VOIS Privacy Policy

1. Who we are

VOIS is a communication app that helps children and adults who are non-verbal, pre-verbal, or have limited speech to communicate. It is set up and managed by the adults who care for them — parents, family members, therapists, and educators — who build personalised communication boards using pictures, words, and recorded voices.

VOIS is a service of Amazing K (Pty) Ltd (registration number 2013/066820/07), a registered special-needs centre based in South Africa, trading as "GetVois". In this policy, "VOIS", "we", "us", and "our" refer to Amazing K (Pty) Ltd t/a GetVois. Under South Africa's Protection of Personal Information Act, 2013 (POPIA), we are the "responsible party" for the information you give us to create and run your account, and for the content created in individual and family accounts. Professional accounts used by schools, clinics, and therapy centres work differently: there, the institution is the responsible party for the children's and clinical information its staff enter, and VOIS acts as its "operator", processing that information on the institution's behalf. Section 7 explains this fully.

We take your privacy seriously — and we are especially mindful of it because many of the people VOIS is built for are children. This policy explains, in plain language, what information we collect, how we use and protect it, where it is stored, and what rights you have. If anything here is unclear, please contact us using the details at the end.

2. A note about children first

Because VOIS is often used by and for children, protecting their information matters more than anything else we do. A few things are worth stating clearly up front:

• Children never create accounts or enter their own information. Everything is set up by a responsible adult.
• We ask for as little as possible about a child. To create a child profile, we only need the child's first name — no surname, date of birth, ID number, or diagnosis is requested or required.

Under POPIA, a child is anyone under the age of 18, and the personal information of a child may only be processed with the consent of a "competent person" — usually a parent or legal guardian. By creating a child profile on VOIS, you confirm that you are that child's parent or guardian, or that you have the necessary authority and consent to do so. Where VOIS is used by a school, clinic, or therapy centre, that institution is responsible for obtaining parental or guardian consent before adding any child to the system, and we recommend keeping records of that consent as part of its normal enrolment process.

3. What information we collect

The information VOIS holds falls into a few simple categories:

• Account information — the email address, display name, and account type you provide when you sign up.
• Child profile information — the first name of each child profile you create.
• Board content — the categories, cards, and labels you create to build a communication board.
• Card images — photographs you take or upload to create communication cards. These may include pictures of a child and of real, everyday environments, so we treat them as sensitive and handle them accordingly.
• Voice recordings — short audio clips a caregiver records so the child hears a familiar voice when they tap a card. These are normally the voice of the adult setting up the board, saying the word on the card. They are stored on the device and backed up to our storage so they follow the child to any device the account signs in on. We do not listen to, transcribe, or analyse them, and they are used for nothing except playing back in the app.
• Clinical information — if you use a Professional account, we also store therapist names, session notes, goals, progress records, observation tags, and attendance records that you enter. Because this is a record of a child's therapy, POPIA treats it as special personal information relating to the child's health — the most strongly protected category — and we handle it accordingly (see Section 7).
• Account security information — a small amount of information needed to keep your account secure, such as authentication tokens. Your password is encrypted (hashed) and is never stored in a readable form, even by us.

We do not collect advertising or tracking data, and we do not build profiles of you for marketing.

4. What is stored on your device

VOIS keeps a copy of your recordings on the device itself, as well as backing them up. This is deliberate: a child tapping a card needs to hear the word straight away, and often in places with poor signal — a therapy room, a car, a shop. Playing from the device means VOIS keeps working when the connection does not.

Recordings made while you are offline are saved on the device and uploaded the next time you are connected. Until then, that recording exists only on that device.

If a recording is deleted — because the card was deleted, or the profile or account was removed — VOIS removes the copy held on each device as well, the next time that device signs in.

The app also stores its own cache and offline files on your device so VOIS loads quickly and works without a connection.

5. How we use your information

We use your information only to provide and run the service you have signed up for. In practice, that means:

• syncing your communication boards across the devices you log into;
• storing your voice recordings so the app can play them back, and so they are not lost if a device is lost, replaced, or reset;
• keeping your account secure and letting you sign in;
• providing the clinical tools to Professional accounts; and
• responding to you when you contact us for support.

We do not sell or rent your personal information to anyone. We do not use it for advertising. The only marketing we may send is direct communication about VOIS itself — for example, an update about a new feature — and you can ask us to stop at any time.

6. Where your information is stored

The information that syncs to the cloud — your account details, child profile names, board content, card images, voice recordings, and clinical records — is stored using Supabase, our database and storage provider, on servers located in Ireland (the European Union). This means your personal information is processed outside South Africa.

POPIA permits this kind of cross-border transfer where the place the information is sent to offers protection that is substantially similar to POPIA. Ireland and the wider European Union are governed by the General Data Protection Regulation (GDPR), one of the strongest data-protection standards in the world, and our provider is bound by a data-processing agreement that requires it to protect your information. In addition, you consent to this transfer when you create an account, and the transfer is necessary for us to provide the service you have asked for.

How we keep it secure:

• All information sent between your device and our servers is encrypted using HTTPS/TLS.
• Our database uses row-level security, so each account can only ever access its own data.
• Passwords are managed securely and stored only in encrypted (hashed) form.

7. Professional accounts: schools, clinics, and therapy centres

Professional accounts work differently from home accounts, and the law treats them differently too, because they hold genuinely sensitive clinical information. When a school, clinic, or therapy centre uses VOIS, the information its staff enter about a child — session notes, goals, progress records, observation tags, and attendance — is a record of that child's therapy. Under POPIA this is special personal information relating to a child's health, which carries the highest level of protection the Act provides. The following applies to Professional accounts:

The institution is the responsible party. The school, clinic, or therapy centre decides what information to collect about each child and why, so under POPIA it is the responsible party for that information. VOIS acts as the institution's operator — we process the information only on the institution's behalf and on its instructions, in order to provide the platform. This relationship is set out in a separate Data Processing Agreement between VOIS and the institution, which applies in addition to the Terms of Use.

Parental consent is the institution's responsibility. The institution must obtain consent from each child's parent or guardian before creating a profile for that child in VOIS, and should keep a record of that consent. Because the institution is the responsible party, this responsibility sits with it, not with VOIS.

Access to children's records. Any device signed in to a Professional account can see all of the children's information held in that account. The institution is responsible for keeping its login details confidential and for ensuring that only authorised staff can access the account.

Keeping and deleting information. We keep a Professional account's information for as long as the subscription is active. If the subscription is cancelled, we retain the information for a grace period of 30 days so that the institution can export its records, after which it is permanently deleted.

A parent's right to have a child's data deleted. A parent or guardian may ask for their child's information to be deleted. Because the institution is the responsible party, this request is usually directed to the institution, and VOIS will action it as the institution's operator. VOIS provides an in-app profile deletion feature so that a child's profile and all of its associated information can be permanently removed.

Voice recordings and erasure. Voice recordings belong to the account they were made in, and VOIS keeps no record of which individual made a particular recording. This means we cannot action a request to delete one person's voice while leaving the rest of an account's recordings in place — deletion works per card, per child profile, or per account. Institutions and households where several people record should be aware of this before they start.

8. Who we share your information with

We do not share your personal information with third parties for their own purposes. To run VOIS, we rely on a small number of trusted service providers who process information strictly on our instructions and only to keep the service working:

• Supabase — our database, image storage, and voice recording storage provider;
• Netlify — hosting for the VOIS app;
• Payfast — payment processing for VOIS subscriptions;
• Resend — sends your account and service email;
• Zoho Mail — hosts the mailbox that receives your replies.

When you pay for a VOIS subscription, your payment is processed directly by Payfast on its own systems. Your card and banking details are entered with Payfast, not with VOIS — we do not see, collect, or store them. We may also disclose information if we are required to do so by law, or to protect the rights, safety, or property of our users or others.

9. Your rights under POPIA

You have the right to:

• Access — ask for a copy of the personal information we hold about you or your child;
• Correction — ask us to correct information that is inaccurate or out of date;
• Deletion — ask us to delete your account and the information associated with it;
• Objection — object to the way we process your information; and
• Withdraw consent — withdraw a consent you have given, at any time.

To exercise any of these rights, please contact our Information Officer using the details below. You also have the right to lodge a complaint with the Information Regulator of South Africa at https://inforegulator.org.za/

10. How long we keep your information

• We keep your information for as long as your account is active.
• When you delete your account, or ask us to delete your information, we permanently remove it from our active systems within 30 days, and from our backups within a further 90 days. This includes your voice recordings.
• A copy of a recording may remain on a device that has not been used since the deletion. VOIS removes it the next time that device signs in.
• Records of payments are an exception. South African law requires us to keep records of payments and invoices for seven years, and longer where an audit, objection, or outstanding return applies. Those records include the name and email address given to our payment provider at the time of payment, and they are kept after an account is deleted. We use them only for tax, accounting, and audit purposes, and for nothing else. Everything else associated with your account is deleted.

11. Cookies and local storage

VOIS does not use advertising or tracking cookies. We only use essential browser storage that the app needs to function: to keep you signed in, to keep a copy of your voice recordings on the device so they play back instantly and work offline, and to let the app work offline.

We also use Google Analytics 4 to understand how visitors use the VOIS website (getvois.co.za). This service collects anonymised data about page visits, time on site, and general browsing behaviour, and uses cookies to do so. This data is processed by Google and is used solely to help us improve the website. It does not identify you personally. You can opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout

12. Photographs and voices are your responsibility

When you add a photograph to VOIS, you are responsible for making sure you have permission to photograph the person in it — especially if that person is a child. We do not view, moderate, or analyse the photographs you upload; they are stored privately against your account and are only visible to you. If you would prefer not to use photographs, VOIS includes a built-in icon library you can use instead, which can be a good choice for children who move between different care settings.

The same applies to voices. If you record someone else — a partner, a grandparent, a sibling, a colleague — please make sure they are happy for their voice to be recorded, stored, and played back in the app. Where an account is shared within a household or a team, the account holder is responsible for this. We do not listen to, transcribe, or analyse recordings.

13. Changes to this policy

We may update this policy from time to time as VOIS develops or as the law requires. When we do, we will show you a notice in the app, and the "last updated" date at the top will change. If the changes are significant, we may ask you to read and accept the updated policy before continuing to use VOIS.

14. How to contact us

Responsible party: Amazing K (Pty) Ltd t/a GetVois (registration number 2013/066820/07)
Information Officer: Noel Ross
Email: hello@getvois.co.za
Address: 22 Paul Street, Northwold, 2155