Privacy Policy

The short version

• We never connect to your core banking system.
• We only receive the feedback data you choose to give us.
• We don’t sell data, and we never use one institution’s data to serve another.
• Short excerpts of feedback go to an AI provider to produce the analysis. That content is not used to train models.
• You can export your data or ask us to delete it.

Who this policy covers

Custavox is sold to institutions, not to individuals, so there are three different groups of people involved and they aren’t treated the same way.

• The institution and its staff. The bank or credit union that subscribes, and the people there who sign in and use the product.
• The institution’s employees. People who are named in customer feedback, and people who fill in a profile describing their role. Most of them never create an account.
• The institution’s customers. The people whose reviews, survey responses, complaints and exit interviews are uploaded. They have no relationship with Custavox at all.

For the second and third groups we act as a service provider processing data on the institution’s behalf and under its instructions. If you are an employee or a customer of an institution that uses Custavox, that institution controls the data and your request should go to them first — though you can always call us and we will help route it.

What we collect

Account information. When someone creates an account we collect their name, work email, and the name of their institution, plus a password managed by our authentication provider. If you contact us or book a demo, we collect what you send us — typically a name, work email, phone number and institution.

Employee profiles. Employees of a customer institution may be invited to describe their own role: their title, a short summary, whether they work with customers, which locations and teams they belong to, the systems and products they use, when they started, and the handoffs they are part of. This is submitted without an account — the employee identifies themselves by email so they can return to it later. It is visible to their employer, because their employer is the one asking.

The feedback you upload. Reviews, survey responses, complaints, exit-interview notes and similar records. These frequently contain personal information about third parties — a reviewer’s display name, the words they wrote, and often the name of an employee they dealt with. You control what is in those files.

Your org structure. The branches, departments, people, systems, products and touchpoints you set up, so findings can be attributed to the right part of your institution.

Usage and technical data. Standard logs — pages loaded, actions taken, browser and device information — used to operate, secure and troubleshoot the service.

Support and in-product feedback. If you use the feedback button inside the product, we receive your message along with your name, email, the page you were on and your browser details, so we can reproduce what you saw.

What we ask you not to upload

Custavox does not need, and has nowhere to store, account numbers, balances, transaction records, Social Security numbers, card or routing numbers, dates of birth, or credentials. Please keep them out of the files you upload. If you send them to us by mistake, call us and we will delete them.

What we never collect

We do not integrate with, read from, or write to your core banking system, and we have no access to account balances, transactions or customer financial records. Nothing about Custavox requires that access. All data reaches us because someone at your institution uploaded it or typed it in.

How we use it

• To analyze the feedback you upload and produce the scores, attributions, summaries and recommended actions that are the product.
• To create and maintain your account and let your colleagues collaborate in it.
• To respond to you, provide support, and run a demo if you ask for one.
• To keep the service secure, reliable and working, and to investigate misuse.
• To meet our legal obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use one institution’s data to serve another, and we do not use your data to train AI models.

How AI is used

To write the summaries and suggested opportunities, Custavox sends a compact package to an AI provider: aggregate figures we have calculated, and a small number of short feedback excerpts as supporting evidence. Reviewer names are never included. Employee names and branch names are included, because the point of the analysis is to say where a problem is and who can fix it.

Under our agreement with that provider, the content we send is not used to train their models and is deleted within 30 days. The AI produces analysis and suggestions; it does not make decisions, and everything it produces is visible to you in the product.

Who can see your data

Your own team. People at your institution who have been given access. You control who those are.

A small number of Custavox staff. Some of our people can access customer accounts to provide support, investigate problems and keep the service running, including summary information about each institution’s account. Access is limited to those who need it for their job.

Service providers. A small number of vendors process data solely to provide their service to us — hosting and database infrastructure, and the AI provider described above. They are bound by contract and may not use the data for their own purposes.

Nobody else. We do not share your data with other institutions, advertisers, or data brokers. We may disclose information if we are legally required to, or to protect rights and safety, and we will tell you unless we are prohibited from doing so.

We don’t list our vendors by name here, because they can change. If your vendor review needs the current subprocessor list, call us at (515) 460-4911 and we’ll send it.

Where your data is stored

Your data is stored in data centers in the United States. It is encrypted in transit and at rest, and every record is scoped to your institution.

Retention and deletion

We keep your data for as long as your account is active. You can delete individual records in the product at any time. If you close your account, call us and we will delete your institution’s data, other than anything we are required to keep for legal, accounting or fraud-prevention reasons. Copies may persist in encrypted backups for a limited period before they age out.

Employees named in feedback

Customer feedback often names the employee who served them, and Custavox attributes that feedback to the person. This is an accurate reflection of what customers said, not a performance rating, and the analysis can be wrong — a name can be misheard, a complaint can be about a policy rather than the person who explained it.

Decisions about employees belong to the employer. If you are an employee at an institution that uses Custavox and you want to know what has been attributed to you, or you think something is wrong, ask your employer — they can see it, correct it, and are responsible for how it is used.

Your rights and choices

You can access, correct, export or delete data in the product, and you can call us for help with any of it. Depending on where you live you may have additional rights under state or other privacy laws — including the right to know what personal information is collected and why, to request correction or deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are used in the California Consumer Privacy Act.

If you are a customer or employee of an institution that uses Custavox, send your request to that institution. They control the data; we will assist them in responding.

Cookies and similar technologies

We use cookies that are necessary for the product to work — keeping you signed in and maintaining your session — and we store some preferences, like your theme and table layout, in your browser. We do not use advertising cookies or third-party tracking pixels. Blocking essential cookies will prevent sign-in from working.

Security

Data is encrypted in transit and at rest, access is limited to the people who need it to operate the service, and each institution’s data is separated from every other’s in code and checked automatically before changes ship. No system is perfectly secure, but we treat this data as what it is: your customers’ words about your institution.

If personal information is compromised, we will notify affected institutions without undue delay and give you what you need for your own regulatory obligations.

Business transfers

If Custavox is involved in a merger, acquisition, financing or sale of assets, data may be part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

Children

Custavox is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 13.

Changes

If we change this policy we’ll update the date at the top of this page, and we’ll tell you directly if the change is significant.

Contact

Questions, requests, or concerns — including access, correction and deletion requests, or a copy of our current subprocessor list — call us at (515) 460-4911.