Privacy Policy
Last updated: September 11, 2026
1. Who we are
VoxBurst is a social media management platform operated by FORTHEAN LABS LLC, a Texas limited liability company ("we", "us", "our"). This Privacy Policy describes how we collect, use, and protect personal information when you use VoxBurst at voxburst.com, app.voxburst.io, voxburst.io, and any associated subdomains or APIs (collectively, the "Service").
We do not knowingly collect or solicit personal information from anyone under the age of 18. The Service is intended solely for users who are 18 years of age or older. If you believe a minor has provided us personal information, please contact us and we will delete it promptly.
2. Information we collect
Account information
When you create an account, we collect your name, email address, and a hashed password (using a modern salted hashing algorithm). If you sign up via OAuth (Google, etc.), we receive your email and name from that provider.
Social platform credentials
When you connect a social account, we store OAuth access tokens (and refresh tokens where applicable) to publish on your behalf. We do not store your passwords for any social platform. Tokens are encrypted at rest using AES-256. OAuth tokens are used solely to publish content and retrieve analytics on your behalf — they are never shared with third parties for any purpose unrelated to operating the Service, are not logged or cached in plaintext, and are only transmitted over TLS-encrypted connections. Access to stored OAuth tokens is restricted to the minimum system components required to perform publishing operations.
Meta platform data (Facebook, Instagram, Threads)
When you connect a Facebook Page, an Instagram professional account, or a Threads profile, we access data from Meta's APIs strictly to provide the features you use:
- Account and Page details — the account or Page ID, name, username, and profile image of the accounts you choose to connect, so we can display them to you and publish to the correct destination.
- Content you publish through us — posts, images, video, and first comments you create in VoxBurst and send to these platforms.
- Comments and mentions on your own content — the commenter's platform username, the comment text, and its timestamp, so you can read and reply to them from your inbox.
- Post and account insights — aggregate metrics such as impressions, reach, and engagement for content published to accounts you connect.
- Messaging contacts — when someone sends a message to a Facebook Page or Instagram account you have connected, we store their platform-scoped user ID, their display name, the time of their most recent message, and the text of each message they send. We use the timestamp solely to determine whether Meta's 24-hour messaging window is open. We store the message text so you can read the conversation in your Contacts panel and reply with full context, and we check each message for opt-out keywords (for example, replying "STOP") and record those requests so that contact is never messaged again.
Inbound message text is stored only for messages sent to accounts you have connected, is visible only to members of your workspace, and is not used for advertising, profiling, or training AI models. We do not store message attachments, and we do not store the body of replies you send from VoxBurst — only whether each reply was delivered, failed, or read. Inbound message text is retained for as long as the contact remains in your workspace; it is deleted when you delete the contact, when you delete your workspace, or when Meta sends us a data-deletion request for the connected account. Where a message contains an opt-out keyword, we retain that message as the record of the opt-out request, even if the contact is later deleted, so that opt-out is never lost. We do not use Meta platform data for advertising, do not sell it, and do not use it to build profiles unrelated to the features you use. Our use of information received from Meta's APIs adheres to the Meta Platform Terms and Developer Policies.
You can disconnect a Facebook, Instagram, or Threads account at any time from your account settings, which ends our access and deletes the stored tokens. You may also remove VoxBurst from your Facebook settings; Meta notifies us and we delete the associated data. To request deletion directly, see Your rights.
Content you create
Post drafts, scheduled posts, media uploads, and analytics data you generate while using the Service are stored on our servers.
Usage and log data
We automatically collect IP addresses, browser type, pages visited, and actions taken within the Service for security, debugging, and product improvement purposes.
Payment information
Billing is handled by Stripe. We do not store credit card numbers. We receive a payment confirmation and subscription status from Stripe.
3. How we use your information
We process your personal information for the following purposes and on the following legal bases:
We do not sell your personal data. We do not use your content to train foundation AI models, and we do not share your content with our AI providers for their own model training. Brand Voice and Persona features process your content within your workspace only, to generate a private style profile that conditions content generation for your account. This profile is not used to train shared models, is not accessible to other customers, and is deleted when you delete the corresponding persona or your account. See our AI Policy for full details.
4. Third-party services
We share data with third parties only as necessary to operate the Service:
- Stripe: payment processing and subscription management
- Amazon Web Services (AWS): cloud infrastructure, data storage, and transactional email delivery via Amazon SES. Data is hosted in AWS us-east-1 (United States).
- Sentry: error monitoring and crash reporting. Sentry may receive limited technical metadata (stack traces, request URLs) but does not receive post content or social credentials.
- Google Tag Manager / Google Analytics: website analytics on the marketing site (voxburst.com). Gated by your cookie consent choice via our consent management platform.
- Ahrefs Analytics: website traffic analytics on the marketing site. Gated by your cookie consent choice.
- Social media platforms: data is shared with the platforms you connect — including Meta (Facebook, Instagram, and Threads), Twitter/X, LinkedIn, TikTok, Pinterest, YouTube, Bluesky, Mastodon, Reddit, and Google Business — when publishing posts, sending messages, or retrieving analytics on your behalf.
- Anthropic — AI text generation. Anthropic does not train on API customer data by default.
- Google (Gemini API, paid tier) — AI text and multimodal generation. Voxburst uses the paid API tier; Google does not train on customer data on the paid tier. Google retains request data for up to 55 days for abuse monitoring purposes.
- Stability AI — AI image generation under enterprise licence terms.
- Alibaba Cloud (Qwen) — available as a bring-your-own-key (BYO-key) option only. Voxburst does not proxy Qwen requests. Users selecting Qwen connect their own API key and are subject to Alibaba Cloud's own terms of service, including potential data processing in Singapore.
We do not share your personal data with third parties for their own advertising purposes.
5. International data transfers
VoxBurst is operated from the United States. Your data is stored in AWS us-east-1 (Northern Virginia, USA). When we share data with sub-processors such as AI providers or analytics tools, that data may be processed in countries outside your own, including the United States and countries where those providers operate.
For transfers of personal data from the European Economic Area (EEA) or United Kingdom, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (IDTA) with our sub-processors. A copy of our Data Processing Agreement is available on request — see our Security page.
FORTHEAN LABS LLC does not currently have a designated EU/UK representative under GDPR Article 27. If you have questions about data processing affecting EEA or UK residents, please contact us directly.
6. Data retention
We retain your account data for as long as your account is active. Self-service account deletion (from your account settings) is immediate — your profile, workspaces you own, and their content are removed from our active systems as soon as you confirm the deletion, not after a waiting period. Residual copies in encrypted backups are purged within 90 days of that deletion. We retain a minimal billing record, disconnected from your deleted profile, for tax, accounting, fraud-prevention, dispute, and other legal-compliance purposes — see 6.3 Billing and subscription record retention below for what that record contains and for how long. We may also retain other data longer where required by law or to resolve disputes. See the Delete Account section of your account settings for the full breakdown of what is deleted, retained, and externally managed.
Deleting your VoxBurst account does not, by itself, cancel a subscription that is still on track to renew. If you have a paid subscription set to renew, deleting your account cancels it for you — you do not need to cancel separately. Your subscription will not renew and no further charges will be made. Access ends immediately and any remaining prepaid time is forfeited; no refund is issued except where required by law. If we cannot confirm the cancellation with our payment provider, we do not delete your account, so you are never left with a live subscription and no account from which to cancel it. See our Terms of Service for how subscription cancellation and billing work.
When you disconnect a social account from VoxBurst, the associated OAuth access token and refresh token are deleted from our systems immediately, so VoxBurst can no longer access that account. Where the platform provides a revocation endpoint and we have implemented it, we also revoke the authorization with the platform itself; where we have not, the platform continues to list the connection until you remove it in that platform's own app or connected-apps settings, and we encourage you to do so. When you delete your VoxBurst account, all connected social account tokens are deleted, and revoked with the platform on the same basis, as part of the account deletion process.
Note: Third-party AI providers may retain API request data for their own abuse-monitoring purposes independent of our retention schedules (for example, Google retains Gemini API request data for up to 55 days). We do not control third-party provider retention periods.
Post content and analytics may be retained in anonymized, aggregated form indefinitely for product improvement purposes.
6.1 Content retrieved from connected social platforms
Some features retrieve content you have already published on a connected platform — for example syncing your existing posts into the VoxBurst calendar, or importing recent posts to build a Brand Voice profile. This is content that originates on the platform rather than in VoxBurst, and each platform's developer terms limit how long we may keep it.
We apply a per-platform retention window to this platform-sourced content, set to the shortest period the relevant platform requires or recommends. Where a platform publishes no specific window, we default to 30 days. Once the window elapses, the retrieved post text and any derived text representations are erased on a scheduled basis. We keep only VoxBurst's own records about the item — such as the publish date, the link to the post on the platform, scheduling status, and aggregate engagement counts — so your calendar history and analytics remain intact.
Content you author inside VoxBurst is not subject to these platform windows and is retained under the general schedule above. If a platform reports that a post has been deleted, or you disconnect the account, we stop retrieving that content from then on, and we mark the affected records accordingly; any copy we already retrieved is then erased on the scheduled retention cycle described above rather than at the moment of the disconnect or deletion. Residual copies in encrypted database backups are purged on the backup retention cycle described above.
6.2 No AI training on platform content
We do not use content retrieved from your connected social accounts — your posts, comments, engagement data, or profile information — to train, fine-tune, or otherwise create a persisted machine-learning model, and we do not provide it to any third party for that purpose. VoxBurst does not operate any model training or fine-tuning pipeline.
Where platform content is used by an AI feature, it is used only at the moment of generation, as context in a request on your behalf, and the resulting output is available only inside your workspace. Brand Voice similarity matching uses a deterministic statistical text representation computed on our own servers; it is not a trained model and is erased alongside the source content when the retention window elapses. Our AI providers operate under terms that prohibit training on customer API data. See our AI Policy for full details.
6.3 Billing and subscription record retention
While your account is active, we hold your billing state directly: your Stripe customer and subscription identifiers, plan tier, subscription status, current billing period, and billing history (upgrades, downgrades, cancellations, and completed charges). We do not store your card number — Stripe holds that, as described below.
When you delete your VoxBurst account, we retain a minimal version of this billing record — disconnected from your deleted profile, so it can no longer be traced back to your VoxBurst identity by an ordinary lookup — for as long as required for tax, accounting, fraud-prevention, dispute, and contractual-enforcement purposes. That retained record keeps only what those purposes require: the Stripe customer and subscription identifiers, plan, status, and billing history. It does not retain your name, email, or any card-adjacent detail — those were never stored locally in the first place; Stripe holds them, under Stripe's own retention practices, described below.
Retention period (provisional). The retention clock runs from the end of the calendar year containing the last financial transaction on the account. A later refund, chargeback, or other financial adjustment restarts it. We retain this record for 10 years from the end of the calendar year of the transaction. We apply a single global period rather than varying it by country: it exceeds the U.S. federal and Texas requirements and also satisfies the 10-year record-keeping rule that applies to EU digital-services VAT, so the same rule protects every customer. We extend it only where a specific obligation requires — an active audit, tax controversy, chargeback, fraud investigation, litigation, or legal hold — and we review the justification annually.
Stripe's role. Stripe is our payment processor. Stripe holds your payment method, billing address, and full transaction history under Stripe's own retention practices as a payment processor, independent of VoxBurst's retention schedule for its own records described above — closing your VoxBurst account does not instruct Stripe to delete or retain data on any particular timeline, and we do not control or represent Stripe's internal retention periods here. See Stripe's Privacy Policy for how Stripe itself handles your data.
7. Security
We use industry-standard security practices including TLS 1.2+ encryption in transit, AES-256 encryption at rest for sensitive credentials, role-based access controls, and audit logging. For more detail, see our Security page.
In the event of a confirmed security incident affecting your personal data, we will notify affected workspace administrators without undue delay and in accordance with applicable law — typically within 72 hours where GDPR applies.
8. Children's data
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has submitted personal information to us, please contact us and we will delete it promptly.
9. Your rights
Depending on your location, you may have rights regarding your personal data. To exercise any of these rights, contact us.
You can disconnect any connected social account at any time from your workspace settings. Disconnecting an account immediately ends VoxBurst's access and deletes the associated OAuth tokens from our systems. See Data retention for how revocation with the platform itself is handled.
- GDPR (EU/EEA residents): right of access, rectification, erasure ("right to be forgotten"), portability, restriction of processing, objection to processing, and the right to withdraw consent at any time where consent is the legal basis. You also have the right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority).
- UK GDPR (UK residents): same rights as above. You may also complain to the Information Commissioner's Office (ICO).
- CCPA/CPRA (California residents): right to know what personal information we collect and how it is used, right to delete, right to correct inaccurate personal information, right to opt out of sale (we do not sell personal data), right to limit use of sensitive personal information, and the right to non-discrimination for exercising your privacy rights.
We will respond to verifiable requests within 30 days (or as required by applicable law).
11. Changes to this policy
We may update this Privacy Policy from time to time. For material changes — including changes to how we use personal data, the legal bases we rely on, or the third parties we share data with — we will provide at least 14 days' notice by email or by displaying a prominent notice in the Service before the change takes effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
12. Contact
Questions about this Privacy Policy or requests to exercise your rights? Contact us through our contact form. We aim to respond within 5 business days.
FORTHEAN LABS LLC
Texas, United States