Privacy Policy

This Privacy Policy explains how Voxif Technologies (Private) Limited (“Voxif”, “we”, “us”) collects, uses, stores, and shares personal data when you use voxif.tech, app.voxif.tech, the Voxif API, or place or receive phone calls through the Voxif platform (collectively the “Service”). It applies to: (a) account holders and their team members who sign in to the dashboard; (b) visitors to our website; and (c) end users (call recipients) whose data is processed when our Customers place or receive calls. Where (c) applies, our Customer is the data controller and Voxif acts as a data processor under their Data Processing Agreement.

1. What we collect

We collect personal data in three categories:

(a) Account data — when you create an account or log in: email, full name, hashed password, two-factor authentication state, organization name, billing details (handled by our payment processor), team membership, and IP addresses you sign in from.

(b) Service-operation data — when you operate voice agents: provider API keys (encrypted at rest with AES-256-GCM using your organization’s Data Encryption Key), SIP trunk credentials (same encryption), call metadata (phone numbers, durations, dispositions, latency metrics), call transcripts, call recordings if you enable them, knowledge-base documents you upload, contact lists you import, and webhook subscription endpoints.

(c) Technical telemetry — when you interact with the site or API: user-agent string, IP, timestamp, the routes you accessed, and error logs. No third-party advertising trackers are loaded on voxif.tech.

2. Why we collect it (lawful bases under GDPR)

Our lawful bases for processing are:

• Performance of a contract — for account data and service-operation data that we need to deliver the Service you subscribed to.
• Legitimate interests — for security, fraud prevention, abuse handling, aggregated service-quality metrics, and product improvement that does not involve training AI on your data.
• Legal obligation — when we must respond to a lawful subpoena, court order, or regulatory request (see our Law Enforcement Response Policy).
• Consent — for non-essential analytics or marketing communications, and for any processing that legitimately depends on it. You can withdraw consent at any time.

3. How we use it

We use personal data to operate, secure, bill, and improve the Service:

• Authenticate you and your teammates and prevent unauthorized access.
• Route your calls through the providers you have configured (your STT/LLM/TTS keys, your SIP trunk).
• Persist call logs, transcripts, contacts, and bookings so you can review and act on them in the dashboard.
• Send transactional email (account verification, password reset, booking confirmations, quota alerts).
• Compute aggregated, anonymized service metrics (call counts, latency percentiles, error rates) for engineering and operations purposes.
• Detect and respond to abuse, fraud, and security incidents.
• Comply with applicable laws and respond to lawful requests.

We do not sell personal data. We do not use your transcripts, prompts, contact lists, or recordings to train AI models — ours or anyone else’s. We do not run third-party advertising trackers on voxif.tech.

4. Sub-processors

We use the following sub-processors. Each is listed with the data category they process. Customer-side BYOK providers (OpenAI, Deepgram, ElevenLabs, your SIP carrier) are controllers of their own usage because your traffic and credentials flow directly between you and them through Voxif as a conduit.

• Oracle Cloud Infrastructure — compute, storage, networking. Region: US-East (Ashburn) by default; EU region available for enterprise contracts. Encrypted at rest (block volumes) and in transit (TLS 1.2+).
• Cloudflare — DNS, CDN, DDoS protection, WAF. Sees inbound HTTP request metadata only; never decrypted application data.
• LiveKit (self-hosted on Oracle) — real-time media routing. Voice frames traverse LiveKit between caller, agent, and your AI providers; we do not retain raw audio frames.
• Telnyx (or another SIP carrier you select) — PSTN telephony. Carrier sees call setup metadata (from/to numbers, duration); voice content is end-to-end between caller and your TTS/STT providers.
• Brevo — transactional email delivery (verification, password reset, booking confirmations, quota alerts).
• Your chosen AI providers — STT (e.g. Deepgram), LLM (e.g. OpenAI), TTS (e.g. ElevenLabs). Each operates under their own privacy policy. Voxif transmits your requests using your encrypted-at-rest API keys, which we decrypt in memory only for the duration of the request.

We maintain a current list of sub-processors and will give at least 30 days’ notice via the dashboard before adding a new one. Enterprise customers under a signed DPA receive direct email notice.

5. Where data lives

Default region for new accounts is United States (Oracle US-East, Ashburn). Enterprise customers may request EU residency (Oracle Frankfurt) or Pakistan residency, subject to a signed DPA. Encrypted backups are stored in the same region as the primary data. Cross-border transfers, where they occur, rely on Standard Contractual Clauses (SCCs) and our DPA.

6. How long we keep it

Default retention windows. Enterprise customers can shorten any of these by contract.

• Account data: for the life of the account, then 30 days after termination for export, then deletion.
• Call transcripts: 30 days, then auto-purged. Configurable up to 365 days for paid plans, or down to 7 days for privacy-first customers.
• Call recordings: only retained if you explicitly enable recording. Default retention 30 days.
• Encrypted provider keys: until you rotate or delete them. Old keys are destroyed within 7 days of rotation.
• Billing records: 7 years to comply with accounting and tax laws.
• Security logs: 12 months.
• Aggregated, anonymized service metrics: indefinitely.

7. Security

We apply commercially reasonable safeguards:

• Provider API keys, SIP credentials, and other secrets encrypted at rest using AES-256-GCM with a per-organization Data Encryption Key (DEK), which is itself wrapped by a Key Encryption Key (KEK) held in Oracle Cloud Vault. Voxif staff cannot read plaintext keys at the application layer.
• TLS 1.2+ on all transport, with HSTS and modern cipher suites.
• Argon2id password hashing; passwords never logged.
• HMAC-SHA256 signing on outbound webhooks with replay protection.
• JWT access tokens with short TTL; refresh tokens revocable per-session.
• Rate limiting and bot-mitigation at the edge (Cloudflare WAF).
• Production deployment in a hardened virtual private cloud; the database is not publicly addressable.
• Quarterly access review for production credentials.

8. Breach notification

If we become aware of a personal-data breach affecting your account or data, we will notify you without undue delay and in any case within 72 hours of confirming the breach, by email to your account’s primary contact and via the in-product banner. Our notice will describe (to the extent then known) the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the steps we have taken or propose to take to mitigate it.

9. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — ask for a copy of the personal data we hold about you.
• Correction — ask us to fix data that is wrong.
• Deletion — ask us to delete your account and the data we hold (subject to lawful retention obligations, e.g. billing records).
• Portability — receive your data in a structured, machine-readable format (CSV/JSON) where technically feasible.
• Restriction or objection — ask us to stop or limit certain processing.
• Withdraw consent — where processing is based on consent.
• Complain — to a supervisory authority. EU residents may contact their national data-protection authority; UK residents may contact the ICO.

To exercise any of these rights, email privacy@voxif.tech with the request and the email address on your Voxif account. We will respond within 30 days. If you are an end user (call recipient) and not a Voxif Customer, contact the Customer who placed the call — they are the data controller for your data.

10. California residents (CCPA / CPRA)

California residents have the rights described in Section 9 plus the right to know which categories of personal information we have collected, the sources, the business purposes, and any third parties with whom we have shared it. Voxif does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise CCPA rights, email privacy@voxif.tech. You may also designate an authorized agent.

11. Children

The Service is not directed at children under 16. If we learn we have collected personal data from a child under 16 without parental consent, we will delete it promptly. Contact privacy@voxif.tech if you believe a child has provided us data.

12. Cookies and similar technologies

voxif.tech uses strictly-necessary cookies for session, authentication, and CSRF protection. app.voxif.tech additionally uses local storage to persist UI preferences (active campaign, sidebar state) on your device. We do not run third-party advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings; signing in to the dashboard will not work if you block all cookies.

13. Changes

We will update this Privacy Policy from time to time. Material changes will be announced via the dashboard and (for enterprise customers) by email at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

14. Contact

Privacy / GDPR / CCPA: privacy@voxif.tech.
Security: security@voxif.tech.
Mailing address: Voxif Technologies (Private) Limited, Karachi, Pakistan. We will publish a full registered-office address as soon as our EU and US registered agents are appointed.