Last updated: June 19, 2026
This policy explains what data Vogata collects, why we collect it, and what you can do about it. We've tried to write it like humans, not lawyers. If you'd rather skip ahead, here's the short version: we collect what we need to run the product, we don't sell your data, and we never use your team's goals, 1:1s, or conversations to train AI models.
Vogata is an ultralight performance and growth platform for startups without an HR team. If you have a question about anything here, email [email protected] and a real person will answer.
Who we are
"Vogata", "we", "us", and "our" refer to the team behind Vogata, the operator of vogata.app and app.vogata.app. We are the data controller for the personal data described below, except where we act as a processor on behalf of an organization that uses Vogata (more on that in "Your role" below).
Your role: account holder vs. team member
Vogata is a B2B product. How we treat data depends on who you are:
- Organizations (controllers). When a company signs up, that company decides what goals, 1:1 notes, and team data go into Vogata. For that content, the organization is the controller and Vogata acts as a processor on its behalf.
- Individual members. If you were invited by your employer, your organization administrator controls your access and most of your content. For questions about your data inside a workspace, contact your organization first; we'll support both of you.
For your own account and billing data, and for the operation of the service itself, Vogata is the controller.
What we collect
Account data
Your name, work email, password (stored hashed, never in plain text), and basic profile details. We need this to create and secure your account.
Organization data
Your company or team name, the members you invite, roles, and team structure. This is what makes Vogata a shared workspace instead of a solo tool.
Goals and 1:1 content
The objectives you set, the notes and agendas you write for 1:1s, growth check-ins, and related context. This is the heart of the product, and we treat it as sensitive. It belongs to you and your organization.
Product usage
How you use Vogata: pages visited, features used, timestamps, and device and browser information. We use this to keep the service working, fix bugs, and decide what to build next. We keep this deliberately minimal.
Contact and support data
When you email us or fill in a form, we keep the message and your contact details so we can reply and follow up.
Technical and security data
IP address, approximate location derived from it, and security signals (for example, from our bot-protection challenge) used to prevent abuse and keep accounts safe.
Why we use it, and our legal basis
Under the GDPR we need a lawful reason to process your data. Here's the mapping:
- To provide the service (accounts, goals, 1:1s, the AI coach) — performance of our contract with you.
- To keep it secure and prevent abuse (bot protection, fraud and security monitoring) — our legitimate interest in a safe product.
- To improve the product (minimal usage analytics, debugging) — our legitimate interest in a product that works well, balanced against your privacy.
- To communicate with you (service emails, support replies) — performance of our contract and our legitimate interest in supporting customers.
- To send product updates or marketing (only where this is separate from service emails) — your consent, which you can withdraw at any time.
- To meet legal obligations (tax, accounting, lawful requests) — compliance with the law.
Under the CCPA, we do not sell or share your personal information for cross-context behavioral advertising. We have not done so in the past 12 months.
The AI coach, and the one promise that matters
Vogata includes an AI coach that helps you write clearer goals, prepare better 1:1s, and reflect on growth. To do that, relevant content from your workspace is sent to our AI provider, Anthropic (the maker of Claude), to generate a response.
Your data is not used to train AI models. Anthropic processes the content only to return a result to you, and does not use it to train or improve its models. We chose our provider partly for this reason. The AI coach is an assistant, not a decision-maker: it never makes employment decisions, and a human is always in the loop.
Who we share data with
We don't sell your data. We do rely on a small set of trusted infrastructure providers (sub-processors) to run Vogata. Each one only gets what it needs:
- Amazon Web Services (AWS) — hosting, databases, and computing in the US (region us-east-2). Your application data lives here. AWS also powers our email delivery (Amazon SES) for sign-ups, invitations, and notifications.
- Cloudflare — content delivery, DNS, and bot protection (Turnstile). Helps the site load fast and keeps automated abuse out.
- Anthropic — the AI provider behind the AI coach. Processes workspace content to generate responses, and does not use it to train models (see above).
We may also share data when the law requires it, to protect Vogata or its users, or as part of a business transfer (for example, a merger or acquisition) — in which case we'll let you know and this policy will continue to protect you.
Google sign-in and Calendar
Vogata lets you sign in with Google and, optionally, connect your Google Calendar. If you use these, we access only the data you approve on Google's consent screen:
- Sign-in (OpenID, email, profile) — to create or log you into your account and show your name.
- Calendar events — to read your agenda and create 1:1 calendar events on your behalf (including a Google Meet link), so you don't have to leave Vogata to schedule a 1:1.
We store the minimum needed to keep the connection working (an encrypted authorization token), and we use Google data only to provide these features at your request. We do not use Google data for advertising, and we do not sell it. You can disconnect Google access at any time from your account settings or your Google account permissions, which deletes the stored token.
Limited Use. Vogata's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train AI or machine-learning models.
International transfers
Vogata is hosted in the United States. If you're in the EEA, the UK, or elsewhere, your data will be transferred to and processed in the US and other countries where our providers operate. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to protect those transfers.
How long we keep it
We keep your data for as long as your account is active, and for as long as we need it for the purposes above. After that:
- Account and workspace data — kept while your account is active; deleted or anonymized within a reasonable period after you close your account or your organization removes you.
- Goals and 1:1 content — controlled by your organization; removed when they delete it or close the workspace.
- Billing records — kept as long as the law requires (typically for tax and accounting).
- Logs and minimal analytics — kept for a short, rolling window, then deleted or aggregated.
How we protect it
We encrypt data in transit and at rest, hash passwords, restrict internal access to what's necessary, and use bot protection and monitoring to keep accounts safe. No system is perfectly secure, but we take this seriously and design for it. If a breach ever affects your data, we'll notify you and the relevant authorities as required by law.
Your rights
Depending on where you live (GDPR, CCPA, and similar laws), you can:
- Access the personal data we hold about you.
- Correct data that's wrong or out of date.
- Delete your data ("right to be forgotten").
- Export your data in a portable format.
- Object to or restrict certain processing, and withdraw consent at any time.
- Opt out of any sale or sharing of personal information — though, as noted, we don't sell or share it.
- Be free from discrimination for exercising any of these rights.
To exercise any of these, email [email protected]. If your data sits inside a workspace controlled by your employer, we may direct your request to them and help both sides. You also have the right to complain to your local data protection authority.
Cookies and analytics
We keep cookies to a minimum. We use what's necessary to keep you signed in, remember your preferences, and protect the site from abuse. We use lightweight, privacy-respecting analytics to understand product usage in aggregate. We don't run third-party advertising trackers, and we don't follow you around the web.
Children
Vogata is a workplace tool and isn't meant for anyone under 16. We don't knowingly collect data from children. If you believe a child has given us personal data, email [email protected] and we'll remove it.
Changes to this policy
We may update this policy as the product and the law evolve. When we make a material change, we'll update the date at the top and, where appropriate, let you know by email or in the app. Continuing to use Vogata after a change means you accept the updated policy.
Contact us
Questions, requests, or just want to understand something better? Email [email protected]. You can also reach us through our contact page.
Want to see what we're talking about? Explore our features, check pricing, or start free.