Privacy Policy

VoiceSync handles personal data in two distinct roles, and the difference matters for your rights.

• For our own customers — the businesses that buy the service — we decide how their account data is used. We are the controller, and this policy governs it.
• For the people who call those businesses, we act only on the instructions of the business. They decide what happens to that data; we process it for them. We are the processor, and you should raise requests with the business you called. We will help them answer you.

We do not retain call audio. Only the text transcript is kept. This is a deliberate design decision and it materially limits what could ever be exposed.

• We do not sell personal data, and we never have.
• We do not use call content for advertising or profiling.
• We do not use your data or your callers' data to train AI models.
• We do not make automated decisions that produce legal or similarly significant effects about a person.

Running a telephone line answered by an AI necessarily involves other companies. The current list, what each one receives and where it operates, is published and kept current on the Sub-processors page.

Some of these operate outside India and outside the EEA, so call data crosses borders. Where that happens we rely on the transfer mechanisms available to us and on contractual terms with each provider.

Transcripts and call records are kept for the retention period configured by the business whose line was called, and are deleted automatically when it expires. Account data is kept while the account is open and deleted after closure, apart from records we must keep for tax or legal reasons.

Depending on where you are, you may have the right to access what we hold, correct it, have it deleted, object to processing, ask for a copy in portable form, and complain to a regulator.

If you called a business that uses VoiceSync, ask that business first, as they decide. If it is easier to come to us, write to us and we will route it and help them answer.

Indian users may contact our Grievance Officer, named on this page. We aim to respond within 30 days.

The console is not for children. Where a caller gives us information about a child — a parent booking an appointment, for example — the business is responsible for having the parent's consent. We do not profile children or direct advertising at anyone.

Data is encrypted in transit, access to each business's data is isolated at the database level, and console access requires authentication. Fuller detail is on the Security page.

If a breach affects personal data we will notify the affected businesses and the relevant authority within the time limits that apply to us, and we will tell you what happened rather than what we would like to have happened.