Privacy Policy

Last updated: August 1, 2026

This Privacy Policy explains how Voismatic ("Voismatic," "we," "us," or "our") collects, uses, shares, and protects personal data when you visit our website, create an account, or use our AI voice agent platform (the "Service"). It also explains the rights available to you and to the people who call the phone numbers our customers operate through the Service.

If any term in this policy conflicts with a signed agreement between us and your organization, that agreement controls.

1. The Two Roles We Play

Our responsibilities under data protection law depend on whose data is involved:

  • As a controller — for the personal data of our account holders (for example, the email address you register with, billing details, and how you use the dashboard). We decide how this data is handled and are directly responsible for it.
  • As a processor — for the personal data contained in the calls our customers handle through the Service (for example, a caller's phone number, what they said, and the resulting transcript). We process this data on our customer's instructions and on their behalf. If you called a business that uses Voismatic, that business is the controller of your data, and you should direct privacy requests to them in the first instance. We will assist them in responding.

2. Information We Collect

  • Account data — email address, name, team or company name, and authentication records. Passwords, where used, are stored only as salted hashes.
  • Billing data — subscription plan, billing history, and the payment token issued by our payment processor. We do not receive or store full card numbers.
  • Agent configuration — agent names, greetings, instructions, voice settings, routing rules, and any knowledge base content, documents, or FAQs you upload.
  • Call data — caller and recipient phone numbers, call timestamps and duration, call transcripts, and AI-generated summaries and analysis (such as outcome, next step, sentiment, and quality signals).
  • Connected-service data — where you connect a third party such as Google Calendar, the tokens and the specific data needed to perform the actions you authorize (for example, reading availability and creating events).
  • Usage and technical data — voice minutes consumed, API requests, feature usage, log data, IP address, and device or browser information used for security, billing, and diagnostics.
  • Website data — analytics about visits to our marketing site, including pages viewed, referring source, approximate location derived from IP address, device and browser information, and clicks on calls to action such as starting a signup or calling our demo number.

3. How We Use Information and Our Legal Bases

We use personal data to:

  • provide, operate, secure, and improve the Service, and answer and act on phone calls on behalf of our customers;
  • generate transcripts, summaries, and quality analysis of calls;
  • authenticate users, manage teams, and prevent fraud and abuse;
  • bill accurately and send transactional messages such as receipts and security notices;
  • respond to support requests and diagnose technical problems;
  • comply with legal obligations and enforce our terms.

Where the EU/UK GDPR applies, we rely on these legal bases: performance of a contract (to deliver the Service you signed up for); our legitimate interests (to secure, maintain, and improve the Service, and to prevent abuse); consent (where required, such as for certain cookies); and compliance with a legal obligation. For call data we process as a processor, our customer is responsible for having an appropriate legal basis and any required consent.

In Canada, PIPEDA works from knowledge and consent rather than a list of legal bases. We collect and use personal information for the purposes set out above, which a reasonable person would consider appropriate in the circumstances, and we identify those purposes before or at the time of collection. Where consent is required it is express for sensitive information and may otherwise be implied by your use of the Service; you can withdraw it as described in Section 11.

4. Call Transcription and Consent

Transcribing and analysing phone calls is regulated. Laws in many U.S. states and other countries require that some or all parties to a call be notified of, or consent to, transcription. Our customers — not Voismatic — decide whether their agents transcribe calls and are responsible for providing any legally required notice or disclosure to callers and for obtaining any required consent. Customers are responsible for configuring their agents to give callers appropriate notice where the law requires it. If you are a caller and have questions about how a particular business transcribes or uses your calls, please contact that business directly.

5. AI Processing and Automated Analysis

The Service uses artificial intelligence to convert speech to text, generate spoken responses, and analyze calls. This processing runs on Cloudflare's infrastructure and may use third-party AI model providers engaged as sub-processors to generate agent responses. We do not permit these providers to use your content to train their general models, and we do not use the content of customer calls to train our own models except where you have explicitly opted in. AI output can be inaccurate; automated call analysis is provided as a tool and is not a substitute for human judgment, and it is not used to make legal or similarly significant decisions about callers.

6. How We Share Information

We do not sell personal data and we do not share it for cross-context behavioral advertising. We share data only as described here:

  • Sub-processors — vendors that process data to help us run the Service, each under contractual data-protection obligations:
    • Telnyx — telephony, phone number provisioning, and call routing.
    • Cloudflare — hosting, edge compute, and AI inference.
    • Neon — managed PostgreSQL database hosting.
    • Stripe — payment processing and subscription management.
    • Composio — third-party integrations, including calendars (such as Google Calendar).
    • Google Analytics — website analytics for our marketing site, to understand how visitors find us and which pages lead to signups.
    • PostHog — product analytics and error reporting across this site and the dashboard, to understand and improve how the product is used. Session replay runs in the signed-in dashboard only, never on this marketing site, and it masks what you type as well as the contents of call transcripts. We also send operational metrics about voice calls — duration, latency, model, cost, and outcome. These are attributed to the business account, not to the caller: we do not send caller phone numbers or call transcripts to PostHog.
    • AI model providers — engaged to generate agent responses, under the restrictions described in Section 5.
    • Email provider — to send transactional email.
  • Our customers — call data is made available to the business on whose behalf the call was handled.
  • Legal and safety — where required by law, legal process, or to protect the rights, safety, and security of Voismatic, our users, or the public.
  • Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this policy.

A current list of sub-processors is available on request at privacy@voismatic.com.

7. International Data Transfers

Voismatic and our sub-processors may process data in countries other than your own, including the United States. Where we transfer personal data across borders in a way covered by the GDPR or UK GDPR, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent UK mechanisms.

8. Data Retention

We retain account data for as long as your account is active. Call data and transcripts are retained according to your plan and settings and for as long as needed to provide the Service to your organization. When you delete your account, or when a customer instructs us to delete data we process on their behalf, we delete or de-identify the associated data within 30 days, except where we must retain limited records to comply with legal, tax, accounting, or security obligations, or to resolve disputes and enforce our agreements. Backups are purged on a rolling schedule.

9. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit and at rest, access controls and least-privilege access, network protection, signed webhooks, and continuous monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and any relevant authority as required by law.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. Account holders can exercise many of these rights directly through the dashboard and API — including accessing and exporting call logs, transcripts, and knowledge base content, and deleting an account. To make any other request, contact us at privacy@voismatic.com. If your data was processed because you called a business using Voismatic, please contact that business, as they control your data; we will help them respond. We will not discriminate against you for exercising your rights, and you may appeal a decision or complain to your local data protection authority.

11. Canadian Privacy Rights (PIPEDA and Quebec Law 25)

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our collection, use, and disclosure of personal information in the course of commercial activity in Canada, alongside substantially similar provincial laws in Alberta, British Columbia, and Quebec. Under PIPEDA you may ask us what personal information we hold about you, how we have used it, and to whom we have disclosed it; ask us to correct information that is inaccurate or incomplete; and withdraw your consent, subject to legal and contractual restrictions and reasonable notice. Use privacy@voismatic.com for any of these requests. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

Personal information we handle is processed and stored outside Canada, primarily in the United States, by the service providers described in Section 6 and under the transfer safeguards described in Section 7. While it is outside Canada it is subject to the laws of that jurisdiction, including lawful access by courts and government authorities there.

If you are in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25) also gives you the right to request that personal information be transferred to you or another organization in a structured, commonly used technical format, and to be informed when a decision about you is based exclusively on automated processing. Voismatic does not make decisions about individuals by automated means; the AI processing described in Section 5 generates transcripts, summaries, and quality analysis for our customers, who decide what to do next.

For calls handled on behalf of a business using Voismatic, that business — not Voismatic — determines why your information is collected and is accountable for it under Canadian law. Contact that business directly with access, correction, or withdrawal requests; we will assist them in responding.

12. California Privacy Rights

If you are a California resident, the CCPA/CPRA gives you rights to know, access, correct, and delete personal information, and to limit the use of sensitive personal information. Over the past 12 months we have collected the categories of personal information described in Section 2 (such as identifiers, commercial and billing information, internet and usage activity, and audio and electronic information from calls) for the business purposes described in Section 3. We do not sell or share personal information as those terms are defined under the CPRA. To exercise your rights, use the contact details in Section 15.

13. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

14. Cookies and Tracking

The dashboard uses essential cookies for authentication and session management.

Our marketing website uses Google Analytics 4, which sets analytics cookies (named _ga and _ga_*) in your browser to distinguish returning visitors from new ones and to measure how people move through the site. These cookies persist for up to two years and are shared across voismatic.com and its subdomains. We do not use cookies for advertising, and we do not sell or share the data with advertising networks.

We also use PostHog for product analytics, on both this site and the dashboard. It stores an identifier in your browser — a cookie named ph_* alongside a matching entry in local storage — so that repeat visits are recognised as the same person rather than counted as new ones. As with the analytics cookie above, it is shared across voismatic.com and its subdomains, which is what lets us see that someone who read a pricing page later signed up. It is never used for advertising.

You can opt out of Google Analytics entirely by installing the Google Analytics Opt-out Browser Add-on, or by blocking analytics cookies in your browser settings. Doing so does not affect your ability to use the Service.

15. Changes and Contact

We may update this Privacy Policy from time to time. We will post the updated version here with a new "last updated" date and, for material changes, notify you by email or through the Service. Questions, requests, or complaints — including access and correction requests under PIPEDA — can be sent to privacy@voismatic.com, which reaches the person accountable for personal information at Voismatic.