Privacy Notice

1. Who we are and when this notice applies

VoiceFleet("VoiceFleet", "we", or "us") operates the VoiceFleet business voice-assistant service from Ireland. Our public service address is Dublin, Ireland. You can contact us at [email protected].

This notice covers visitors to our websites, account holders and team members, people who communicate with us, callers who interact with a customer's VoiceFleet assistant, and business contacts shown in our public directory.

VoiceFleet is a controller for website, account, billing, security, support, marketing, and directory data. For call content, recordings, transcripts, booking details, and connected business systems, the VoiceFleet customer normally decides why and how the data is used and is the controller; VoiceFleet acts as its processor under our Data Processing Agreement. Contact the relevant business first if your request concerns a call you made to that business.

2. Personal data we process and where it comes from

• Account and business details, such as name, work email, organisation, role, settings, and authentication identifiers.
• Billing and subscription records. Stripe processes complete payment-card details; VoiceFleet receives transaction and limited card metadata.
• Technical and security data, including IP address, device/browser information, login and audit events, region, referral source, and service usage.
• Call data, including caller and called numbers, time, duration, recording, transcript, summary, messages, booking details, and customer-configured instructions.
• Support, demo, and sales communications, including microphone audio and transcripts when you choose to use a voice demo.
• Voice samples, generated voice identifiers, and proof of authority when voice cloning is used.
• Connected-service data and OAuth tokens for calendar, booking, CRM, and communication integrations you enable.
• Public business-directory information, such as business name, public contact details, category, website, and location.

We receive data directly from account users and callers, automatically from devices and the service, from a customer that configures VoiceFleet, from connected providers, and from public business websites or directories. We do not intentionally require callers to provide sensitive data. Customers using VoiceFleet for regulated or special-category data must first satisfy the requirements in the Terms and DPA.

3. Why we use data and our legal bases

• Provide the service and manage accounts: performance of our contract and steps requested before entering it.
• Process calls, bookings, and integrations for customers: the customer's documented instructions under the DPA.
• Billing, accounting, and legal records: contract and legal obligations.
• Security, abuse prevention, troubleshooting, and service reliability: our legitimate interests in protecting and operating VoiceFleet.
• Product improvement and anonymous aggregate measurement: our legitimate interests, with data minimisation and opt-out controls.
• Requested communications and support: contract, legitimate interests, or consent depending on the message.
• Optional marketing: consent where required; you may unsubscribe at any time.
• Public business directory: legitimate interests in providing accurate business discovery, balanced against the rights of listed contacts.
• Compliance, claims, and authorities: legal obligations and legitimate interests in establishing or defending legal claims.

Where consent is the basis, you may withdraw it without affecting earlier processing. If providing data is required for an account or requested feature and you do not provide it, we may be unable to supply that feature.

4. Calls, AI, recording, and transcription

VoiceFleet adds a spoken notice that the caller is interacting with an AI assistant and that the call may be recorded and transcribed. A customer may need to provide further information or obtain consent depending on its purpose and applicable law. The customer is responsible for choosing and documenting its lawful basis, publishing its own caller notice, and configuring the service lawfully. If consent is required, recording must not continue without valid consent.

5. Google user data

If you connect Google Calendar, we access calendar account metadata, calendar identifiers and names, time zones, free/busy availability, relevant event information, appointment details created or updated through VoiceFleet, and OAuth access or refresh tokens needed to keep the integration connected.

We use this data only to provide the calendar features you request: choosing a calendar, checking availability, creating, updating or cancelling appointments, sending invitations or updates, and maintaining the connection. Data may be visible to authorised VoiceFleet account users, Google Calendar, appointment attendees, and subprocessors strictly as needed to provide those functions or comply with law.

We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. OAuth tokens are not shared with voice or language-model providers. Information sent to AI services is limited to what is needed for the scheduling request. VoiceFleet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Google Calendar in VoiceFleet or your Google Account. We then delete stored OAuth tokens promptly. Existing calendar events remain in the relevant calendars until their owners delete them.

6. Who receives data

We disclose data only as needed to:

• VoiceFleet personnel and authorised users of the relevant customer workspace.
• Infrastructure, database, authentication, telephony, speech-to-text, voice, AI, email, monitoring, payment, and support providers.
• Google, Microsoft, calendar, booking, CRM, and other integrations selected by the customer.
• Professional advisers, insurers, auditors, potential business successors, courts, regulators, or law enforcement where lawfully necessary.

The current core provider list and purposes appear in the DPA subprocessor schedule. We do not sell personal data.

7. International transfers

We offer regional configurations, but some providers or customer-selected integrations may process data outside the EEA. Where required, we use an adequacy decision, the European Commission's Standard Contractual Clauses, the UK addendum, or another lawful safeguard. Contact us for information about the safeguard relevant to your data.

8. Retention

• Call recordings: 30 days, after which the provider copy and VoiceFleet recording link are deleted.
• Call logs, transcripts, summaries, and bookings: while the customer account is active and normally for up to 30 days after account closure, unless the customer deletes them earlier or law requires longer.
• Account, support, and configuration data: while the account is active and normally for up to 30 days after closure.
• OAuth tokens: until the integration is disconnected, access is revoked, or the account is deleted.
• Voice samples and clones: until the user deletes the clone or the account closes, subject to provider deletion cycles.
• Invoices, payments, contracts, and acceptance evidence: up to six years after the relevant transaction or end of the relationship where needed for Irish tax, accounting, or legal claims.
• Security logs: normally up to 12 months unless needed to investigate an incident.
• Directory information: while it remains publicly available and relevant, subject to correction or objection.

Restricted backup copies may remain until overwritten under provider backup cycles. We isolate them from ordinary use and delete or anonymise data when no longer needed.

9. Cookies and analytics

VoiceFleet uses essential browser storage for authentication, security, preferences, and requested service functions. We do not load Google Analytics. We use a self-hosted Umami installation for cookieless, aggregate site measurement. It does not set analytics cookies or identify visitors across websites; search strings and URL fragments are excluded and browser Do Not Track is respected.

10. Security

We use measures appropriate to the service, including encrypted transport, provider encryption at rest, access controls, tenant separation, secrets management, monitoring, backups, and retention controls. No online system is completely secure. Customers must protect their credentials and configure access appropriately.

11. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data; object to processing based on legitimate interests or direct marketing; and withdraw consent. You may also complain to the Irish Data Protection Commission or your local supervisory authority. We do not use account or caller data to make solely automated decisions that produce legal or similarly significant effects.

Email [email protected]. We may verify your identity. For customer-controlled call data, we will normally refer the request to or assist the relevant customer.

12. Changes and contact

We will post material changes here and, where appropriate, notify account administrators. Questions can be sent to [email protected] or by post to Dublin, Ireland.