Privacy policy

This page is a draft. A lawyer is still checking it, and the details in [square brackets] are still to be filled in.

Last updated: [EFFECTIVE DATE]

We've written this in plain English. If anything is unclear, email us at hello@puffinhq.com and we'll explain.

The short version

Puffin is run by VOICEVUI SRL in Romania.
We collect only what we need to run Puffin: your name, your email, and the business records you make in it.
Your clients' details belong to you. We store them for you and use them only to do what you ask.
We never sell your information, and we don't use it for ads or to train AI.
Our website uses no cookies and no ad trackers. When we start counting visits, we'll use Cloudflare Web Analytics, which counts totals only.
The Puffin app uses one small cookie, to keep your account safe.
You can download everything, or delete everything, any time. Just ask Puffin in ChatGPT.
Questions or requests? Email hello@puffinhq.com.

1. Who we are

Puffin is run by VOICEVUI SRL, registered in Romania. (Company number: [COMPANY NUMBER].)

Postal address: Aleea Zanelor 18, Bl. B, Sc. B, Ap 28, Bucharest, Romania
Email: hello@puffinhq.com
Our representative in the UK: [UK REPRESENTATIVE]

In this policy, “we”, “us” and “Puffin” mean VOICEVUI SRL. “You” means you.

For your own account and records, we are the “controller”. That’s the legal word for the one who decides how information is used. For your clients’ details, you are the controller and we work for you. Section 6 explains this.

2. What this policy covers

This policy covers three things. They work differently, so we explain each one on its own.

The website at puffinhq.com. This is the site you’re reading now.
The launch list and the tips email. The emails you can sign up for on the website.
The Puffin app. The plugin you use inside ChatGPT, and the pages it opens, at app.puffinhq.com.

It doesn’t cover ChatGPT itself. OpenAI runs ChatGPT and has its own privacy policy. See section 7.

About the words we use. US law often says “personal information”. UK and EU law say “personal data”. We mean the same thing: anything that’s about you and could identify you.

About the legal reasons. UK and EU law say we need a legal reason (a “lawful basis”) for each thing we do with your information. We use these:

Contract: we need it to give you the service you asked for.
Legitimate interests: we have a fair business reason, and it doesn’t outweigh your rights. You can object to these. See section 10.
Consent: you said yes. You can take it back any time.
Legal duty: the law makes us do it.

3. The website: what we collect and why

Visit counting.

What: which pages are visited, where visitors came from (the “referrer”), the type of device and browser, the rough country, and how fast pages load. We see these as totals, like “120 visits to the pricing page this week”. We can’t see who you are.
How: Cloudflare Web Analytics. Cloudflare says it uses no cookies or local storage and doesn’t “fingerprint” visitors.
Why: to learn which pages help people and which pages are slow.
Legal reason: legitimate interests.
More detail, and how to say no, in section 11.

Button taps.

What: when you tap one of the site’s main buttons (like “Tell me when Puffin is ready”), we count the tap, which button it was, and your rough country. We don’t keep your IP address or any ID, so we can’t tell taps from the same person apart.
How: Cloudflare Workers Analytics Engine.
Why: to learn which buttons and links people use.
Legal reason: legitimate interests.

Running the website safely.

What: your IP address and basic browser details, which every website receives when you visit.
How: Cloudflare hosts the website and uses this to send you the page and to block attacks.
Why: so the site works and stays safe.
Legal reason: legitimate interests.

Emails you send us.

What: your email address, your name if you give it, and what you write.
Why: to answer you.
Legal reason: legitimate interests (answering people who contact us). If you’re asking about your rights, legal duty.

There are no ad trackers, no social media pixels and no videos from other sites that load on their own.

4. The launch list and tips email

What we collect: your email address, whether you asked for the tips email, and when you signed up and confirmed.

Why: to send you what you asked for.

The launch list: up to 5 short emails about Puffin’s launch.
The tips email: one email a month with practical tips for running a small business. Only if you checked the box. We never check it for you.

Legal reason: consent.

How it works:

After you sign up, we email you a link to confirm. Nothing else is sent until you tap it. If you don’t confirm within 7 days, we delete your address.
After the 5th launch email, or 60 days after launch if that’s sooner, we delete your address from the launch list.
If you asked for the tips email, we keep your address for that until you unsubscribe.
Every email has an unsubscribe link. You can also email hello@puffinhq.com.
When you unsubscribe, we keep your address on a “do not email” list. That’s only so we never email you again by mistake.
We don’t track whether you open our emails or which links you click.

Stopping robots: the sign-up form has a hidden box that only robots fill in, and it limits how many sign-ups one connection can send in a minute. Cloudflare keeps that count in memory for a minute and doesn’t save it. When it’s switched on, the form also uses Cloudflare Turnstile, a bot check that looks at basic signals from your browser. It isn’t a puzzle and it doesn’t use your information for ads. If it can’t load, you can still sign up. Legal reason: legitimate interests.

Who sends them: Resend, from hello@news.puffinhq.com. We keep the list itself in our own database at Cloudflare, apart from the app’s. See section 7.

5. The Puffin app: what we collect and why

You use Puffin inside ChatGPT. Here’s what Puffin itself keeps.

Your account.

What: your name, your email address, a backup email if you add one, your plan (Free or Pro), the country you work from, your currency and time zone, your usual tax rate, your tax number (like a VAT number) if you add it, and settings like whether accepted quotes become draft invoices.
Why: to set up your account, sign you in, and show money and dates the right way.
Legal reason: contract.
When you first connect, we suggest a country, currency and time zone from your rough location. Cloudflare works this out from your IP address. We don’t store the IP address for this.

Signing in and keeping your account safe.

What:
- Your 6-digit codes. To check the code you type, we keep a scrambled version (a “hash”). Each code works once, for 10 minutes. Our copy of the email that sent you the code is deleted after 24 hours.
- Your email address each time a code is sent to it, with the time. We use it to limit how many codes one address can get.
- A record of each browser you’ve signed in from. We save a random ID in a cookie on that browser, and a scrambled copy of it with the date we first saw it. See section 11.
- Your IP address, if a wrong code is typed. We use it to slow down anyone trying to guess codes.
- Your rough location when you sign in from a new browser (like “near Bristol, UK”). Cloudflare works this out from your IP address. We put it in the alert email we send you, so you can spot sign-ins that weren’t you.
- Sign-in tokens that let ChatGPT stay connected to your account.
Why: so only you can get into your account, and so you hear about it if someone else tries.
Legal reason: contract, and legitimate interests (keeping accounts safe).

Your business setup.

What: your business name, what your business does, your website address, your logo, your main brand color, how you like messages to sound (friendly or formal), your payment terms, your services and prices, and which Puffin tools you switched on.
If you give us your website address, Puffin reads that one public page to fill in your setup: its words, your logo and your brand colors. Cloudflare’s browser service usually loads the page for us. We don’t read Etsy shop pages.
Why: to fill in your quotes and invoices for you.
Legal reason: contract.

Your business records.

What: everything you make in Puffin. That includes clients (with their stage and follow-up dates), client notes and history, possible jobs (“opportunities”), quotes, invoices, payments you record, how clients can pay you (like bank details you add to invoices), and reminders. For makers, it also includes products, materials, suppliers, what goes into each product, batches, and stock changes (with what you paid for materials). PDF copies of quotes and invoices you send are stored too. We also keep a history of what happens in your account, like quotes sent and settings changed.
Why: this is what Puffin is for.
Legal reason: contract.

Files you bring in.

What: if you bring clients or unpaid invoices over from a spreadsheet file, we keep the file’s name and every row and column in it while you check the preview, including columns you choose to skip. Once you bring it in, we empty the stored rows and keep only the clients and invoices it added. A preview you never bring in stays until you delete your account.
Why: so you can check what will come in before anything is saved.
Legal reason: contract.

Your clients’ details.

What: names, company names, email addresses and notes about the people you work for. Also when a client first opened a quote or invoice link, whether they accepted or declined a quote, and which emails Puffin sent them.
Why: to send quotes, invoices and reminders for you.
You’re in charge of this information. See section 6.

Reminders to your clients.

When an invoice is due, Puffin drafts a polite reminder, then more at 3, 7 and 14 days late. It also drafts one friendly nudge when a quote has had no answer for 3 days.
On the Free plan, each reminder waits until you tap Send.
On Pro, Puffin emails invoice reminders for you, from 9am your time, without waiting for a tap. You can turn this off for any client, or switch off follow-ups. Quote nudges always wait for you.
Reminders go out in your business’s name, and replies go to your email. We keep a record of each one: which step it was, and when and to whom it was sent.

Emails Puffin sends.

What: a copy of each email Puffin sends, to you or for you. For example, your sign-in codes, new-browser alerts, and the quotes, invoices and reminders sent to your clients. The copy includes who it went to, the subject, the words and whether it was delivered.
Why: so we can try again if sending fails, never send twice, and show you what was sent.
Legal reason: contract.

Card payments and Pro billing (when we add them).

What: if you connect Stripe so clients can pay by card, we’ll store your Stripe account ID and the payment status of each invoice. If you buy Pro, we’ll store your plan and billing status.
We’ll never see or store full card numbers. Stripe handles them.
Why: to take payments for you, mark invoices paid, and run your Pro plan.
Legal reason: contract. We’ll keep billing records because tax law tells us to (legal duty).

Your Etsy shop (when we add this, and only if you connect it).

What: your shop name, your listings, and your orders, including your buyers’ names and what they bought.
Why: to track your stock and show the true profit on each order.
Legal reason: contract. Your buyers’ details are yours to be in charge of, like your clients’ details (section 6).
You’ll be able to disconnect your shop any time.

Usage counts.

What: when key things happen in your account, like signing up or finishing setup. Each is saved with your account ID, not your name or email.
Why: to see if Puffin is working for people, and to fix what isn’t.
Legal reason: legitimate interests.

Error records.

What: when something breaks, like an email that won’t send, we record what broke and the ID of the record involved. We don’t put your email address or name in these.
Why: to fix problems.
Legal reason: legitimate interests.

Feedback.

What: anything you send us through “send feedback to Puffin”, with your account ID.
Why: so a real person can read it and help.
Legal reason: legitimate interests.

Things we don’t do:

We never sell your information or your clients’ information.
We don’t share it for ads, and we don’t use ad trackers in the app.
We don’t use it to train AI.
We don’t read your records unless you ask us to help, or the law makes us, or we need to fix a problem or stop misuse.

6. Your clients' details: you're in charge

When you put details about your clients (or, once we add Etsy, your Etsy buyers) into Puffin, you are the controller of that information. That means you decide what goes in and why. We are your “processor”: we store it and use it only to do what you ask, like sending a quote.

This means:

You need a fair reason to store your clients’ details and to email them. For most freelancers, that’s simply that you’re working for them.
If one of your clients asks to see or delete what you hold about them, they should ask you. You can find, change, export or delete their details in Puffin. If you need help, email us and we’ll help you.
If a client contacts us directly, we’ll pass the request to you, unless the law says otherwise.
Our promises to you as your processor are in the “Your clients’ details” section of our Terms.

7. Who else handles information for us

We use a few other companies to run Puffin. Cloudflare and Resend work for us. They may only use your information to do their job for us, and have agreed in writing to protect it. Stripe will too, once we add card payments. OpenAI runs its own service, under their own privacy policies, and so will Etsy if we add the Etsy connection.

Company	What they do for us	Which part
Cloudflare	Hosts the website and the app. Stores the database, files (logos, PDFs), and sign-in tokens. Runs the job queue. Makes the PDFs. Sends the app’s emails. Stores the launch list. Reads your website during setup. Keeps usage counts and error records. Counts website visits and button taps, and runs the bot check on the sign-up form.	Website, app, launch list form
Resend	Sends the launch list and tips emails. We switch off its open and click tracking.	Launch list, tips email
Stripe	When we add card payments and Pro billing: takes card payments for your invoices through your own Stripe account, and bills Pro plans.	App
OpenAI	Runs ChatGPT. What you type in ChatGPT, and what Puffin sends back (like a quote or a client’s details), passes through ChatGPT. OpenAI decides how it uses ChatGPT conversations, under its own privacy policy. Your ChatGPT settings control whether OpenAI may use your chats to improve its models.	App
Etsy	Only if we add the Etsy connection and you connect your shop: shares your shop’s listings and orders with Puffin.	App

We will never sell your information. In the words of US state laws: we don’t “sell” or “share” personal information, and we haven’t in the last 12 months.

We may also share information if the law makes us (for example, a court order), to protect people from harm or fraud, or if Puffin is sold to another business. If Puffin is ever sold, we’ll email you first, and this policy will still protect your information.

8. Sending information to other countries

Puffin is run from Romania. Some of the companies above are in the United States, and Cloudflare runs computers around the world. So your information may be stored or handled outside the UK and the EU.

When that happens, we make sure it stays protected. We use one of these:

the country has been approved by the UK or EU as having good protection;
the company is certified under the EU-US Data Privacy Framework (and its UK Extension); or
the company has signed the official “standard contractual clauses” (and the UK Addendum) with us.

Email us if you’d like a copy of these safeguards.

9. How long we keep things

What	How long
Your account and business records (including your clients’ details)	Until you delete your account. Then deleted right away.
Copies of emails Puffin sends (to you or for you)	Until you delete your account. Copies of sign-in code emails are deleted after 24 hours.
Files (logo, PDFs of quotes and invoices you send)	Until you delete your account. Then deleted right away.
Sign-in codes	They stop working after 10 minutes. We delete them after 24 hours.
Records of codes sent (your email address) and wrong codes (the IP address used)	Used for 15 minutes. Deleted after 24 hours.
Browser records for sign-in alerts	Until you delete your account. The cookie on your browser expires after 2 years.
Database backups	Cloudflare can restore our database to any point in the last 30 days. So deleted information can stay in that restore history for up to 30 days, then it’s gone for good.
Usage counts	About 3 months, by Cloudflare. They hold your account ID, not your name or email.
Error records	A few days, by Cloudflare.
Pro billing records (once we add Pro billing)	6 years after the payment, because tax law says so.
Emails you send to hello@puffinhq.com	Up to 2 years after we last write to each other, unless we need them longer for a legal reason.
Launch list	Until the 5th launch email, or 60 days after launch if sooner. Unconfirmed sign-ups: 7 days.
Tips email	Until you unsubscribe. Then only on the “do not email” list.
Website visit counts	Totals only. Cloudflare keeps them under its own rules.
Inactive accounts	We don’t delete accounts for not being used. If we ever start, we’ll email you first and give you time to download your data.

When you delete your account, we also keep a simple count that “an account was deleted” on that day, with nothing that points back to you.

10. Your rights, and how to use them

Wherever you live, you can ask us to:

show you the information we hold about you, and give you a copy;
correct anything that’s wrong;
delete your information;
give you your information in a file you can use somewhere else;
stop or limit how we use it; or
stop using it for a “legitimate interests” reason (this is called “objecting”).

You can also take back your consent for the launch list or tips email any time.

If you’re in the UK or EU, these are your legal rights under UK GDPR and EU GDPR. If you’re in a US state with a privacy law (like California), you have similar rights to know, correct, delete and opt out. We’ll never treat you worse for using any of these rights.

The quickest way, for the app:

To download everything, ask Puffin in ChatGPT to “export my data”. You’ll get a link that works for 15 minutes. It downloads a ZIP file of spreadsheets (CSV files) with all your records, plus your files.
To delete everything, ask Puffin in ChatGPT to “delete my account”. You’ll get a link to one page with one button. That page also lets you download your data first. Deleting removes your account, your records, your clients’ details, your files and the copies of your emails. It also disconnects Puffin from ChatGPT. We email you to confirm.
To correct something, ask Puffin in ChatGPT to change it. Puffin can’t change your name or sign-in email yet, so for those, email us.

Any other request, or if you can’t use ChatGPT: email hello@puffinhq.com. Tell us what you’d like. We may need to check it’s really you, for example by sending a code to the email on your account. We’ll reply within one month. If a request is complicated, we may need up to two more months, and we’ll tell you why.

Someone acting for you: in some US states, you can ask someone else to make a request for you. We’ll need proof they’re allowed to.

If you’re not happy: please tell us first, and we’ll try to fix it. You also have the right to complain to a data protection regulator:

UK: the Information Commissioner’s Office (ICO), ico.org.uk, phone 0303 123 1113.
EU: the data protection authority in your country, or Romania’s, where Puffin is based: the ANSPDCP, dataprotection.ro. There’s a list at edpb.europa.eu.
US: your state’s attorney general, or the California Privacy Protection Agency if you live in California.

11. Cookies and similar things

On the website (puffinhq.com):

No cookies at all: no tracking cookies and no ad cookies.
We count visits with Cloudflare Web Analytics. Cloudflare says it uses no cookies or local storage and doesn’t fingerprint visitors. It counts visits as totals.
The sign-up form stores nothing in your browser either.

How to say no to visit counting:

If your browser sends a “Global Privacy Control” signal, we don’t load the counter at all.
You can block it yourself with any tracker blocker, or by blocking static.cloudflareinsights.com in your browser.
Or email hello@puffinhq.com. We can’t pick you out of the totals, but we’ll tell you how to stop it.
Saying no doesn’t change how the website works for you.

In the app (app.puffinhq.com):

One security cookie, called __Host-bhq-device. It holds a random ID so we know when you sign in from a browser you haven’t used before, and can email you an alert. It lasts 2 years. We only use it to keep your account safe, never for ads or tracking. It’s “strictly necessary”, so we don’t ask first.
Signing in through ChatGPT uses tokens that ChatGPT holds, not cookies in your browser.
There’s no visit counting on the app, its Connect page, or the quote and invoice pages your clients open.

12. Children

Puffin is only for people aged 18 and over. We don’t knowingly collect information from anyone under 18. If you think someone under 18 has given us their information, email hello@puffinhq.com and we’ll delete it.

13. Keeping information safe

Here’s some of what we do:

Everything travels over a secure, encrypted connection (HTTPS).
There are no passwords to steal. You sign in with a 6-digit code sent to your email. Each code works once, for 10 minutes. Too many wrong guesses and it stops working.
We email you when someone signs in to your account from a new browser.
Every account is locked to its own records. One Puffin user can never see another’s.
Links to download or delete your data work for 15 minutes. A delete link works once. We store them scrambled.
The quote and invoice links your clients get use long random codes that can’t be guessed.
ChatGPT can never send a quote, invoice or reminder, record a payment, or delete your account by itself. You always press a button. The one exception is Pro’s automatic invoice reminders, which Puffin sends on a schedule (see section 5).
When we add card payments, Stripe will handle card numbers. We’ll never see them.

If something ever goes wrong that puts your information at risk, we’ll tell you quickly, and we’ll tell the regulator when the law says we must.

14. AI and automatic decisions

Puffin works inside ChatGPT, which is an AI. ChatGPT can make mistakes. That’s why Puffin shows you a card to check before anything is sent. The one exception is Pro’s automatic invoice reminders (see section 5).

Puffin makes some small automatic choices to save you time. For example, it suggests a starting setup that fits your kind of business, drafts an invoice when a client accepts a quote, moves a client to “past” after 180 days with no activity, and marks a quote as expired once its date has passed. You can change your setup, and turn off the invoice drafts and the move to “past”. Puffin doesn’t make automatic decisions that have legal or similarly big effects on you.

We don’t use your information to train AI.

15. Changes to this policy

If we make a big change, we’ll email you at least 30 days before it starts, and say what’s changing. For small changes, like fixing a typo, we’ll update the date at the top. Old versions are available if you ask.

16. Contact us and complaints

Email: hello@puffinhq.com
Mail: VOICEVUI SRL, Aleea Zanelor 18, Bl. B, Sc. B, Ap 28, Bucharest, Romania

We read every message. For privacy requests, we reply within one month. See section 10 for how to complain to a regulator.