Privacy Policy

Vosy LLC ("Vosy," "we," "us," or "our") operates the Vosy AI platform (the "Service"), an AI-powered voice agent platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Phone number
• Organization name
• Password (stored as a cryptographic hash — we never store your plaintext password)

1.2 Usage Data

We automatically collect information about how you interact with the Service:

• IP address and approximate location (city/region level)
• Browser type, operating system, and device type
• Pages visited, features used, and session duration
• API calls and usage metrics

1.3 Voice Call Data

When you use the Service to make or receive voice calls, we process:

• Phone numbers (caller and recipient)
• Call duration and timestamps
• Call recordings (if enabled by you)
• Real-time voice transcriptions
• AI-generated conversation data and extracted information
• Call metadata (hangup cause, direction, provider details)

1.4 Payment Information

If you subscribe to a paid plan, payment processing is handled by our third-party payment processor. We do not store your full credit card number. We may store your billing name, billing address, and the last four digits of your card for reference.

1.5 Information You Provide Through Agents

You may configure AI voice agents with custom prompts, knowledge bases, and extraction schemas. The data collected during calls depends on your agent configuration. You are the data controller for information collected from call recipients through your agents.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — process voice calls, run AI agents, generate transcriptions, and deliver analytics
• Maintain your account — authenticate you, manage your subscription, and communicate with you about your account
• Improve the Service — analyze usage patterns, diagnose technical issues, and develop new features
• Ensure security — detect fraud, prevent abuse, enforce rate limits, and protect against unauthorized access
• Comply with law — respond to legal requests and comply with applicable regulations

We do not use your voice call data or transcriptions to train AI models. Your call data is processed solely to deliver the service you requested.

3. Third-Party Service Providers

We use third-party services to operate the platform. These providers process data on our behalf and are contractually obligated to protect your information:

Provider	Purpose	Data Processed
Amazon Web Services (AWS)	Cloud infrastructure, storage, encryption	All platform data (encrypted at rest)
Telnyx	Telephony — making and receiving calls	Phone numbers, call audio
Deepgram	Speech-to-text transcription	Call audio streams (real-time)
Cartesia	Text-to-speech synthesis	AI response text
OpenAI / Anthropic / Google	AI language models for conversation	Transcribed text, agent prompts

For the most current list of sub-processors, contact contact@vosy.ai. We will notify customers of material changes to our sub-processor list with 30 days' notice.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted via HTTPS/TLS encryption
• Sensitive credentials encrypted using AWS KMS (Key Management Service)
• Passwords hashed using Argon2id with per-user salts
• PII (phone numbers, emails) encrypted at rest with HMAC blind indexes for search
• CSRF protection, rate limiting, and session fingerprinting
• Audit logging of all administrative actions

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users without unreasonable delay and no later than 72 hours after becoming aware of the breach (as required by GDPR for applicable users)
• Provide details about the nature of the breach, the types of data affected, the steps we have taken to address it, and recommended actions you should take
• Notify relevant supervisory authorities where legally required

If you believe your account or data has been compromised, contact us immediately at contact@vosy.ai.

6. Data Retention

• Account data: Retained while your account is active and for 30 days after deletion request
• Call recordings: Retained according to your organization's settings. You may delete recordings at any time
• Transcriptions and analytics: Retained while your account is active
• Usage logs: Retained for up to 12 months for security and operational purposes
• Audit logs: Retained for up to 24 months for compliance purposes

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Opt-out: Opt out of certain data processing activities

To exercise any of these rights, contact us at contact@vosy.ai. We will respond within 45 days.

8. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

Categories of personal information collected (in the preceding 12 months):

• Identifiers (name, email, phone number, IP address)
• Commercial information (subscription plan, usage history)
• Internet activity (pages visited, feature usage)
• Audio information (call recordings, if enabled)
• Professional information (organization name)

We do not sell personal information. We do not have actual knowledge that we sell personal information of consumers under 16 years of age.

To submit a CCPA request, email contact@vosy.ai with the subject "CCPA Request." We will verify your identity before processing your request.

9. General Data Protection Regulation (GDPR)

If you are located in the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK), you have additional rights under the GDPR:

Your GDPR Rights

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Object: Object to processing based on legitimate interest, including profiling
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at contact@vosy.ai. We will respond within 30 days.

We do not currently have a designated Data Protection Officer (DPO). For all GDPR-related inquiries, contact contact@vosy.ai.

10. International Data Transfers

Your personal data is processed and stored in the United States on Amazon Web Services (AWS) infrastructure. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the US.

For users in the EU/EEA/UK, international data transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.

Our third-party service providers may also process data in jurisdictions outside your country of residence. Each provider maintains their own data processing agreements and security certifications. See Section 3 for details on our providers.

By using the Service, you acknowledge and consent to the transfer of your data to the United States and other jurisdictions as described in this policy.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at contact@vosy.ai.

12. Cookies and Tracking

We use essential cookies to operate the Service (session management, CSRF protection, authentication). We do not use third-party advertising or analytics cookies. We do not track you across other websites.

Do Not Track: Our Service does not respond to Do Not Track (DNT) browser signals. We do not track users across third-party websites or services.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or sending you an email. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Vosy LLC
Email: contact@vosy.ai
Nevada, United States