Privacy starts with
plain language.

Privacy notice

Last updated: October 23, 2026

Who is responsible

Vocreo is responsible for the account and workspace information described below. For messages that visitors send through a customer’s form, the customer who owns the form decides what is collected and why; Vocreo processes those messages on the customer’s behalf, to store and deliver them. If you sent a message through a form, contact the website you sent it to about that message.

What we collect

• Account details: your email address, name (when your sign-in provider shares one), the workspaces you belong to with your role in each, and whether two-step verification is on. Passwords and authenticator secrets are held by Amazon Cognito and never by our application.
• Form setup: the forms in your workspaces, their fields, look, settings, and AI builder drafts.
• Submissions: what visitors enter into your forms, plus the website they came from, their IP address and browser, used for delivery, spam protection and abuse limits.
• Integrations: webhook names and URLs, their signing secrets, and a log of each delivery attempt (time, response status and any error, never the message content).
• Activity and compliance records: a workspace activity log (who invited, joined, or changed settings, roles and webhooks, by name and email), when the Healthcare Use Notice was accepted, and when content was blocked as potential health information.
• Operational logs: error and request logs used to run and secure the service. They identify records by ID, and email addresses in error messages are masked.

We don’t use advertising, analytics, or tracking cookies, and we don’t sell or share personal information for advertising.

Why we use it

• To provide the service you signed up for: accounts, forms, delivery, and integrations (performing our contract with you).
• To keep the service secure and prevent abuse: rate limits, spam protection, sign-in protection, and logs (our legitimate interest in a safe service).
• To keep compliance records about health information (a legal and legitimate interest).

How long we keep it

• Submissions: each workspace’s Admins choose to keep them until deleted, or to delete them automatically 30, 90, 180 or 365 days after they arrive.
• AI builder: reference images are deleted once the draft is generated, and within a day at most; drafts expire after 30 days.
• Webhook delivery logs: 30 days. Invites: links work for 7 days; the record is removed within 30 days.
• Operational logs: up to 90 days. Abuse counters: a one-way hash of the visitor’s IP address, expiring within minutes.
• Workspaces: deleting a workspace deletes its forms, submissions, drafts, members, invites, webhooks, and activity log. Healthcare compliance records are kept as evidence that the PHI restriction was accepted and enforced.
• Accounts: deleting your account removes your profile and sign-in, and any workspace where you were the only member. In shared workspaces, entries in the activity log that name you remain while that workspace exists.

Service providers and where data is stored

Vocreo Contact runs on Amazon Web Services in the United States (us-west-2): Amazon Cognito for sign-in, Amazon DynamoDB and Amazon S3 for storage, AWS Lambda and Amazon API Gateway to run the service, Amazon SES and Amazon SQS to deliver submission emails, and Amazon CloudWatch for logs. When you use the AI builder, your request, the current form and any reference images are sent to OpenAI, or to Anthropic if OpenAI is unavailable; submissions are never sent to them. If you sign in with Google, Google shares your name and email address with us. Forms styled with a Google Fonts typeface load that font from Google when visitors view them.

Webhooks send each new submission to the URL a workspace’s Editors or Admins choose, such as their own server or an automation service. That destination is chosen and controlled by the customer, not by Vocreo.

If you use the service from outside the United States, your information is transferred to and stored in the United States. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses with our providers.

Your rights and choices

From Settings you can download a copy of your data, change your email address or password, turn on two-step verification, and permanently delete your account. Workspace Admins can delete individual submissions, set the retention period, and manage who has access.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your information, to object to or restrict how it is used, and to complain to your local data protection authority. Send requests to support@vocreo.ai from the email address on your account, so we can confirm it’s you. We respond within the time the law allows (for example, one month under the GDPR). If you sent a message through a customer’s form, we will pass your request to that customer.

We don’t sell or share personal information for cross-context advertising, so there is nothing to opt out of; browser signals such as Global Privacy Control are honored by default because no such sharing happens.

We keep you signed in using your browser’s local storage, which is necessary for the service to work.

Vocreo Contact is a business tool and isn’t directed to children. Accounts are for people 16 and older, and we don’t knowingly collect information from children under 13. If you believe a child has given us information, contact us and we’ll delete it.

Healthcare and PHI

Vocreo Contact is not a HIPAA-compliant service and does not support the collection, storage, processing, or transmission of Protected Health Information (PHI). Healthcare organizations may use it only for general business and contact inquiries that do not request patient-specific health information.

Responses to healthcare forms are emailed to the form’s recipients and are never stored in Vocreo Contact’s database. Amazon SES still processes the message to deliver it. This does not make the service HIPAA compliant, and PHI remains prohibited.

Do not use Vocreo Contact for patient intake, medical histories, symptoms, diagnoses, treatment or prescription information, health insurance information, medical records, or similar HIPAA-regulated workflows.

Terms of service

Workspace Admins are responsible for who they invite and what their forms collect. Customers may not use Vocreo Contact in a way that would require Vocreo to act as a HIPAA Business Associate. Vocreo does not enter into Business Associate Agreements for this product. PHI is prohibited, and forms that appear designed to collect it can’t be published.

Contact

Questions can be sent to support@vocreo.ai. Return home.