Privacy Policy
Last updated: 27 September 2026
This Privacy Policy explains how VoxAgent ("we", "us", "our"), operator of voxagent.ie, collects, uses, and protects personal data. We are based in Ireland and comply with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Contact: for any privacy question or to exercise your rights, email privacy@voxagent.ie.
1. Controller vs processor
For data about our own customers (businesses who sign up for VoxAgent), we are the data controller. For data about our customers' end-callers and clients(people who phone or chat with a customer's AI agent, or who make a booking), the customer is the data controller and VoxAgent acts as a data processor on their behalf, processing that data only to provide the service.
2. Data we collect
Account data (customers)
- Name, email address, and password (stored hashed via our authentication provider).
- Billing details processed by Stripe (we do not store full card numbers).
- Agent configuration, knowledge base content, and any documents or website content you provide for training.
Service data (end-callers & clients)
- Phone numbers, call metadata (time, duration), and — where enabled — call transcripts and summaries.
- After a call ends, the transcript is read by an AI language model which writes a short summary for the business owner and records an impression of how the caller sounded (positive, neutral or negative). No recording of the call is made or kept — only the written transcript, the summary and that impression.
- Chat messages sent to the website widget.
- Booking details: name, phone number, email, and appointment information.
- Payment details for deposits are processed directly by Stripe on the customer's connected account.
3. How we use data
- To provide, operate, and improve the VoxAgent service.
- To answer calls and chats, generate responses, and manage bookings.
- To send transactional emails (confirmations, reminders, receipts, account notices).
- To take payments and prevent fraud.
- To provide support and comply with legal obligations.
4. Legal bases (GDPR Article 6)
- Contract — to provide the service you sign up for.
- Legitimate interests — to secure, operate, and improve the platform.
- Legal obligation — for tax, accounting, and regulatory requirements.
- Consent — where required (e.g. certain communications). You may withdraw consent at any time.
5. Phone number provisioning
Where you request a phone number in an area we do not already hold numbers for, our telecoms provider requires proof of address for that area before the number can be issued. We ask you to upload a recent utility bill or bank statement solely for this purpose.
We do not store this document. It is held in memory only for as long as it takes to forward it to our telecoms provider, byphone (Clarity Telecom Limited), and is then discarded. We retain only the area code requested, the status of the request, and the dates it was submitted and verified.
Our lawful basis is Article 6(1)(b) — processing necessary to perform our contract with you, as we cannot provision your number without it. byphone acts as a recipient of this document and processes it under their own privacy terms.
6. Sub-processors
We use trusted third parties to run the service. Each processes data only as needed to provide their function:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, storage |
| GigaGPU | Server hosting in the United Kingdom, and our own speech synthesis — generating the voice the agent speaks with. This is now the only GPU we operate |
| OpenAI | Language model for agent responses, speech recognition, the real-time voice model that listens and speaks during a call, indexing your business information so the agent can answer from it, and — after a call ends — writing the call summary and noting how the caller sounded, from the transcript |
| byphone (Clarity Telecom Limited) | Telephony carrier; call routing and number provisioning, including proof-of-address documents forwarded for that purpose |
| Stripe | Payments and subscriptions |
| Resend | Transactional email |
| Optional calendar sync (only if the customer connects it) | |
| Microsoft | Optional Outlook calendar sync (only if the customer connects it) |
7. International transfers
Our servers are hosted in the United Kingdom, and some providers are based outside the EEA (for example, the United States). Where data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision — the United Kingdom is covered by an adequacy decision of the European Commission.
8. Data retention
We keep account and service data for as long as your account is active and as needed to provide the service. Call logs, transcripts, and bookings are retained per your settings and legal requirements. On account closure, data is deleted or anonymised within a reasonable period, except where we must retain it for legal reasons.
9. Your rights
Under GDPR you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. To exercise any right, email privacy@voxagent.ie. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).
If you are an end-caller or client of a business using VoxAgent, please direct requests to that business (the data controller); we will assist them in responding.
10. Cookies
We use only essential cookies required to keep you signed in and operate the dashboard. We do not use advertising or third-party tracking cookies.
11. Security
We use encryption in transit, row-level security, per-account isolation, and access controls to protect data. No system is perfectly secure, but we take reasonable measures to safeguard your information.
12. Changes
We may update this policy from time to time. Material changes will be notified via the dashboard or email. Continued use of the service after changes constitutes acceptance.