Privacy Policy

1. Who we are and our roles

VoxDesk (“VoxDesk”, “we”, “us”) provides an AI-powered phone receptionist for call-driven businesses, HVAC (including plumbing and electrical), Roofing, Automotive and Towing, and Real Estate. This policy applies to voxdesk.online, the VoxDesk dashboard and CRM, and calls handled by the Service.

Two roles: for account, billing, and website data we act as the business/controller. For call content processed on behalf of a subscribing business (recordings, transcripts, caller details), we act as a service provider/processor and the subscribing business is the controller of its callers' data.

2. Information we collect

Account data: name, email, phone number, business name, industry, and profile details you provide at signup and onboarding.

Call data: when VoxDesk answers a call for a business, we process the call audio, a transcript, an AI-generated summary, caller ID, call duration, and details the caller shares (such as name, callback number, service address, vehicle, property, or the reason for a visit). A recording-and-AI disclosure plays at the start of calls by default.

Booking, lead, and CRM data: appointments, messages, contacts, deals, and lead details created through calls, the website chat assistant, or the contact form.

Billing data: subscription tier and payment status. Card details are processed by our merchant of record (Polar), we never see or store full card numbers.

Usage data: standard server logs, device and browser information, and product analytics used to keep the Service fast, secure, and reliable.

3. What we do NOT collect

No biometric identifiers: we do not create voiceprints and do not use voice recordings to identify individuals (relevant to laws like Illinois' Biometric Information Privacy Act). No precise geolocation tracking. No data purchased from data brokers. No third-party advertising trackers on our site.

4. How we use information

To provide the Service: answer calls, transcribe and summarize them, book appointments, send SMS confirmations and email notifications, populate the CRM, and page on-call staff for emergencies.

To operate the business: billing, support, abuse prevention, debugging, and service communications (for example billing, usage, and incident emails). Marketing emails include a working unsubscribe link, honored promptly, as required by CAN-SPAM.

To improve reliability: aggregated, de-identified statistics (answer rates, latency, booking rates) that do not identify you or your callers. We do not sell personal information, we do not share it for cross-context behavioral advertising or targeted ads, and we do not use your call content to train third-party foundation models.

5. AI processing and disclosure

Calls are handled live by an AI voice agent running on our telephony partner's platform, using your business profile (services, hours, service area) to respond. Sia identifies as an AI assistant, consistent with state bot-disclosure laws. Transcripts and summaries are generated automatically. The website chat assistant is powered by a large-language-model provider and is labeled as an assistant. AI output may contain errors; businesses should review bookings and messages before relying on them.

6. Service providers (sub-processors)

We use a small set of infrastructure providers to run VoxDesk: SignalWire (telephony, call media, AI voice runtime), Supabase (database and authentication), Fly.io and Vercel (application hosting), Upstash (job queueing), Polar (merchant of record for payments), Resend (transactional email), Cal.com (optional calendar booking), and a large-language-model provider for the website chat assistant. Each processes data only as needed to provide its function to us, under contractual confidentiality and security commitments. Data is primarily hosted in the United States.

7. Sharing

We share personal data only: with the sub-processors above; with the subscribing business whose line answered your call (callers' details flow to the business they called); to comply with law or valid legal process; to protect the rights, safety, and security of VoxDesk, our customers, or the public; and as part of a business transfer (Section 8). We do not sell or rent personal information, and we have not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising.

8. Business transfers

If VoxDesk or substantially all of its assets are acquired, merged, reorganized, or sold, in whole or in part, account data and Customer Data may be transferred to the successor as part of that transaction, subject to protections no less restrictive than this policy. We or the successor will notify account owners of a change of operator, and this policy continues to apply until updated with notice.

9. Retention

Account and CRM data: for the life of the account and up to 30 days after termination for export, then deleted in the ordinary course. Call recordings, transcripts, and summaries: retained per the account's retention window (default 12 months, configurable) and deleted on schedule by an automated retention job. Billing records: retained as required for tax and accounting. Backups and logs expire on rolling windows. We keep personal data no longer than reasonably necessary for the disclosed purposes, the data-minimization standard now required by the strictest state laws (for example Maryland's).

10. Security and breach notice

Encryption in transit (TLS) and at rest at our hosting providers; tenant isolation with row-level security in the database; scoped, signed webhooks; secrets kept in managed stores, never in the codebase; least-privilege access; continuous health monitoring. No system is perfectly secure, if we learn of a breach of security affecting your unencrypted personal data, we will notify affected account owners and, where required, regulators, without unreasonable delay and within the timelines state breach-notification laws require.

11. Your privacy rights (all 50 states)

As of 2026, twenty U.S. states have comprehensive privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, New Jersey, New Hampshire, Nebraska, Iowa, Minnesota, Tennessee, Maryland, and, effective 2026, Indiana, Kentucky, and Rhode Island. Rather than gate rights by residency, we extend the core rights to every user: access/know, correction, deletion, portability (export), and no discrimination for exercising rights.

Opt-out rights: we do not sell personal information or use it for targeted advertising, so there is nothing to opt out of, and we treat browsers that send the Global Privacy Control (GPC) signal accordingly.

How to exercise rights: from the dashboard (export and delete) or by emailing support@voxdesk.online. We verify requests, respond within 45 days (extendable once where the law allows), and authorized agents may act with proof of authorization. If we decline a request, you may appeal by replying to our decision; we answer appeals within the statutory window, and you may contact your state Attorney General if unsatisfied.

12. If you called a business that uses VoxDesk

That business is the controller of your call data, recordings, transcript, and the details you shared. Direct access or deletion requests to the business you called, or email support@voxdesk.online and we will pass your request to the business and assist it in honoring your rights. To avoid recording, tell the receptionist or hang up and contact the business another way. To stop text messages, reply STOP (or any reasonable refusal), revocations are honored within ten business days as FCC rules require.

13. Cookies

We use strictly necessary cookies only, sign-in sessions and security. No third-party advertising cookies, no cross-site trackers, no sale or sharing of cookie data. Because we do not track for advertising, no cookie-consent choices are needed, and GPC signals require no additional action, but we honor them by design.

14. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (COPPA) or minors under 18. If you believe a child provided personal data, email support@voxdesk.online and we will delete it.

15. United States hosting

The Service is operated from and hosted in the United States and is intended for U.S. businesses. If you access it from elsewhere, you understand your data is processed in the U.S. under this policy.

16. Changes and contact

We will post material changes to this policy here and notify account owners by email before they take effect. Questions or requests: use the contact form at voxdesk.online/contact or email support@voxdesk.online.