This Privacy Policy explains what personal data Voltane Inc. ("Voltane", "we", "us") collects through voltane.co and the Voltane app, including your account and purchases, why, who it is shared with, how long we keep it and your rights. It describes the Service as it works today.
1. Who we are
Voltane Inc., a Delaware corporation, is the controller of the personal data described here. Address: 6820 Old Chesterbrook Road, McLean, VA 22101. Email: batu@voltane.co. We have not appointed a data protection officer or an EU / UK representative; contact us at that address for anything about your data.
2. What we collect and why
Demo requests
When you request a demo we collect your name, work email, company, role, what you are siting (optional) and which page you came from. Our server adds the time and your browser's user-agent string. We store the request in a private storage bucket and email it to ourselves so we can reply. We use it only to answer your request and follow up about Voltane. Your IP address is used for spam protection (a limit of five requests a minute) and is not stored with the request.
Your account
To create an account and sign in you give us your email address. We email you a one-time sign-in link through our authentication provider, Supabase. If you choose Google sign-in where we offer it, Google tells us your email address. Supabase keeps your account record (email address, account id, sign-up and sign-in times) and may log sign-in events with your IP address. A successful sign-in sets a session cookie (see Cookies). Sign-in link requests are limited per IP address and per email address to block abuse.
With your account we store: your plan and its status; your team, with the email addresses of members and of people the owner invites; the sites you save and any notes on them; and your briefs. A brief, including a draft or preview, is saved with the requirements it used (which can include short phrases from your project description) and its results. We do not keep the full description text you type.
Some testers sign in with a shared password we gave them instead. We check it and never store or log it, and failed attempts are counted per IP address.
Inside the app, preferences (filters, layers, map quality, panel layout) are kept in your browser's local storage and never sent to us. Sites saved in a browser before you had an account stay there; on a plan that keeps saved sites, they are copied into your account once.
Payments
Payments are handled by Stripe, our payment processor, on its own checkout and billing pages. You give your card details and billing details (such as name, country and postal code) to Stripe, not to us; Stripe also uses payment data to prevent fraud, under its own privacy policy. We send Stripe your account email address and our internal account and team ids.
From Stripe we receive and keep: your Stripe customer id, subscription id, plan, billing interval, status and renewal dates, and for each payment its amount, currency, date, Stripe ids and whether it was refunded or disputed. We never receive your full card number.
Technical and security data
Like any website, our hosting provider (Vercel) receives your IP address, browser user agent, the pages and files requested and the time of each request, and keeps request and function logs for 1 day. We use IP addresses for short-lived rate-limit counters (sign-in, demo requests, Ask Voltane, address lookups) that expire within about a minute, or 10 minutes for sign-in link requests. We do not use analytics, advertising or tracking tools of any kind.
In the signed-in map, your browser loads terrain elevation images directly from a public Amazon Web Services (AWS) Open Data bucket. AWS receives your IP address, user agent and which map tiles were loaded. No cookies are involved, and we have no agreement with AWS for this public data.
Ask Voltane and the Opportunity Brief
When you use Ask Voltane or build a brief, we send what you type, the earlier questions and answers of the conversation, what is on screen (region, project type, open site, filters) and the Voltane data the assistant looks up to our AI provider, Anthropic, which returns the answer. If you ask about a street address, our server sends that address to the U.S. Census Bureau Geocoder to find it on the map; we do not store or log the address.
For each Ask Voltane question we keep a log line in private storage: the time, the map area, the question with street addresses and ZIP codes replaced by "[address]", the tools used, token counts, cost and response time. It is not linked to your account, IP address or session. We use it to improve answers and control cost. We count your Ask Voltane messages and briefs to apply your plan's limits.
Email correspondence
When you email batu@voltane.co, or we reply to a demo request, the messages (with your name, address, signature and anything you include) are kept in our Google Workspace mailbox, to correspond with you.
3. Business contact data for outreach
To reach people who may be interested in Voltane, we may collect business contact details from public sources such as company websites, press releases and professional profiles: name, job title, employer, work email and work phone. We use them only to contact you about Voltane in your professional role. We do not buy contact lists.
Our legal basis is our legitimate interest in telling relevant professionals about our product. Every message lets you opt out; you can also email batu@voltane.co at any time and we will stop and keep only your email address on a do-not-contact list.
4. Legal bases (EU and UK)
- Your account, briefs, saved sites and purchases: performance of our agreement with you (the Terms of Service).
- Billing records: our legal obligation to keep tax and accounting records.
- Demo requests and email: steps you ask us to take before a possible contract, and our legitimate interest in answering business enquiries.
- Sign-in, session and limit cookies: performance of our agreement with you (the Terms of Service), and our legitimate interest in keeping the Service secure.
- Technical and security data, rate limits: our legitimate interest in running a secure, reliable service and preventing abuse.
- Ask Voltane and briefs (sending your prompt to Anthropic): performance of our agreement with you, since you ask for the answer.
- Ask Voltane question log: our legitimate interest in improving answers and controlling cost, with addresses removed.
- Business contact data for outreach: our legitimate interest in B2B marketing; you can object at any time.
- The
gv_modulepreference cookie and browser storage: our legitimate interest in returning you to where you left off, and storing what you choose to save.
5. Processors and recipients
We share personal data only with these providers, to run the Service:
- Vercel Inc. (USA): hosting, serverless functions, request logs, rate-limit cache and firewall.
- Supabase, Inc. (USA): sign-in and the account database (account email, team, plan, saved sites, briefs, purchases).
- Stripe, Inc. (USA): payment processing, checkout, subscriptions, invoices and the billing portal.
- Cloudflare, Inc. (USA): private storage (R2) of demo requests and the Ask Voltane question log.
- Resend (USA): delivers sign-in link emails and the demo-request alert email to us.
- Anthropic, PBC (USA): the AI model behind Ask Voltane and the Opportunity Brief.
- Google LLC (USA): Google Workspace email for batu@voltane.co.
These recipients receive data directly but are not our processors: the U.S. Census Bureau Geocoder (addresses you ask Ask Voltane about) and Amazon Web Services (your IP address when your browser loads public terrain tiles).
We do not sell personal data, share it for cross-context behavioural advertising, or show ads. We may disclose data if the law requires it, or to a successor in a merger or acquisition, which would remain bound by this policy.
6. International transfers
We and all of our providers are based in the United States, so data from the EU, the UK and Switzerland is transferred to the US. We rely on:
- Vercel, Cloudflare, Stripe, Resend and Google: their certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and the Standard Contractual Clauses in their data processing terms.
- Anthropic: the Standard Contractual Clauses in its data processing terms, which form part of its commercial terms.
- Supabase: the Standard Contractual Clauses in its data processing agreement.
For a copy of the relevant safeguards, email batu@voltane.co.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data (email, team and seats, plan, saved sites, briefs and drafts, purchases) | while your account is open. When you ask us to close it, we delete it within 30 days, except billing records. |
| Billing records (amounts, dates, Stripe ids) | as long as tax and accounting law requires us to keep them. |
| Demo requests (the stored record and the alert email) | 24 months after we receive the request, then deleted, unless you have become a customer or asked us to keep talking. |
| Ask Voltane question log | 12 months, then deleted. |
| Email correspondence | 24 months after our last exchange, unless it relates to a contract we must keep longer. |
| Business contact data for outreach | 24 months after our last contact with you, or until you opt out (we then keep only your email address on a do-not-contact list). |
| Rate-limit counters (IP address, sign-in email address, account id or a hash of the session) | about one minute for most; sign-in link requests 10 minutes; daily Ask Voltane and brief counters 24 hours. |
| Vercel request and function logs | 1 day (the retention of our Vercel plan). |
| Cookies and browser storage | as listed in the cookie table; browser storage until you clear your site data. |
Stripe keeps payment records for as long as financial regulations require it to, under its own privacy policy. Anthropic and Resend keep the data they process for us under their own retention terms; Anthropic does not use our API data to train its models.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy;
- have it corrected if it is wrong;
- have it deleted;
- object to our processing, including outreach and any processing based on legitimate interest;
- restrict our processing;
- receive it in a portable, machine-readable format;
- withdraw consent where we rely on it, without affecting earlier processing;
- complain to a supervisory authority, such as the data protection authority where you live or work (in the UK, the Information Commissioner's Office).
Residents of US states with consumer privacy laws (such as California, Colorado, Connecticut, Virginia and others) have similar rights to know, access, correct and delete their personal data, and to opt out of its sale, targeted advertising and profiling. We do not sell or share personal data for advertising or profile people. We will not discriminate against you for using these rights, and you may use an authorised agent.
To make a request, or to close your account and delete its data, email batu@voltane.co from your account address. We may need to confirm your identity. We respond within 30 days. Billing records we must keep by law are kept until that duty ends.
10. Security
- All traffic is encrypted with HTTPS (HSTS); our pages carry a strict content security policy.
- Demo requests and question logs sit in private storage buckets, reachable only with access keys held as encrypted environment variables.
- Sessions are signed cookies that page scripts cannot read; sign-in links are single-use; shared passwords are checked in constant time and never stored.
- The account database is reachable only from our server; your browser never holds a database key. Your plan is checked on our server before any paid data is sent.
- We never see or store card numbers: Stripe handles them.
- Sign-in, forms, Ask Voltane and address lookups are rate-limited; the app's data is served only to signed-in sessions.
- Commits are scanned for secrets before they enter our code repository.
No system is perfectly secure. If we learn of a breach affecting your data, we will notify you and the authorities as the law requires.
11. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, email us and we will delete it.
12. Public land records
Our screening uses public parcel records from county and state sources. Some of those records include landowner names and mailing addresses. We process them only to derive non-identifying signals for screening (for example, the type of owner: government, utility or co-op, company, trust or individual); in Ohio, owner names are hashed as soon as they arrive. We do not display landowner names or mailing addresses anywhere in the Service and do not include them in any report or export. Parcel identifiers and site addresses may be shown, with a link to the official county record.
13. Changes to this policy
We will update this policy when what we collect or how we use it changes, and change the "Last updated" date at the top. For material changes we will give notice on the site or by email before they take effect.
14. Contact
Voltane Inc., 6820 Old Chesterbrook Road, McLean, VA 22101. Email: batu@voltane.co.
See also: Terms of Service · Refund Policy.