Privacy Policy

Last updated 16 August 2026

This policy explains what Podieazy collects, the legal basis for each use, how long we keep it, who we share it with, and the rights you have under the GDPR and the CCPA.

1. Who we are

Podieazy is the controller of the personal data described in this policy. For content you record, upload or collect from your own attendees and voters, you are the controller and Podieazy acts as your processor.

Contact for privacy questions and data rights requests: privacy@podieazy.com.

2. What data we collect

Account data: name, email, username, password hash, avatar, bio, plan and workspace settings.
Content data: recordings, uploaded media, transcripts, episodes, clips, show notes and artwork.
Webinar data: registrations (name, email, company, question), attendance minutes, chat, questions and poll answers.
Voting data: ballots, ranked orderings, eligibility lists, verification status and hash-chained audit entries.
Billing data: Stripe customer and subscription identifiers, plan, status and renewal dates. We never store full card numbers.
Technical data: IP address, device and browser information, and error diagnostics.
Marketing data: newsletter subscription state, topic preferences, source and consent timestamps.

3. Legal basis for processing (GDPR Article 6)

Contract: creating your account, running recordings, webinars, votes and hosting; billing your plan.
Legitimate interests: security, fraud prevention, service improvement and diagnostics.
Consent: analytics and marketing cookies, and newsletter email (double opt-in). You may withdraw consent at any time.
Legal obligation: tax records and retention of governance audit records where law requires it.

4. How we obtain data (GDPR Articles 13 and 14)

Most data is provided directly by you when you register, record, host or vote. Some data is provided about you by a Podieazy customer, for example when an organisation uploads you to a voter eligibility list or you register for a webinar it hosts. In that case the organisation is the controller, we process on their instruction, and this policy tells you how we handle that data and how to reach us.

Providing account and billing data is necessary to use the service. Providing marketing consent is optional and refusing it has no effect on your use of the platform.

5. How long we keep data

Recordings, transcripts, episodes and clips: for as long as your account is active, then deleted 30 days after account closure.
Vote audit logs and tamper-evident governance records: 7 years, with personal identifiers anonymised when an account is deleted.
Webinar registration and attendance data: 24 months after the event unless the host deletes it sooner.
Marketing and newsletter data: until you unsubscribe, plus a suppression record so we do not email you again.
Billing records: 7 years, as required for tax and accounting.
Technical logs and diagnostics: 90 days.

7. We do not sell your personal data

Podieazy does not sell personal data and does not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. We have not sold or shared personal data in the preceding 12 months.

8. International transfers

Our processors may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on UK International Data Transfer Agreements or EU Standard Contractual Clauses, together with technical safeguards such as encryption in transit and at rest.

9. Anonymous ballots and voting privacy

For anonymous votes, voter identity and ballot content are written to two separate tables and are never joined after submission. Audit entries record only an anonymised token, an event type and a timestamp, hash-chained to the previous entry. This means we can prove a vote was cast and that records were not altered, without revealing how any individual voted.

10. Security

Media is stored in private buckets accessible only to your workspace. Row-level security restricts every database record to its owner or an explicitly authorised participant. Access to production systems is restricted and audited, and traffic is encrypted in transit.

12. Your California (CCPA/CPRA) rights

Right to know the categories and specific pieces of personal information collected, the sources, purposes and recipients.
Right to delete personal information we hold about you, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing, we do not sell or share, so there is nothing to opt out of.
Right to limit use of sensitive personal information.
Right to non-discrimination for exercising your rights, including no degraded service or pricing.
Right to use an authorised agent to submit a request on your behalf.

13. How to exercise your rights

Use "Download my data" and "Delete my account" in Account settings for immediate self-service access and erasure, or email privacy@podieazy.com. We respond within one month for GDPR requests and within 45 days for CCPA requests, and complete deletion within 30 days.

14. Children under 13

Podieazy is not intended for children. Accounts require you to be 18 or older, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such data, we delete it promptly. Parents or guardians who believe a child has provided data should contact privacy@podieazy.com.

15. Cookies

We use strictly necessary cookies for sign-in and security, analytics cookies (on by default, and only where local law allows) and marketing cookies (off by default). Manage your choices from the Cookies link in the footer. See the Cookie Policy for the full list.

16. Changes to this policy

We will notify you by email or in-product before material changes take effect. The date at the top of this page always reflects the current version.