Back to Tools
Voxtrics logo

Voxtrics

GDPR Compliant

Finnish website survey and feedback platform from Oiva Software Oy in Helsinki, storing survey responses on its own servers in Finland under a published Article 28 DPA, with a free plan and paid plans from €15 a month.

🇫🇮Finland🇪🇺EU Hosted🇪🇺 European

Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.

Freemiumfrom €15/month
Voxtrics website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
GDPR Compliant
HQ CountryFinland
OwnershipEuropean-owned
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
European UnionDPA section 7: "Survey responses and all other Customer data are stored on Voxtrics's own servers in Finland." (feedback.voxtrics.io/en/legal/dpa, read raw 2026-10-07). Vendor-stated: the physical data centre was not named.
EU Servers Available
Data Processing AgreementView DPA
Sub-processor ListView sub-processors
Schrems II Risk
Low Risk
SCCs in Place
Last Verified7 October 2026

How we reached this

Finnish legal entity: Oiva Software Oy, Business ID 3642400-8, Viipurinkatu 12 L 9, 00510 Helsinki, Finland, named as data processor in the DPA and as the contracting party in the Terms and Privacy Policy, all read raw (curl, not WebFetch summary) 2026-10-07. The Finnish PRH open data API confirms the business ID: Oiva Software Oy, limited company, registered 2026-07-30, VAT-liable from 2026-07-23, registered office Viipurinkatu 12, Helsinki. This is a ten-week-old company; the vendor says the product has just launched, and the DPA and Privacy Policy are both dated 6 October 2026. Terms governed by Finnish law, exclusive jurisdiction of the District Court of Helsinki. COMPLIANT: a published Article 28 DPA at a stable URL, roles stated correctly (customer as controller of survey responses, Voxtrics as processor), named technical and organisational measures, 48-hour breach notification, deletion or return within 30 days of termination, audit rights, and 14 days' notice of new sub-processors. Hosting: survey responses and all other customer data are stored on Voxtrics's own servers in Finland. This is a vendor statement; the data centre and whether the hardware is owned or rented were not named. Sub-processors named in the DPA: Cloudflare, Inc. (USA, reverse proxy and TLS termination for all traffic, IP addresses and request data), Plus Five Five, Inc. trading as Resend (USA, delivery of email surveys, recipient addresses and email content) and OpenAI Ireland Ltd. (AI drafting and translation, survey text only, never responses, onward transfers under SCCs). For Cloudflare and Resend the DPA cites the EU-US Data Privacy Framework and the Standard Contractual Clauses, hence sccInPlace true and schremsIIRisk LOW: the safeguards are named against the actual recipients. extraterritorialExposure is US_CLOUD_ACT, narrowly: Resend is a US provider that holds recipient addresses and email content when email surveys are used, and Cloudflare terminates TLS for all traffic. Survey responses themselves are stored in Finland. The Privacy Policy lists Stripe for payments and Google Analytics and Google Ads for the vendor's own marketing, the latter only with cookie-banner consent. Open question for the vendor: the Enterprise plan advertises a dedicated server in the EU region, which the standard plans do not explain against the Finnish hosting statement.

About Voxtrics

Website Feedback With the Data Kept in Finland

Voxtrics asks website visitors why they stopped, hesitated or left, at the moment it happens, and shows the team the answer next to a screenshot of the page. Surveys are embedded with a few lines of code and can be shown after a delay, on exit intent, once a visitor scrolls to the end of the page, on element click, to a returning visitor, to roughly one in every N visitors, or when a specific cookie is present. Several triggers can be combined, and the survey waits until all of them are met.

What It Covers

  • Survey building: multi-step surveys, one question per screen with a progress indicator, custom fields and per-survey themes (colours, radii, fonts) to match a site's branding
  • Context for each answer: page snapshots with the relevant element highlighted, and visitor-selected element capture, both on Scale and above
  • Team workflow: alerts to Slack, Telegram or email from the Growth plan, real-time responses and analytics
  • AI help: AI-assisted survey drafting and translation, metered by monthly credits

Pricing

Public on the site, in euros. Free is €0 for 300 responses a month, one domain and five active surveys, with no credit card. Growth is €15 a month for 1,500 responses, two team members and unlimited fields per step. Scale is €37 a month for 2,500 responses, two domains, four team members per domain, page screenshots and automatic insights, and includes a 30-day trial of Business. Business is €70 a month for 4,000 responses, five domains, ten team members per domain and 24/7 priority support. Enterprise is on request and adds SSO, a 99% SLA and a dedicated server in the EU region. Yearly billing is advertised at 25% off. Paid plans include 30 days of Business without a card.

The Finnish Entity and Where the Data Sits

Voxtrics is operated by Oiva Software Oy, Business ID 3642400-8, Viipurinkatu 12 L 9, 00510 Helsinki, Finland. The Finnish Patent and Registration Office lists it as a limited company registered on 30 July 2026, so this is a very young company, and the vendor describes the product as just launched. The terms are governed by Finnish law with the District Court of Helsinki as the exclusive venue.

Voxtrics publishes a genuine Article 28 GDPR Data Processing Agreement at a stable URL. It states that survey responses and all other customer data are stored on Voxtrics's own servers in Finland, and it names every sub-processor with its purpose and data. There are three: Cloudflare (USA) as reverse proxy and TLS terminator for all traffic, Resend (USA) for delivery of email surveys, and OpenAI Ireland for AI drafting and translation, which receives survey text written by the customer and never survey responses. For the two US recipients the DPA cites the EU-US Data Privacy Framework and the Standard Contractual Clauses, and it promises 14 days' notice before any new sub-processor.

This listing carries US CLOUD Act exposure, narrowly. Resend is a US company and holds recipient addresses and email content when a team sends surveys by email, and Cloudflare terminates TLS for all traffic to the service. Survey responses themselves are stored in Finland and are not held by a US provider. A team that embeds surveys on its own site and never sends email surveys has a much smaller US footprint than one that does.

Where It Fits

For readers comparing survey and feedback tools, see also Formbricks, Survicate, Mopinion and the wider Surveys & Feedback category.

Key Features

Website surveys embedded with a script tag or npm package
Triggers: delay, exit intent, scroll depth, element click, returning visitor, sampling and cookie
Multi-step surveys, or one question per screen with a progress indicator
Page screenshots and visitor-selected element capture (Scale and above)
Alerts to Slack, Telegram or email (Growth and above)
AI-assisted survey drafting and translation, metered by monthly credits
Per-survey theming to match a site's branding

Pros & Cons

Published Article 28 DPA at a stable URL naming every sub-processor with its purpose and data
Survey responses stored on the vendor's own servers in Finland, stated in the DPA
Free plan of 300 responses a month with no credit card, genuinely usable before paying
Transparent euro pricing from €15 a month, with Business free for 30 days on paid plans
AI features receive only survey text written by the customer, never survey responses
A very young company: the Oy was registered on 30 July 2026 and the DPA is dated 6 October 2026, so there is no operating history
US CLOUD Act exposure through Resend when email surveys are used, and Cloudflare terminates TLS for all traffic
The physical data centre is not named, and the hosting claim is the vendor's own statement
Response limits are low at the top self-serve tier (4,000 a month on Business)
Integrations shown on the site are still marked as being added

Company Info

Founded2026

Voxtrics GDPR & data protection: common questions

Is Voxtrics GDPR compliant?

Yes. On the evidence we checked, Voxtrics meets the requirements European businesses usually need. Voxtrics is a European company headquartered in Finland, data is hosted within the European Union, and a Data Processing Agreement is published.

Where does Voxtrics store data?

Voxtrics states: "DPA section 7: "Survey responses and all other Customer data are stored on Voxtrics's own servers in Finland." (feedback.voxtrics.io/en/legal/dpa, read raw 2026-10-07). Vendor-stated: the physical data centre was not named.". Data is hosted within the European Union.

Does Voxtrics offer a Data Processing Agreement (DPA)?

Yes. Voxtrics publishes a DPA at https://feedback.voxtrics.io/en/legal/dpa. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.

What a DPA has to cover →

Is Voxtrics a European company?

Yes. Voxtrics is headquartered in Finland and, as far as we can establish, European-owned.

Is Voxtrics subject to the US CLOUD Act?

Indirectly. Voxtrics itself is European-owned and headquartered in Finland, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.

Schrems II compliance checklist →

Who are Voxtrics's sub-processors?

Voxtrics publishes its sub-processor list at https://feedback.voxtrics.io/en/legal/dpa. Worth reading: a vendor hosting in the EU can still route data through non-EU sub-processors, which is where residency claims usually come apart.

Spotted something wrong?

Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.

If you work at Voxtrics and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.