TEMPLATE — HAVE COUNSEL REVIEW. This text is a starting point written for the Voxa marketing site and console. It is not legal advice and has not been reviewed by a lawyer. Have qualified counsel review and adapt it for your company, your jurisdictions and your actual practices before publishing it as your policy.
Version: 1
Last updated: not yet published (template)
This policy explains what Voxa ("we") collects when you visit this website or use the Voxa console and the voice, video and text agents built with it (together, the "Services"), how we use it, and the choices you have.
1. Who we are and how to reach us
Voxa operates the Services. Questions about this policy and requests about your data go to the security contact on our trust page (/trust#contact).
2. What we collect
Account and organization data. When you create an account we collect your name, email address and sign-in details through our identity provider, and the organization you create or join (its name, members and their roles).
Configuration. The assistants, workflows, phone numbers, knowledge files, tools and settings you create in the console.
Call, conversation and video data. When an agent you configured handles a call, text conversation or video session, the Services process the audio, the transcript, the structured data the agent extracts, the recording (when recording is on) and metadata such as the caller's phone number, duration and cost. You decide, per assistant, whether calls are recorded and analyzed, whether personal data is redacted from transcripts, and how long transcripts and recordings are kept. With HIPAA mode on, no transcript, recording or structured data is stored.
Billing data. Payments are processed by Stripe; we store your billing contact, invoices and the last four digits and brand of a saved card. Full card numbers never reach us.
Usage and log data. Request logs, an activity log of changes made in the console (who changed what and when), and error reports from the console.
Marketing website. Pages on this website send a small first-party beacon with the page viewed and the event (for example a click on "Start free"). The beacon carries no cookies and we store no IP address from it; we keep daily counts, and at most a hashed, day-salted key to count distinct visitors, which cannot be turned back into a person. If you arrive through a campaign link, the utm_* tags of that link are kept in your browser's session storage and recorded with your organization when you sign up. If you submit the contact form, we store what you entered (name, company, work email, expected volume, message).
3. How we use it
We use this data to provide, secure, support and bill the Services; to run the agents you configure (which means sending conversation data to the model, speech and telephony providers you chose, listed on our trust page); to tell you about changes to the Services; and, for the marketing website, to understand which pages and campaigns lead to sign-ups in aggregate.
We do not sell personal data. We do not use your call content to train machine learning models.
4. Cookies
The console uses strictly necessary cookies only: a session cookie that keeps you signed in, and a short-lived cookie that remembers a referral link you followed so the organization you create can be attributed to it. This website sets no analytics, advertising or other non-essential cookies, and loads no third-party trackers, which is why it shows no cookie banner. Preferences such as the last tab you opened are kept in your browser's local storage and never sent to us.
5. Who processes data on our behalf
We use subprocessors to run the Services: speech recognition and synthesis, language models, telephony, payments, identity, cloud storage and video avatars. The current list, what each one receives and where it is located is on our trust page at /trust#subprocessors. Services you connect with your own account (for example your CRM, calendar or Slack) are your choice and governed by their own terms.
6. Where data is stored and for how long
Organizations are hosted in the United States; a European Union region is available where the deployment offers it, and an organization's region is shown in its settings. Transcripts, recordings, logs and contacts are kept for the retention periods set in the organization's settings and deleted afterwards. Account data is kept while the account exists. Contact form submissions are kept for 365 days. Backups are deleted on their own schedule.
7. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. Organization admins can delete calls, contacts and whole organizations from the console; callers can ask the organization that runs an agent to erase their data, and the console provides an erasure tool for that. For anything else, contact us at the security contact on our trust page (/trust#contact).
8. Callers and your obligations
When you deploy an agent, you are responsible for the notices and consents your callers need (for example a recording notice, which the Services play by default, and text message consent), for the retention you choose, and for using the Services lawfully in the places you operate.
9. Children
The Services are for businesses and are not directed at children under 16. We do not knowingly collect data from children.
10. Changes
We may update this policy. The version and date appear at the top; material changes are announced in the console or by email before they take effect.