Privacy Policy

We run an AI phone agent for businesses. To do that we process the calls our customers receive — the recording, a transcript, and what the caller wanted.

We do not sell personal information.We do not share it for cross-context behavioral advertising. We do not use our customers’ call data to train foundation models.

Read this part before the rest; it decides who you should contact.

If you are our customer — a business that pays for VoxPilot — we are the controller of your account data. We decide why we hold your name, your email, and your billing record, and this policy governs it.

If you called a business that uses VoxPilot — we are only a service provider (a processor, in other wording). The business you called decides what is collected and why. We process it on their instructions and for no purpose of our own.

That means a request to see or delete what was said on your call goes to the business you called, not to us. If you send it to us anyway, we will pass it to them and tell you we have done so.

Account information. Business name, contact person, email address, telephone number, industry, and the CRM or scheduling system you name at sign-up.

Call content.Audio recordings, transcripts, summaries, and the fields the agent extracts — typically a caller’s name, a callback number, and what they wanted. Callers decide what they say; anything they mention ends up in the transcript.

Call metadata. Numbers involved, time, duration, outcome, and minutes consumed.

Configuration you give the agent. Opening hours, services, prices, and answers to common questions.

Payment information. Handled by Stripe. We never see or store your card number. We keep a customer reference, the plan, and the invoice history.

Technical data. IP address, browser, and pages visited in the dashboard, for security and for keeping the service running.

Calendar data, only if you connect one: free and busy times, and the appointments the agent creates. We do not read the content of unrelated events.

Some of our customers are medical, dental, veterinary, or legal practices. A caller may mention a health condition or a legal matter, and it will appear in the transcript.

We do not ask for sensitive information, we do not use it to infer anything about anyone, and we do not use it for any purpose beyond delivering the call to the business that received it.

VoxPilot is not currently offered as a HIPAA-compliant service and we do not sign Business Associate Agreements. A covered entity under HIPAA should not use VoxPilot for protected health information until we say otherwise in writing.

• answering, transcribing, and summarizing calls, and booking appointments;
• giving our customer access to their own calls in the dashboard;
• sending the summary emails and alerts our customer configures;
• billing, including counting minutes;
• support, security, fraud prevention, and keeping the service available;
• meeting our legal obligations.

We may produce aggregated, de-identified statistics that cannot be linked to any customer or caller, and use them to operate and improve the service.

Under the California Consumer Privacy Act and the comparable laws of other states, we have not sold personal information and have not shared it for cross-context behavioral advertising in the preceding twelve months, and we do not do so now. We do not offer financial incentives in exchange for personal information.

We use the following providers to run the service. Each receives only what it needs, and each is bound by contract to use it only to provide its service to us:

• Telnyx — telephony, call handling, speech recognition and synthesis
• Twilio — telephony and text messaging, where enabled
• OpenAI — extracting structured fields from transcripts and reading a website during setup
• ElevenLabs — voice synthesis, where a cloned voice is used
• Supabase — database and file storage
• Vercel — application hosting
• Stripe — payment processing
• Resend — transactional email
• Google — calendar access, only where the customer connects it

We may also disclose information where the law requires it, to enforce our agreements, or in connection with a merger or sale of the business — in which case we will say so before the information is transferred.

The service is operated from the United States, and our providers may process data in the United States and elsewhere. If you are contacting us from outside the United States, your information will be transferred to and processed in the United States, where privacy law differs from that of your own country.

Call recordings, transcripts, and summaries:for as long as the customer’s account is active, and for 30 days after it closes, unless the customer sets a shorter period or deletes them sooner in the dashboard.

Account and configuration data: for the life of the account, and for 30 days afterwards.

Invoices and payment records: for as long as tax and accounting law requires.

Security logs: up to 12 months.

Data is encrypted in transit and at rest. Access to production data is limited to the people who need it to operate the service and is logged. Every customer’s data is separated by tenant, and access to the dashboard requires authentication.

No system is perfectly secure. If a breach affects your information, we will notify you as required by the law that applies to you.

Depending on where you live — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and a growing number of other states grant these — you may have the right to:

• know what personal information we hold about you and why;
• receive a copy of it in a portable form;
• correct information that is wrong;
• have it deleted;
• opt out of sale, sharing, or targeted advertising — none of which we do;
• not be discriminated against for exercising any of these rights. We will not degrade or price the service differently because you did.

Write to info@voxpilot.de with the subject line Privacy Request. We will respond within 45 days and may extend once by a further 45 days where the request is complex, telling you why. We will verify your identity before acting; for an account holder that normally means replying from the email address on the account.

If we refuse, you may appeal by replying to our decision with the word Appeal. A different person will review it and answer within 45 days. If the appeal is denied, you may complain to your state attorney general.

An authorized agent may act for you with written permission that we can verify.

Your call was recorded and transcribed on behalf of that business. They decide what happens with it. Send your request to see, correct, or delete it to them — they hold the relationship with you and they have the context to answer.

We will help them do so, and we will act on their instruction to delete. If you cannot identify the business, contact us and we will try to route your request.

VoxPilot is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

The agent decides in the moment how to answer, what to note, and — where the customer has configured it — whether a call is urgent enough to transfer. It does not make decisions that produce legal effects for a caller. A human at the customer’s business reviews what the agent recorded.

Browsers send a “Do Not Track” signal that has no agreed meaning. We do not respond to it. We also do not track you across other websites, so there is nothing for it to switch off.

We will post any change here and update the version below. For a material change affecting our customers, we will also give notice by email at least 30 days in advance.

MINDSOUL INTERNATIONAL LLC, trading as VoxPilot
2880 W Oakland Park Blvd, Suite 225C, Oakland Park, FL 33311, United States
info@voxpilot.de