Privacy
Privacy notice
What we collect, why, who processes it for us, how long we keep it, and your rights. Last updated October 26, 2026.
We collect what we need to make and publish your show, and to bill you. We do not sell your data, and we do not use advertising trackers. To ask what we hold about you, or to delete it, write to [email protected].
Who we are
WovenPod is run by Ostrel Software LLC, a company in the United States. Ostrel Software LLC decides how and why your personal data is used for WovenPod (under EU law, it is the "controller"). Contact: [email protected].
Who this notice covers
- Customers and the people on a customer's team.
- People named in a customer's sponsor details, or on the websites we read for a show.
- Visitors to this site, newsletter readers, and people who send us a show or a message.
- Listeners, when their podcast app fetches a feed or an episode from us.
What we collect
- Account. Your email address and name. If you sign in with Google, the name and email Google shares with us. The people you invite to your account.
- Your business and show. Your business name and website, what we read on your website, your answers in setup, and your show settings.
- Sponsors. The name, website and message of each sponsor business you add, how often it comes up, and what we read on its website.
- Episodes. Scripts, audio, notes, sources and fact-check records.
- Billing. Stripe collects your payment details. We receive your billing name, email, address and tax number if you give one, the card brand and last four digits, and your payment history. We never see full card numbers.
- Use of the site and app. Your IP address and browser type, sign-in records, and what you do in the app. On this site, page views, price page views and episode plays, with a random visitor number.
- Price test. Which price group you are in, any offer code in the link you used, a random visitor number and when it was set.
- Messages. What you write to us, and our replies.
- Newsletter and show submissions. Your email and the shows you chose. If you send us a show: its name, its feed, your name, your email and your note.
- Listeners. When an app fetches a feed or an episode, our servers see its IP address and app name. We keep these only in short-lived server logs.
Cookies
We use three cookies of our own, and no advertising or third-party tracking cookies.
- Session cookie, app only. Keeps you signed in. Lasts up to 30 days, or until you sign out.
- Google sign-in cookie, app only. Used only if you sign in with Google, to finish that sign-in safely. Lasts 10 minutes.
- Price cookie, on this site and the app. Keeps the price you see the same on every visit, and lets us count which price works best. It holds your price group, any offer code, a random visitor number and the date. It is signed so it cannot be changed. Lasts 180 days.
Why we use it, and our legal basis
EU law asks us to say which legal reason we rely on. Here they are.
| What we do | Legal basis (GDPR Article 6) |
|---|---|
| Run your account, sign you in, and make, check and publish your shows. | Our contract with you. |
| Read your website, research your topics, and name your sponsors. | Our contract with you. For people named on those websites or in sponsor details: our and your legitimate interest in making the show you asked for. |
| Take payments and keep tax records. | Our contract with you, and our legal duties. |
| Keep the service secure and stop abuse, using sign-in records, IP addresses and logs. | Our legitimate interest in a safe service. |
| Show each visitor one price, and measure the price test. | Our legitimate interest in fair, consistent prices and in setting them well. |
| Send the newsletter. | Your consent. You confirm by email, and you can unsubscribe in any email. |
| Answer your messages, and look at shows you send us. | Our legitimate interest in replying to you. |
| Protect our legal rights. | Our legitimate interest. |
We do not send you marketing emails unless you ask for them.
Software that writes and voices
We make episodes with software that uses artificial intelligence, through the providers listed below. They receive the content needed for each step, such as what we read on your website, your show settings and your sponsor details. We use them under business terms in which they act for us. We do not use your content to train artificial intelligence models, and we choose provider plans that do not allow them to train on it.
Who processes data for us
These companies handle data only to do the job listed, for us. Business customers who need a data processing agreement can ask at [email protected].
| Company | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts this site, the app, your feed and your audio files. Stores files and our encrypted backups, sends and receives our emails, and protects the site from abuse. | United States, with servers worldwide |
| Hetzner Online GmbH | Runs our database and the servers that make episodes. | Germany and Finland |
| Stripe | Takes payments and keeps billing records. We never see or store full card numbers. | United States and Ireland |
| Anthropic (Claude API) | Researches, writes and checks episodes, and drafts show ideas and sponsor messages. It receives what we read on your website, your show settings and your sponsor details. | United States |
| Google (Gemini API, Google Cloud, Google sign-in, Gmail) | Reads scripts aloud with synthetic voices, drafts show ideas, and makes cover art. Signs you in if you choose Google. Holds the emails you send us. | United States |
| Exa | Searches the web for research and fact checks. It receives search questions about your show's topics. | United States |
| STELQ | A second web search service, used only when we switch research to it. It is run by the same founder as us. It receives the same search questions as Exa. | United States |
| Deepgram | Turns our finished audio back into text, to confirm the voices read the script. Voices short phone-call scenes in some episodes. | United States |
| fal (Features and Labels, Inc.) | Makes music, sound effects and some cover art, using models from Sonilo, Stable Audio, ElevenLabs and others. It receives short descriptions of sounds and images. | United States |
| FactUnion (Ostrel Software LLC) | Our related fact-checking service. It checks the claims in every factual episode, using the same kinds of providers listed here. | United States, with servers in the EU |
We also share data when the law requires it, to protect our rights or someone's safety, or with a company that takes over WovenPod, which must then follow this notice.
Data sent outside the EU
Ostrel Software LLC is in the United States, and most of our providers are too, so your data is processed there. Our database and our production servers are in the EU. When data from the EU or the UK goes to the United States, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses (with the UK addendum). You can ask us for a copy of these safeguards.
How long we keep it
- Account, show and sponsor data: while your account is open. When you close it, we delete it within 90 days, except as below.
- Unfinished podcast setups: kept with your account so you can continue in any browser, and deleted when you start the podcast or 90 days after your last change.
- Published episodes and feeds: as our terms say, at least 90 days after a plan ends, and longer while we redirect a feed you moved.
- Sign-in codes: deleted a day after they expire. Sessions: at most 30 days, or until you sign out.
- Payment and tax records: as long as tax law requires, usually 7 years.
- Price test records: while the test runs, and at most 2 years.
- Security and server logs: at most 30 days.
- Backups: deleted data leaves our live systems within 90 days and our backups within 12 months. Backups are encrypted and locked, so nobody can change or erase them early. We only ever restore one to recover from a failure, never to bring deleted data back into use.
- Newsletter: until you unsubscribe. Messages to us: as long as needed to answer, and at most 3 years unless a legal matter needs longer.
- If you approve an episode, we keep a record of it (your name, email, the time, your IP address and device details) and of the review emails we sent you, for three years after the approval, and then we delete it, even if your account was deleted sooner.
- The plan: which upcoming episodes you looked at, planned or swapped, and whether you swapped from the Monday email. We use this to learn whether planning ahead helps businesses keep their podcasts going. We keep it for 2 years, also after you delete your business; by then it holds only ids and dates, nothing that names you. Some businesses do not get the Monday email, so we can see whether it helps. The links in that email work without signing in, so please do not forward it. A swap link works once and stops working when that week's topic is set, and we delete the links 30 days after they expire.
Your rights
Wherever you are, you can ask us what we hold about you, and ask us to correct or delete it. If you are in the EU or the UK, you also have these rights under the GDPR:
- to get a copy of your data, and to have it sent to you or to another company in a common format;
- to have it corrected, deleted, or its use restricted;
- to object to uses based on our legitimate interest;
- to take back your consent at any time (for example, for the newsletter);
- to complain to a data protection authority. In Hungary that is the NAIH (naih.hu). You can also go to the authority where you live or work.
Write to [email protected] from the email address on your account. We answer within one month. We may ask you to confirm who you are.
US state privacy rights
If you live in California or another US state with a privacy law, you can ask to know what personal information we collect, use and disclose, and ask us to correct or delete it. In the last 12 months we collected the categories listed in "What we collect": identifiers (such as name, email and IP address), commercial information (such as payments), internet activity (such as use of the site and app), and business details. We collect them from you, from your team, from your and your sponsors' websites, and from Stripe and Google when you use them. We use them for the purposes above, and disclose them only to the providers listed, for those purposes.
You can use an authorized agent. We will not treat you differently for using your rights.
We do not sell your data
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the last 12 months. We do not use sensitive personal information to infer things about you. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out anyway.
Children, security and decisions
WovenPod is for businesses and is not meant for anyone under 16. We do not knowingly collect children's data. If you think we have, write to us and we delete it.
We protect data with encryption in transit and in our backups, sign-in by one-time code instead of passwords, and access only for people who need it. No system is perfectly safe. If a breach puts your data at risk, we tell you and the authorities as the law requires.
We do not make decisions about you by automated means that have legal or similarly important effects. Your price group in a price test is chosen at random, not from a profile of you.
Changes
If we change this notice in a way that matters, we email account holders before the change applies, and we update the date at the top.
Contact
Ostrel Software LLC. Privacy questions and requests: [email protected].