Privacy Policy

Last updated: July 26, 2026 · Version: 2026-07-26-v1

1. Introduction

VOXUB (“Company,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services. By creating an account or using our services, you acknowledge that you have read and agreed to this Privacy Policy.

This policy applies to two categories of individuals:

• Customers — businesses and individuals who create a VOXUB account to use our AI voice agent services.
• Callers — individuals who call a VOXUB-powered phone number or interact with a VOXUB chat widget.

2. Information We Collect

2.1 Information You Provide (Customers)

• Account registration information (name, email, password)
• Payment and billing information (processed by Stripe; we do not store full card numbers)
• Business profile data (company name, industry, hours, services)
• Agent configuration and knowledge base data
• Contact information for contacts in your phonebook
• AI assistant and chat widget conversations

2.2 Automatically Collected Information

• Log data (IP address, browser type, pages visited)
• Device information (device type, OS, mobile network)
• Cookies and similar tracking technologies
• Usage analytics (features used, time spent)

2.3 Caller Information

When someone calls a VOXUB-powered phone number or interacts with a VOXUB chat widget, we collect the following information about the caller:

• Phone number (caller ID)
• Call audio recording (if recording is enabled by the business customer)
• Call transcript (AI-generated text of the conversation)
• Call/chat metadata (timestamp, duration, call status)
• Any information the caller shares during the conversation
• Chat widget messages and any data collected by the agent

2.4 Consent and Acceptance Records

When you create an account, we log your acceptance of our Terms of Service and this Privacy Policy, including:

• The version of the Terms and Privacy Policy you agreed to
• The date and time of acceptance
• Your IP address at the time of acceptance
• Your user agent (browser/device identifier)

These consent records are retained for the duration of your account plus 6 years to demonstrate compliance with applicable privacy laws (see Section 5).

3. How We Use Your Information

We use collected information for:

• Providing and improving our AI voice agent services
• Processing payments and account management
• Sending administrative notifications and updates
• Responding to your inquiries and support requests
• Detecting and preventing fraud or security issues
• Complying with legal obligations
• Analytics and service improvement (using anonymized or aggregated data)

3.1 AI Processing

VOXUB uses artificial intelligence to process voice calls and chat conversations. When you call a VOXUB-powered number or interact with a chat widget, your voice or text is processed by:

• Speech-to-text (STT) services to transcribe your words
• Large language models (LLMs) to understand and respond to your request
• Text-to-speech (TTS) services to generate the AI agent’s voice response

We do not use your call data, chat data, or personal data to train AI models. Sub-processors processing your data are listed in Section 11.

3.2 Legal Basis for Processing (GDPR)

For individuals in the EU/EEA/UK, we process personal data based on the following lawful bases:

• Performance of a contract (Article 6(1)(b)) — to provide the services you requested
• Legitimate interests (Article 6(1)(f)) — for fraud prevention, security, service improvement, and analytics
• Consent (Article 6(1)(a)) — for call recordings, marketing communications, and non-essential cookies
• Legal obligation (Article 6(1)(c)) — for tax records, financial compliance, and law enforcement requests

4. Data Sharing

We do not sell your personal data. We do not share your personal data for cross-context behavioral advertising. We may share data with:

• Service providers (payment processors, cloud hosting, AI/ML providers, phone carriers) — see Section 11 for the full list
• Law enforcement when required by law or valid legal process
• Business partners with your explicit consent
• In case of merger, acquisition, or asset sale (with notice)

5. Data Retention

We retain your information only as long as necessary for the purposes set out in this policy, and in accordance with applicable legal requirements. The following schedule applies:

5.1 Customer Data

• Account data: Retained while your account is active. Deleted within 90 days of account closure.
• AI assistant conversations: Retained while your account is active. When you delete a conversation, it is soft-deleted and permanently removed after 6 months.
• Chat widget sessions: Retained for 6 months from the session date. When you delete a session, it is permanently removed after 6 months.
• Call recordings (audio): 90 days from call date, unless extended by the customer for dispute resolution or legal hold.
• Call transcripts: 6 months from call date. Transcripts are deleted when the corresponding recording is deleted.
• Call metadata (CDRs): 2 years from call date for billing and analytics.
• Contacts and phonebook data: Retained while your account is active. Deleted within 90 days of account closure.
• Billing and payment records: 7 years for tax and financial compliance (IRS, SOX). Payment card data is handled exclusively by Stripe (PCI-DSS compliant); we do not store full card numbers.
• Consent and acceptance logs: Retained for the duration of your account plus 6 years to demonstrate compliance with GDPR, CCPA, and other privacy laws.
• Audit and security logs: 1 year for security monitoring and incident investigation.

5.2 Caller Data

• Call recordings and transcripts: Same schedule as above (90 days for audio, 6 months for transcripts).
• Caller phone number and metadata: 2 years for call detail records.
• Chat widget data: 6 months from the session date.

5.3 Legal Hold

If we receive a legal request, subpoena, or if litigation is reasonably anticipated, we may extend the retention period for relevant data until the legal matter is fully resolved, regardless of the standard retention schedule above.

You can request earlier deletion of your data by contacting us or using our self-service deletion endpoints. Business owners can delete their account and all associated data from the dashboard settings. Callers can request data deletion by contacting privacy@voxub.com or using our data deletion request form.

6. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), secure connections (HTTPS), role-based access controls, webhook signature verification, and audit logging. PII is redacted from logs. Access to personal data is restricted to authorized personnel. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights:

• Access your personal data (right to know)
• Correct inaccurate data
• Delete your data (right to erasure)
• Export your data (data portability)
• Opt-out of marketing communications
• Opt-out of the sale or sharing of your personal information
• Limit the use of your sensitive personal information
• Withdraw consent for processing based on consent

To exercise any of these rights, contact us at privacy@voxub.com. We will respond within 30 days (or as required by applicable law).

7.1 California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we collect, the sources, the purpose of collection, and the third parties we share it with.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions (e.g., legal obligations to retain data).
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If this changes, you have the right to opt out. To exercise this right, contact us at privacy@voxub.com.
• Right to Limit Use of Sensitive Personal Information: You can request that we limit our use of your sensitive personal information to what is necessary to perform the services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, email privacy@voxub.com with “CCPA Request” in the subject line and include enough information to verify your identity. Authorized agents may submit requests on your behalf with written authorization.

7.2 GDPR Rights (EU/EEA/UK Residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / “right to be forgotten” (Article 17)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)
• Right to restrict processing (Article 18)
• Rights related to automated decision-making (Article 22)
• Right to withdraw consent at any time (Article 7)

You have the right to lodge a complaint with your local data protection authority. For more information, visit the European Data Protection Board.

7.3 Other US State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws may have similar rights. Contact us at privacy@voxub.com to exercise these rights.

8. Cookies

We use cookies for authentication, preferences, and analytics. You can control cookie settings in your browser or via our cookie consent banner. See our Cookie Policy for details.

9. Call Recording Consent

VOXUB customers are responsible for complying with all applicable federal, state, and international call recording consent laws. Under US federal law (18 U.S.C. § 2511), one-party consent is required to record a call. However, the following states require all-party consent: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington.

VOXUB provides tools to help customers comply with these laws, including AI disclosure announcements at the start of every call. The customer is solely responsible for ensuring that call recording is lawful in their jurisdiction and the caller’s jurisdiction. VOXUB is not liable for the customer’s failure to obtain proper consent.

10. Data Processing Agreement

For customers subject to GDPR, VOXUB acts as a data processor on behalf of the customer (who is the data controller). We process personal data only on the customer’s documented instructions and in accordance with our Terms of Service. A Data Processing Agreement (DPA) is available on request by contacting privacy@voxub.com.

11. Third-Party Services and Sub-Processors

We use the following sub-processors to deliver our services. Each processes personal data on our behalf under a Data Processing Agreement:

• Stripe — Payment processing (PCI-DSS compliant)
• Telnyx / Twilio — Phone number provisioning and call routing
• LiveKit — Real-time voice transport
• Deepgram — Speech-to-text and text-to-speech
• Google (Gemini) — Large language model inference
• Neon — PostgreSQL database hosting
• Railway — Application hosting
• Vercel — Frontend hosting
• Amazon S3 — Call recording storage
• Doppler — Secrets management

A current list of sub-processors is available on request. We do not use your personal data to train AI models, and our sub-processors are contractually prohibited from using your data for model training.

12. Children’s Privacy

VOXUB is not intended for users under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from children. If we become aware of such collection, we will delete the data immediately.

13. International Data Transfers

Your data may be processed in the United States and other countries. For transfers of personal data from the EU/EEA/UK to the United States, we rely on the EU-US Data Privacy Framework (where applicable) and Standard Contractual Clauses (SCCs) with our sub-processors. A Transfer Impact Assessment is conducted for transfers to countries without an adequacy decision.

EU residents may contact us to request information about the safeguards applied to their data transfers.

14. AI Transparency

In compliance with the EU AI Act (Article 50) and state AI disclosure laws (including California AB 2885 and Texas RAIA), VOXUB discloses to callers that they are interacting with an AI system at the start of every call. The disclosure is spoken before any business interaction begins and is logged for audit purposes.

Call recordings begin only after the disclosure is played. Callers in two-party consent states are informed that the call may be recorded before recording starts.

15. Data Deletion Requests

If you are a caller (not a VOXUB customer) and want your call data deleted, you can submit a request:

• Email privacy@voxub.com with your phone number or email address
• Use our automated deletion endpoint: send a POST request to https://api.voxub.com/api/privacy/erasure-request with your phone number or email

We will anonymize your data within 30 days of receiving a verified request. If you are a VOXUB customer, you can delete your account and all associated data from the dashboard settings.

16. Contact Us

For privacy questions, data requests, or to exercise your rights, contact us at:
Email: privacy@voxub.com
Website: voxub.com

17. Changes to This Policy

We may update this policy periodically. The “Last updated” date and version number at the top of this page indicate when changes were made. We will notify you of significant changes via email or prominent notice on our website at least 30 days before they take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

18. Disclaimer

This Privacy Policy is provided for informational purposes and does not constitute legal advice. While we strive to comply with all applicable privacy laws, we make no representations or warranties about the completeness or accuracy of this policy as it applies to your specific situation. If you have specific legal concerns, please consult with a qualified attorney.