Legal
Privacy Policy
Effective date: April 5, 2025
1. Who We Are
Voxie ("we", "us", "our") operates a multi-tenant voice AI SaaS platform that lets business owners create and deploy AI voice agents for their customers. This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it.
For privacy enquiries, contact us at privacy@agenthub.ai.
2. Who This Policy Applies To
This policy applies to two categories of people:
- Business Users — individuals who create an Voxie account to build and manage AI voice agents.
- Callers (anonymous end users) — people who interact with an agent via a public shareable link. No account is required.
3. Data We Collect
3a. Business Users
| Data | Purpose | Legal Basis |
|---|---|---|
| Name, email address | Account creation & authentication | Contract |
| Hashed password | Credential-based login | Contract |
| OAuth identity (Google/GitHub) | Social sign-in | Contract |
| Business name, industry | Configure your AI agent | Contract |
| Knowledge base content | Train your agent with business info | Contract |
| Session cookies | Maintain your login state | Legitimate interest |
| IP address | Rate limiting & abuse prevention | Legitimate interest |
3b. Callers (Anonymous End Users)
| Data | Purpose | Legal Basis |
|---|---|---|
| Voice audio (real-time only) | Streamed to Gemini Live API; not stored on our servers | Legitimate interest |
| Conversation transcript | Stored per session for the business owner's records | Legitimate interest |
| Name, phone, email (if voluntarily provided) | Caller context passed to the agent | Consent (voluntary) |
| Session duration, rating, feedback | Quality analysis & dashboard metrics | Legitimate interest |
| IP address | Rate limiting & abuse prevention | Legitimate interest |
4. AI Processing
Voxie uses third-party AI services to power its features. When data is sent to these services it is subject to their respective privacy policies:
- Google Gemini Live API — processes real-time voice audio. Audio is streamed and not retained by us after the call ends.
- Google text-embedding-004 — converts knowledge base text into vector embeddings for semantic search.
- Anthropic Claude API — analyses session transcripts post-call to generate summaries, sentiment, and action items.
We do not sell data to AI providers or permit them to train their models on your data beyond what is specified in their API usage policies.
5. Data Sharing
We share personal data only with:
- Infrastructure providers — Neon (database), Upstash (rate limiting), Vercel (hosting).
- AI service providers — Google and Anthropic, for the purposes described in Section 4.
- Authentication providers — Google and GitHub, only during the OAuth sign-in flow.
- Resend — for transactional emails (welcome, password reset). Recipient email and name only.
- LangSmith (optional) — AI observability tracing.
We do not sell, rent, or trade personal data to any third party for marketing purposes.
6. Data Retention
- Business User accounts — retained until the account is deleted. Deletion removes profile, business data, knowledge base, and sessions within 30 days.
- Session transcripts & analysis — retained as long as your account is active.
- Password reset tokens — expire after 1 hour and are deleted on use.
- Caller data (anonymous) — retained as part of the session record, controlled by the business owner.
7. Your Rights (GDPR & CCPA)
Depending on your location, you may have the following rights:
Access
Request a copy of your personal data
Correction
Correct inaccurate data we hold about you
Deletion
Request erasure of your personal data
Portability
Receive your data in a machine-readable format
Restriction
Restrict how we process your data
Objection
Object to processing based on legitimate interest
Opt-out (CCPA)
California residents may opt out of data sales (we do not sell)
Withdraw consent
Where processing is consent-based, withdraw at any time
To exercise any of these rights, email privacy@agenthub.ai. We will respond within 30 days.
8. Cookies
We use cookies for authentication and functional preferences. We do not use tracking or advertising cookies. See our Cookie Policy for full details.
9. Security
We implement industry-standard security measures including:
- Passwords hashed with bcrypt (cost factor 12)
- All data transmitted over TLS/HTTPS
- JWT-based session tokens, never stored in plaintext
- Rate limiting on authentication endpoints
- Database hosted on Neon with encryption at rest
No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it via our contact page.
10. Children's Privacy
Voxie is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. International Transfers
Your data may be processed in countries outside your own, including the United States. We rely on standard contractual clauses and other safeguards to ensure adequate protection for such transfers.
12. Changes to This Policy
We may update this policy from time to time. We will notify Business Users of material changes by email or a prominent dashboard notice. The effective date at the top of this page will always reflect the latest revision.