Privacy Policy
Version 1.3 — April 13, 2026
1. Who are we?
VoxCloud is located at Woestduinstraat 145-1, Amsterdam, the Netherlands. Chamber of Commerce (KvK) number: 56765789. We develop open-source Nextcloud apps and offer commercial licenses and support for them.
For questions about this privacy policy, please contact us at info@voxcloud.nl.
2. What personal data do we process?
We only process data necessary for our services:
| Data | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Company name, contact person, email address, phone number | Customer account and license management | Performance of contract (Art. 6(1)(b)) | Duration of contract + 7 years (fiscal obligation) |
| Invoice and payment data | Financial administration | Legal obligation (Art. 6(1)(c)) | 7 years (fiscal obligation) |
| Support tickets and messages | Providing technical support | Performance of contract (Art. 6(1)(b)) | Duration of contract + 2 years |
| Instance hash (SHA-256) and usage statistics | License validation and volume monitoring | Performance of contract (Art. 6(1)(b)) | Duration of contract + 1 year |
| Anonymous telemetry (app version, Nextcloud version, PHP version, country code via timezone) | Product improvement and usage statistics | Legitimate interest (Art. 6(1)(f)) | 12 months, then anonymized |
3. Telemetry
Our Nextcloud apps collect anonymous usage statistics by default. This helps us improve the apps. Telemetry is designed with privacy as a core principle:
- Instances are identified via a SHA-256 hash — we never see the actual URL
- No IP addresses are stored or processed
- No personal data of end users is collected
- Country code is derived from the IANA timezone, not IP geolocation
- Telemetry can be disabled in the app settings (opt-out)
Optionally, an administrator can include the organization name and contact email with telemetry. This is entirely voluntary.
4. Who do we share data with?
We only share your personal data with:
- Hosting provider: Hetzner Online GmbH (Germany) — for hosting the license server
- Email provider: Soverin.nl (Netherlands) — for sending license and support notifications
We do not sell or provide your data to third parties for marketing purposes. Your data is not processed outside the European Economic Area (EEA).
5. Security
We take appropriate technical and organizational measures to protect your personal data:
- Encrypted connections (HTTPS/TLS)
- Passwords are stored using bcrypt hashing
- API keys are stored as SHA-256 hashes with salt
- Parameterized SQL queries to prevent injection
- Rate limiting and security headers (Helmet.js)
- Server access is restricted to authorized personnel via SSH keys
6. Your rights
Under the GDPR, you have the following rights:
- Right of access — you can request which data we process about you
- Right to rectification — you can have incorrect data corrected
- Right to erasure — you can request deletion of your data (unless a legal retention obligation applies)
- Right to restriction — you can request restriction of processing
- Right to data portability — you can receive your data in a structured format
- Right to object — you can object to processing based on legitimate interest
You can exercise your rights by sending an email to info@voxcloud.nl. We will respond to your request within 30 days.
7. Complaints
If you have a complaint about the processing of your personal data, you can contact us at info@voxcloud.nl. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.
8. Cookies
Our website only uses functional cookies (language preference). We do not use tracking cookies, analytics cookies, or third-party cookies. No consent is required for this.
9. Web Analytics
We use Plausible Analytics, an open-source analytics tool that we self-host on our own server (stats.voxcloud.nl). Plausible works without cookies and does not collect or share any personal data with third parties. No IP addresses are stored, no user profiles are created, and visitors are not tracked across websites. The data collected is limited to aggregated statistics about page views, referrers (search engine, social media), device and browser type. This data helps us improve the website. No consent required.
10. Changes
We may update this privacy policy. The most recent version is always available on this page. In case of material changes, we will inform our customers by email.