Privacy Policy

Last updated: March 2026

This privacy policy explains how SIGMA DIGITAL MARKETING SRL (“VoxBase”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use our website and services at getvoxbase.com. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

SIGMA DIGITAL MARKETING SRL is a company registered in Romania. We operate an AI-powered platform that helps public relations professionals find and connect with UK journalists and media contacts.

For the purposes of data protection law, SIGMA DIGITAL MARKETING SRL is the data controller. If you have any questions about how we handle your data, you can reach our privacy team at contact@getvoxbase.com.

2. What we collect

2.1 Account information

When you create an account, we collect your name, email address, and password. Your password is securely hashed using industry-standard algorithms — we never store it in plain text. You may also provide your company name and job title.

2.2 Payment information

Payments are processed entirely by our payment partner, Stripe. We do not store your credit card number, bank details, or full payment credentials on our servers. Stripe provides us with a customer ID, subscription status, and billing dates so we can manage your account.

2.3 Usage data

We collect information about how you use VoxBase, including search queries, journalist profiles viewed, media lists created, and feature interactions. This helps us improve the product and provide you with a better experience.

2.4 Analytics data

We use Plausible Analytics, a privacy-focused, cookie-free analytics service hosted in the EU. Plausible does not collect personal data, does not use cookies, and does not track you across websites. We receive only aggregate statistics such as page views, referral sources, and device types.

3. How we use your data

We use the personal data we collect to:

  • Provide, maintain, and improve the VoxBase platform
  • Process your subscription and manage billing
  • Power AI-powered search and journalist insight features
  • Send transactional emails (account confirmation, password resets, billing receipts)
  • Respond to support requests
  • Monitor for abuse and ensure platform security
  • Analyse aggregate usage patterns to improve our product

We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties for their own marketing purposes.

4. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

  • Contract performance (Article 6(1)(b)): Processing your account data, search queries, and subscription information is necessary to provide you with the VoxBase service you have signed up for.
  • Legitimate interests (Article 6(1)(f)): We process aggregate usage data for product improvement, and we process publicly available journalist contact information to provide the core database service. We have assessed that these interests do not override the rights and freedoms of the individuals concerned.
  • Consent (Article 6(1)(a)): Where you sign up for waitlist notifications or marketing communications, we process your email on the basis of your consent. You can withdraw consent at any time.
  • Legal obligation (Article 6(1)(c)): We may process data where required by law, for example to comply with tax or regulatory obligations.

5. Journalist and media contact data

The VoxBase database contains publicly available professional contact information for UK journalists and media professionals. This includes names, job titles, outlet affiliations, professional email addresses, social media profiles, and publicly listed beat coverage areas.

We collect this information from publicly available sources including media outlet websites, public social media profiles, press directories, and professional networking platforms. This data relates to individuals’ professional capacity and is processed under our legitimate interest in providing a media contact database service to the public relations industry.

If you are a journalist listed in our database: You have the right to access, correct, or request removal of your information at any time. Please contact us at contact@getvoxbase.com and we will process your request within 30 days. You can also use the “Report an issue” button on your profile page to flag inaccurate information, which we will investigate within 48 hours.

6. Third-party services

We use the following third-party services to operate VoxBase. Each processes data only as necessary to provide their service to us:

  • Supabase (EU region) — Database hosting and user authentication. Stores your account data, search history, and media lists.
  • Vercel — Website hosting and serverless functions. Processes requests and serves the VoxBase application.
  • OpenAI — Powers embedding-based semantic search. Your search queries are sent to OpenAI to generate vector representations. We do not send journalist personal data to OpenAI for training purposes.
  • Anthropic — Powers AI-generated journalist insights and conversational search features. Query text may be sent to Anthropic for processing.
  • Stripe — Payment processing. Handles all credit card transactions, invoices, and subscription management.
  • Resend — Transactional email delivery. Sends account confirmation, password reset, and billing notification emails.
  • Plausible Analytics (EU-hosted) — Privacy-focused, cookie-free website analytics. No personal data is collected.

7. International data transfers

Your account data is stored in Supabase’s EU region. Some data processing — specifically AI search queries — involves transferring data to OpenAI and Anthropic, which are based in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable, as required under UK GDPR.

We evaluate all third-party providers for their data protection practices and only work with providers that offer appropriate safeguards for international data transfers.

8. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data from our systems within 30 days. Some data may be retained for longer where required by law (for example, billing records for tax purposes, which we retain for 7 years).

Media lists and search history are deleted when your account is deleted. Aggregated, anonymised usage statistics may be retained indefinitely as they cannot be used to identify you.

9. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Ask us to correct inaccurate or incomplete data.
  • Right to erasure: Ask us to delete your personal data.
  • Right to data portability: Receive your data in a structured, machine-readable format.
  • Right to object: Object to processing based on legitimate interests.
  • Right to restrict processing: Ask us to temporarily limit how we use your data.
  • Right to withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at contact@getvoxbase.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Cookies

VoxBase uses only essential cookies required for the service to function. These include authentication session cookies managed by Supabase, which are necessary to keep you logged in.

We do not use advertising cookies, tracking cookies, or third-party cookies. Our analytics provider, Plausible, is fully cookie-free. No cookie consent banner is required because we do not use any non-essential cookies.

11. Children

VoxBase is a business-to-business service designed for public relations professionals. We do not knowingly collect personal data from anyone under the age of 18. If we learn that we have collected data from a child, we will delete it promptly.

12. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

13. Contact us

If you have any questions about this privacy policy or how we handle your data, please contact us: