Privacy Policy

1. Scope & Role Definition

This Privacy Policy explains how VoxFlow, operated by Jeevesh Singale, a sole trader established in England & Wales ("Voxflow", "we", "us") processes information when operating our conversational voice AI platform. Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018:

• When business customers use Voxflow to handle inbound telephone calls from their suppliers, carriers, or customers, the business customer acts as Data Controller, and Voxflow acts as Data Processor. We process call audio and transcripts solely on the Controller's documented instructions.
• When individuals visit our website (voxflow.cc) or open an account, Voxflow acts as Data Controller for account management, billing, and authentication data.

2. Information We Process

Depending on whether you are a platform customer or a telephone caller interacting with an AI agent:

• Account & Workspace Data: Name, work email address, hashed passwords, workspace settings, role assignments (Owner, Operator, Viewer), and Stripe customer IDs.
• Inbound Telephony Data: Caller phone number (E.164 ANI), destination number (DID), call start/end timestamps, call duration, hangup reason, and caller-provided reference codes (e.g. PO numbers, container IDs).
• Call Audio & Transcripts: Audio chunks processed in flight by speech recognition models; redacted text transcripts generated for order status verification; caller verification status.
• Call Recordings & Consent Evidence: Where the tenant enables recording, audio is recorded via Amazon Connect (recordings land in the Connect instance S3 bucket) together with IVR consent evidence stored against the call record.

3. Lawful Bases for Processing

We process personal data on the following bases: contract (providing the telephony service to the Customer); legitimate interests (service operation, security, and billing); legal obligation (tax and invoicing records); and consent (call recording, captured via IVR disclosure before recording begins). Controllers relying on Voxflow remain responsible for establishing their own lawful basis for directing caller data to the service.

4. Data Retention & Automated Purge Policy

Voxflow enforces automated data lifecycle policies with per-tenant configurable windows. Defaults: call transcripts 30 days, call records 90 days, transient audio chunks in S3 24 hours, and call recordings per tenant setting (recordings are off by default and retained only where the tenant enables them). Expired transcripts and recording pointers are permanently erased by scheduled automated purge jobs, and caller PII is scrubbed in line with customer-configured retention limits.

5. Data Subject Rights (DSAR & Right to Erasure)

In accordance with UK GDPR Chapter 3, individuals have the right to request:

• Access: Export of all call records and transcripts associated with a given telephone number.
• Erasure: Cryptographic and physical deletion of caller records, audio files, and transcripts.
• Rectification: Correction of erroneous caller identity or order associations.

Where Voxflow is a Processor, we forward DSAR requests to the relevant Customer Controller within 48 hours. Where Voxflow is Controller (account data), we respond within 30 days.

6. Sub-Processors & Data Hosting

Voxflow runs on the following infrastructure — and nothing else. Project data lives in PostgreSQL (AWS RDS in eu-west-2 as primary database); user authentication identities live in Supabase Auth. The API runs on AWS EC2 behind Caddy with automatic TLS (Oracle Cloud VM as standby) with production secrets in AWS Secrets Manager (KMS); the dashboard is served from the Vercel edge network at voxflow.cc behind Cloudflare DNS with Turnstile bot protection. Conversational inference is transient: Groq hosted LLM and Whisper STT process call content in flight and do not retain it (processing regions per Groq's policy, which may include the US — see /subprocessors). Telephony ingress is Amazon Connect eu-west-2 with Amazon Lex speech capture; one legacy +44 number (+44 20 4640 4552: legacy, migration in progress) still routes via us-west-2 pending migration; call recordings land in S3. Billing is Stripe; transactional email is Resend; error monitoring is PII-scrubbed Sentry; product analytics is PostHog EU (allow-listed non-identifying events, no IP capture); support chat is Crisp. Google Sheets acts as an optional per-tenant call-log mirror only, never the source of truth. We hold no ISO 27001 or SOC 2 certification — no such certification is claimed. Full processor list with data and locations: /subprocessors.

7. Call Recording Disclosure

Every call carries an automated recording disclosure: callers are told the call may be recorded before any recording starts, and their IVR consent response is stored as consent evidence against the call record. If a caller does not consent, audio recording stays off for that call.

8. Data Protection Officer (DPO)

To exercise data subject rights or submit privacy queries, email our Data Protection Officer at privacy@voxflow.cc.

9. Cookies & Site Tracking

The marketing site and dashboard use strictly-necessary cookies for authentication session state (keeping you signed in). We run no advertising trackers, no cross-site analytics, and no third-party marketing pixels. Non-essential cookies and client telemetry (first-party product analytics via PostHog EU and in-app support via Crisp) are off by default and strictly blocked until you grant explicit consent via our cookie consent banner. If you decline, neither PostHog nor Crisp is loaded, and no non-essential cookies or identifiers are set.