VOO

Voo

Privacy Policy

Last updated: September 11, 2026

This Privacy Policy explains how Ellington Marketing, LLC, doing business as Voo (“Voo”, “we”, “us”, “our”), collects, uses, shares, and protects information when you visit voo.dev (the “Site”), use the Voo application at app.voo.dev (the “App”), or interact with advertising, emails, or public pages we operate (together, the “Services”).

Voo is business software used by marketing agencies and their staff to manage work, bill clients, and report on advertising performance. It is not directed to consumers or children.

By using the Services you agree to this policy. If you do not agree, please do not use the Services.

1. Who we are and how to reach us

Ellington Marketing, LLC is the data controller for the Site and for account data in the App. For data an agency loads into its own workspace (client records, connected ad accounts, uploaded files) the agency is the controller and Voo acts as its processor.

Questions, requests, or complaints about privacy:

  • Email: support@voo.dev
  • Mail: Ellington Marketing, LLC, 2508 Camden Road, Greensboro, NC 27403, United States

We respond within 30 days.

2. Information we collect

2.1 Information you provide

  • Account details: name, email address, password (stored as a salted hash), profile settings, and time zone.
  • Workspace content: agencies, clients, brands, contacts, tasks, comments, knowledge documents, proposals, invoices, uploaded files, meeting recordings and transcripts, and generated media.
  • Billing details: invoice and payment records. Card numbers are entered directly with Stripe and never reach Voo.
  • Credentials you store on purpose: entries in the Access Vault and API keys for connected platforms. These are encrypted at rest (AES-256-GCM) and are never displayed again in the interface after entry except by an authorized reveal, which is audit-logged.
  • Messages you send us: contact form submissions on the Site and support emails.

2.2 Information from connected platforms

When a workspace administrator connects a third-party platform, Voo accesses only the data needed to provide the feature that was connected:

Platform Data accessed
Meta (Marketing API, Graph API) Ad account metadata and performance metrics (spend, impressions, clicks, conversions), campaign structure and creatives, Facebook Page and Instagram insights, lead-gen forms, and customer-list audiences you choose to upload (hashed before upload).
Google Ads API Ad account metadata, campaign structure, and performance metrics for the customer accounts you connect.
Support desks (FreeScout) Conversation threads, customer email addresses, and attachments from the mailboxes you connect.
Communication (Slack, EmailIt) Channel identifiers and the messages Voo sends.
Engineering and hosting (GitHub, GridPane, ServerAvatar, Better Stack, BugSmash, WordPress) Repository, server, site, incident, and bug-report records for the accounts you connect.
Project tools (Wrike) Tasks, folders, and comments in the spaces you map.
AI (OpenRouter and the model providers it routes to; Model Context Protocol servers you add) The prompts, files, and context you or your agents send for processing.

Each connection can be removed at any time in Settings → Integrations, which deletes the stored credentials immediately.

2.3 Information collected automatically

  • On the Site: IP address, browser and device type, pages viewed, referring URL, and approximate location derived from IP, collected through server logs and, where enabled, analytics and advertising tags (see Section 7).
  • In the App: sign-in events, feature usage, error reports, and an activity log of changes made in a workspace. These are needed to run the service securely and to give administrators an audit trail.

3. How we use information

  • To provide the Services: run your workspace, render dashboards and reports, generate tasks and invoices, send the emails you ask us to send, and perform actions you explicitly approve on connected platforms.
  • To operate AI features: send the content you choose to the models you select, through OpenRouter, to generate text, images, video, audio, transcripts, and agent work. Voo does not use your content to train models, and our processors are bound by their terms not to do so.
  • To secure and improve the Services: detect abuse, debug problems, keep audit trails, and understand which features are used.
  • To communicate: respond to your requests, send transactional notices about your account, and, only if you opt in, send product news. You can unsubscribe from marketing at any time.
  • To market the Site: measure the performance of our own advertising and show relevant ads about Voo to people who visited voo.dev (Section 7). We never use data from our customers’ connected ad accounts for this.
  • To comply with law: keep records we are legally required to keep and respond to lawful requests.

We process personal data to perform our contract with you, for our legitimate interests in operating and securing a business service, with your consent where required (for non-essential cookies and marketing), and to comply with legal obligations.

4. How we share information

We do not sell personal data and we do not share it with third parties for their own marketing. We share data only with:

  • Service providers who process it for us under contract: cloud hosting and database providers, Cloudflare (Site hosting, security), EmailIt (transactional email), Stripe (payments), OpenRouter and the model providers it routes to (AI processing), and S3-compatible storage for uploaded files.
  • Connected platforms at your direction: when you connect Meta, Google, or another platform and approve an action, the data needed for that action is sent to that platform.
  • Your workspace: content you create is visible to other members of your workspace according to the roles and team permissions your administrators set, and to clients only where you share it with them.
  • Legal and safety: if required by law, subpoena, or to protect the rights, property, or safety of Voo, our users, or the public.
  • Business transfers: if Voo is involved in a merger, acquisition, or asset sale, we will notify you before your data becomes subject to a different policy.

5. Platform data from Meta

Where Voo receives data through Meta’s Marketing API or Graph API (“Platform Data”), we:

  • use it only to provide reporting, dashboards, and the approved actions that the connecting workspace requested;
  • do not sell it, license it, or use it to build or augment profiles for any other purpose;
  • do not use it to target advertising on Voo’s behalf;
  • keep it only as long as the connection is active, or as long as needed to display the reports it powers, and delete it on disconnection or on request;
  • protect it with encryption at rest, access controls, and audit logging;
  • comply with the Meta Platform Terms and Developer Policies, and will delete Platform Data promptly if Meta requests it or if Voo’s access is revoked.

Customer-list audiences uploaded to Meta are SHA-256 hashed immediately before upload; the raw list is never stored in the change record.

You can request deletion of Platform Data at any time. See our Data Deletion Instructions.

6. Data from Google

Voo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data received through the Google Ads API is used only to provide and improve the reporting and management features you connected, is not transferred to others except as necessary to provide those features or as required by law, is not used for serving advertisements, and is never read by humans except with your consent, for security purposes, or to comply with law.

Voo also complies with the Google Ads API Terms and Conditions and Google’s Required Minimum Functionality where applicable.

7. Cookies, pixels, and advertising on the Site

The Site uses the following categories of cookies and similar technologies:

  • Strictly necessary: security, load balancing, and remembering a consent choice. These cannot be turned off.
  • Analytics: to understand how visitors use the Site. Data is aggregated.
  • Advertising: the Meta Pixel and Google Ads conversion and remarketing tags, which let us measure whether our ads led to a visit or sign-up and show ads about Voo to people who visited the Site. These tags may set cookies and collect your IP address, user agent, and the pages you viewed, and may match that data to your Meta or Google account according to those companies’ policies.

Analytics and advertising tags load only after you consent where consent is required by law. You can withdraw consent at any time from the cookie settings link in the Site footer, block cookies in your browser, and opt out of interest-based advertising through:

The App at app.voo.dev uses only strictly necessary cookies for authentication and preferences. We do not place advertising tags inside the App.

8. Data retention

  • Account and workspace data is kept while your account is active. When a workspace is deleted, its data is removed from production systems within 30 days and from backups within 90 days.
  • Connected-platform credentials are deleted immediately on disconnection. Performance data is read on demand for reports; any cached copies are refreshed or purged on their own schedule and removed on disconnection.
  • Meeting recordings, transcripts, and generated media are kept until you delete them or the workspace is deleted.
  • Contact form submissions and support email are kept for up to 24 months.
  • Site analytics and advertising data are kept for the periods set in Google and Meta, which you can review in their policies; our own server logs are kept for 30 days.
  • Financial records (invoices, payments) are kept for the period required by tax law, typically seven years.
  • Audit logs are kept for 24 months for security and compliance.

9. Security

Voo uses TLS in transit, AES-256-GCM encryption at rest for stored credentials and vault entries (with a dedicated vault key), salted password hashing, role- and team-based access controls, human approval gates before any change reaches a connected platform, and audit logging of sensitive actions. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any regulator as required by law.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority.

California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights. Voo does not sell personal information. Advertising tags on the Site may constitute “sharing” under the CPRA; you can opt out via the cookie settings link in the footer or by enabling the Global Privacy Control signal in your browser, which we honour.

To exercise any right, email support@voo.dev. We will verify your identity and respond within 30 days (45 days where the law allows). If you are a client of one of our agency customers, we may direct your request to that agency, who controls your data in their workspace.

11. International transfers

Voo is operated from the United States. If you access the Services from elsewhere, your data is transferred to and processed in the United States and in the countries where our service providers operate. Where required, we rely on standard contractual clauses or equivalent safeguards.

12. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children under 13 (or 16 where that is the applicable age). If you believe a child has provided us data, contact us and we will delete it.

The Site and App link to third-party services. Their privacy practices are their own; please review their policies.

14. Changes to this policy

We will post any changes on this page and update the “Last updated” date. For material changes we will also notify account holders by email or in the App before the change takes effect.

15. Contact

Ellington Marketing, LLC (Voo) 2508 Camden Road, Greensboro, NC 27403, United States support@voo.dev

For data deletion, see Data Deletion Instructions. For the rules that govern use of the Services, see the Terms of Service.