and state are not a mailing address. Privacy contact: lgletch2@msn.com.

Any required EU or UK representative, data protection officer, and international-transfer details must be confirmed before the relevant market release. A private list is access-controlled; it is not end-to-end encrypted.

Information Votum handles

Account data includes email, account identifier, authentication records, display name, and optional profile image. Google supplies sign-in information when you choose Google sign-in. List data includes memberships and roles, invited email addresses, titles, notes, comments, dates, places and coordinates, budgets, companions, links, status, photos, and memories supplied by members.

Public posts include the selected name, image, story, and other details the author chooses to publish. Booking-link records include the requested destination, partner, time, account, and associated list item. If optional analytics are allowed, Votum records limited public-post views and concierge interactions. New public-post view records do not store a full referrer URL or raw browser user-agent string. We also store your policy acceptance and the public authors you choose to hide.

Hosting, authentication, and optional providers may process IP addresses, browser/device information, and logs needed to deliver and secure their services. Reports, rights requests, and correspondence include the information you submit. An intimate-image removal request includes your role, electronic signature, contact information, consent statement, and any known-copy details you provide. Child sexual abuse or exploitation reports allow you to omit your name and email and are not linked to your signed-in account. Technical hosting/security records may still exist. Do not send passwords, identity documents, or copies of abusive images.

Who can see your lists and posts

Authorized list members can access content according to their role and surprise-item controls. They can copy what they see. Authorized service personnel and providers may access information when necessary for operation, security, or support.

Publishing to the Feed is a separate choice. Selected details become public, including to search engines and social sharing services. Changes to a private item do not automatically change its public snapshot. Review both when correcting or removing information. Unpublishing cannot retrieve copies someone else already saved.

Optional AI and other providers

When you explicitly allow an AI starter request, Votum sends the dream’s title, category, place, timing, group size, budget, dream size, and notes to Anthropic. The response becomes suggested text on the list. Account credentials and photos are not part of that prompt. Free text can nevertheless include personal information; remove sensitive details and confirm you are entitled to share information about other people. You can plan manually without using AI.

The Dream Map asks you to choose whether to load Mapbox before initializing its map. The place field separately offers optional Google place search; ordinary text entry remains available. Loading these services can send browser/network information to the provider, and their searches send the text you enter. Map requests can disclose the viewed area. A device-location permission, if requested, is separate from loading the map or entering a place manually. Recommendation searches may send a destination or restaurant query through our server to Viator or Yelp when enabled.

Supabase provides authentication, database, and file storage; Vercel hosts the application. Account emails use the configured authentication email service. External images and provider pages can send network information directly to their hosts. Following a booking link may include affiliate attribution and is governed by that provider’s privacy practices.

Vendor regions, data-processing agreements, international-transfer safeguards, and the configured email service require operator verification before release. We do not claim EU-only hosting, zero provider retention, or a specific provider training policy without that verification.

Purposes and legal bases

Where EU or UK data protection law applies, account and list functions requested by you are intended to rely on performance of our agreement. Proportionate security, support, invitations, and requested booking-handoff measurement require a documented legitimate-interest assessment where that basis is used. Legal duties can require particular records or disclosures. Optional analytics and third-party AI permissions are separate choices, and consent is used where required.

The operator must complete a purpose-by-purpose lawful-basis assessment before launch, including information supplied about nonmembers and sensitive details in free text. Votum does not use these planning suggestions to make automated decisions with legal or similarly significant effects about you.

Choices, rights, and requests

Privacy choices lets you enable or disable optional analytics; they are off by default. Global Privacy Control and Do Not Track signals keep them off. Booking taps you request and necessary authentication/security operations still work. No advertising pixel or cross-site advertising system is implemented in the reviewed application; the operator must verify production providers before making any legal sale/sharing determination.

Account privacy provides a downloadable export of the records covered by that tool and an in-account deletion request. An export is not necessarily a complete response to a statutory access request and excludes other people’s private records and hidden surprise content. You can edit your profile and content where your role permits.

You can request access, correction, deletion, portability, restriction, or object to a use where the applicable law provides those rights. You can withdraw a permission for future optional processing. Contact lgletch2@msn.com or use Report or contact. Identity checks must be proportionate and protect other people’s data.

EU/UK requests normally require a response within one month; a lawful extension or refusal must be explained. Other applicable laws may provide different deadlines, appeal rights, or authorized-agent procedures. You can complain to the competent privacy regulator, including your local EU/EEA authority or the UK Information Commissioner. You do not need to accept new terms to access the privacy-request tools.

Retention and account deletion

A deletion request is recorded for review; it does not itself erase the account. Shared lists belong to their members’ list, so deletion requires identifying your personal information and contributions while preserving others’ rights. Public posts, uploaded files, caches, provider records, and backups require separate handling. Where a legal obligation justifies retaining limited information, the purpose and restriction must be explained.

An approved retention schedule, tested deletion completion process, and verified backup expiry are still launch requirements. No automatic retention cleanup or guaranteed deletion completion period has yet been verified for production. The service must not be represented as launch-ready until those controls and the corresponding notice are finalized.

For people in Canada

You can contact lgletch2@msn.com to ask about our privacy practices, request access or correction, or raise a privacy complaint. Applicable Canadian federal and provincial privacy law determines your rights and any limits. You may also raise concerns with the appropriate privacy regulator.

Votum’s operator is based in the United States. Service providers may process information outside your province or Canada, where local laws and lawful government-access powers can differ. The provider locations, safeguards and agreements must be verified and disclosed before launch; we do not promise that information stays in Canada.

Canadian privacy, consent, cross-border processing, complaint and provincial requirements remain part of the launch review. Quebec privacy and applicable French-language requirements are not waived by choosing Canada as a launch market.

Children and notice changes

Votum accounts are for people aged 18 or older. An account age rule does not prevent family members from mentioning children or prove children cannot access public pages. Report information about a child that should not be present through Report or contact. Choose child sexual abuse or exploitation if you need the anonymous reporting option for that content. A change to permit accounts for people under 18 requires a separate reviewed design.

We show a new version when this notice changes and will give additional notice or seek a new permission when legally required.