Privacy Policy

1. Controller and contact

The controller of personal data is AI AGENT HUB PROSTA SPÓŁKA AKCYJNA, registered office in Katowice, ul. Jana III Sobieskiego 11/E6, 40-082 Katowice, Poland, entered in the register of entrepreneurs of the Polish National Court Register (KRS) under number 0001168165, tax ID (NIP) 6343054493, REGON 541503506.

For any matter concerning personal data, including exercising the rights described in section 11, you can contact us by e-mail at support@aiagenthub.pl (please use the subject line “Data protection — Voxiora”) or in writing at our registered address.

The Controller has not appointed a data protection officer because it is not required to do so (Article 37 GDPR). Data protection matters are handled by a person designated by the management board, reachable at the e-mail address above.

2. When we are a controller and when we are a processor

We are the controller of the data of website visitors, people who use the contact form, customers and their team members who use the dashboard, participants of “Call me” demo calls and members of the partner program.

For the data of people who call our customers (recordings, transcripts, phone numbers, information given during the call, bookings and messages) we act as a processor, only on the customer’s instructions and under the data processing agreement. The controller of that data is the business the person is calling (see section 8).

If a customer turns on e-mails to callers, we send e-mails on the customer’s behalf to callers who asked for them and confirmed their address during the call (for example a call summary, a callback or appointment confirmation, or information the caller requested) — from the customer’s own mailbox or e-mail account, or from our sending address with the customer’s name. The customer decides on the content and templates and is the controller of this data; we act as a processor. These are service messages, not marketing; every e-mail contains a link to stop receiving e-mails from that business, and we keep opt-outs only as a one-way hash of the address.

We are also the controller of the data of people who chat or talk with Voxiora’s own AI assistant on voxiora.com and in the customer dashboard — it is our own assistant, not the assistant of one of our customers.

3. What data we process

• Account data: name, e-mail address, company name, team role and account settings; when you sign in with Google, basic Google profile data (name and e-mail address).
• Billing data: selected plan, payment and invoice history, company details for invoices (name, address, tax ID). Payment card data is processed only by Stripe; we have no access to full card numbers.
• Content provided by the customer to configure the assistant: business knowledge, instructions, price lists, greetings and the content of the public website indicated when creating the assistant.
• Contact form data: name, e-mail address, company, topic and message.
• Technical data: IP address, browser and device type, time and addresses of requests, in server and security logs; activity performed in the account, in the dashboard audit log.
• E-mail communication: your e-mail preferences; records of marketing consents and withdrawals (date and time, IP address, browser, the exact wording of the consent with its version and language, and where it was given); the history of e-mails we have sent you; for marketing e-mails only, whether they were opened and which links were clicked.
• Satisfaction survey: your rating of Voxiora (1 to 5 stars), your comment and request to be contacted if you add them, the date of your answer, the billing period it refers to, the language, the link to your account and to the survey e-mail, and on the survey page a one-way hash of your IP address for rate limits and abuse protection.
• Statistics (only with consent): information about website use collected by Google Analytics 4 (see section 10).
• Partner program: the partner code from the referral link and, when the link is clicked, a one-way hash of the IP address, never the full address.
• “Call me” demo call: phone number (in readable form only while the call is set up and the SMS is sent), its one-way hash and masked form (e.g. +48 22 ••• 958), a hash of the IP address, a recording of the call including the voices of both parties, its transcript and technical parameters.
• Conversations with the assistant in the browser or in the widget on a customer’s website: microphone audio transmitted during the conversation, browser language, the address of the page the conversation was started from and a hash of the IP address (for rate limits and abuse prevention).
• Conversations with Voxiora’s own AI assistant on the website and in the dashboard (chat or voice): the content of the conversation (typed text, or microphone audio processed in real time and its transcript; these conversations are not recorded), the language, the address and title of the page you are on, a hash of your IP address (for limits and abuse prevention) and, if you are signed in to the dashboard, the identifier of your user account and the basic information about the company account that the assistant needs to help you (e.g. company name, plan and trial status, setup step, assigned phone number, assistant status, connected integrations and the number of calls in the last 7 days). If you ask to be contacted: your name, e-mail address and question; if the assistant creates a support ticket for you: its subject and description.
• Phone number verification (only if you choose a number from a country where the law requires it): the details of the number’s user that the carrier requires for that country — for example the company name, registration and tax numbers, the contact person’s name, phone number and e-mail address, the address and, in some countries, the place and date of birth and identity document details — and copies of the documents you upload (identity document, company register extract, proof of address).
• Data of people calling our customers (as a processor): phone number, voice recording (if the customer has enabled recording), transcript, call summary and score, information given during the call (e.g. name, appointment time, description of the matter) and the content of SMS and e-mails sent.

4. Purposes and legal bases

• Concluding and performing the Voxiora service agreement, maintaining the account, technical support and service communication: Article 6(1)(b) GDPR; for people acting on behalf of a customer: Article 6(1)(f) GDPR (legitimate interest in performing the agreement with the customer).
• Billing, issuing and storing invoices and accounting records: Article 6(1)(c) GDPR in conjunction with tax law and the Polish Accounting Act.
• Replying to contact form messages or e-mails: Article 6(1)(f) GDPR, and where the message concerns concluding an agreement, Article 6(1)(b) GDPR.
• The demo call, sending one summary SMS and recording and automatically analysing the call to improve the assistant: Article 6(1)(a) GDPR (consent given in the form); storing the number hash to limit abuse: Article 6(1)(f) GDPR.
• Website statistics (Google Analytics 4) and storing the partner attribution cookie: Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law (consent to the relevant cookie category given in the banner).
• Settling the partner program: Article 6(1)(b) GDPR (agreement with the partner) and Article 6(1)(f) GDPR.
• Ensuring the security of the website and the service, preventing abuse, keeping event logs: Article 6(1)(f) GDPR.
• Service e-mails about setting up and using your account (for example a reminder about an unfinished setup step, the end of the trial, tips after your first call): Article 6(1)(b) GDPR. You can turn setup reminders off in the dashboard settings or with the link in each such e-mail; messages necessary to perform the agreement (for example payments, invoices, your phone number) are still sent.

Service e-mails (for example reminders when you have not been active in the dashboard — at most 3 — and a weekly summary of your assistant's work) may be drafted by a language model (Anthropic, see section 6) from your account data: first name, company name, industry, setup step, trial, phone number and call counts. Fixed rules decide whether and when an e-mail is sent; the model only chooses the wording, makes no decisions about you and builds no profile. We never give it recordings or the content of calls. E-mails are signed by the Voxiora team. You can turn reminders and summaries off in the dashboard settings or with the link in the e-mail.

• Satisfaction survey for customers with a paid plan — a short service e-mail roughly halfway through a paid billing period, at most once every 3 months, without any advertising — and handling of the answers: passing your rating and comment to our team and, in the case of a low rating, a request to be contacted or a described problem, automatically opening a support request on your behalf so that we can help: Article 6(1)(b) GDPR (performance of the contract) and, for persons acting on behalf of a customer, Article 6(1)(f) GDPR (our legitimate interest in checking the quality of the service and helping customers). Taking part is voluntary. You can switch surveys off in the dashboard settings or with the link in every such e-mail. The link in the e-mail contains only a random identifier and is valid for 30 days.
• Marketing e-mails (practical tips, product news, offers, invitations to come back): only with your prior consent, confirmed by clicking the link in a confirmation e-mail (double opt-in): Article 6(1)(a) GDPR, Article 398 of the Polish Electronic Communications Law and Article 13 of Directive 2002/58/EC. Giving consent is voluntary and is not required to create an account. You can withdraw it at any time, as easily as you gave it: with one click in every marketing e-mail, in the dashboard settings or by writing to us. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
• Measuring whether marketing e-mails are opened (with an invisible image) and which links in them are clicked, and linking the purchase of a plan or the connection of a phone number within 7 days to the e-mail sent before it: on the basis of the consent described above (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). We do not measure service e-mails in this way.
• Keeping records of consents and withdrawals (to demonstrate consent, Article 7(1) GDPR) and a list of addresses that have unsubscribed or whose e-mails could not be delivered, so that we do not write to them again: Article 6(1)(c) and (f) GDPR.
• Answering questions asked to Voxiora’s AI assistant on the website: Article 6(1)(f) GDPR (our legitimate interest in informing about the service and handling enquiries), and where the question concerns concluding an agreement, Article 6(1)(b) GDPR; help with setup and support tickets for customers signed in to the dashboard: Article 6(1)(b) GDPR (performance of the agreement), and for people acting on behalf of a customer, Article 6(1)(f) GDPR; an automatic summary and quality assessment of these conversations and noting unanswered questions to improve the assistant’s answers: Article 6(1)(f) GDPR. Passing a contact request to our team and replying to it: Article 6(1)(a) GDPR (consent given in the conversation, covering only that request; you can withdraw it at any time by writing to support@aiagenthub.pl).
• Verifying the user of a phone number with the carrier before the number is activated (registration of the number’s user required by telecom law in the number’s country): Article 6(1)(b) GDPR (performance of the agreement — providing the number you ordered) and Article 6(1)(c) GDPR (obligations of electronic communications law concerning the identification of number users). Providing these details is voluntary, but without them the carrier cannot assign a number from that country.
• Establishing, exercising or defending legal claims: Article 6(1)(f) GDPR.

Providing data is voluntary but necessary to create an account, conclude an agreement, receive a reply or receive a demo call. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

5. Quality analysis and artificial intelligence

Recordings and transcripts of demo calls are analysed automatically, on our own servers and using the Google Gemini (via OpenRouter) and Anthropic Claude language models, to assess audio quality and the course of the conversation and to formulate general rules that improve the assistant. These rules do not contain personal data (among other things, we filter out numbers, e-mail addresses and web addresses). Recordings are deleted after 30 days.

Conversations handled by our customers’ assistants are not used for the quality analysis described above. Their summaries and scores are generated automatically only for the customer concerned, and insights from a customer’s calls (if the customer has enabled assistant learning) are applied only to that customer’s assistant.

We do not train artificial intelligence models on call data, and our language model providers process it only to generate responses, in accordance with their agreements.

Voxiora’s own AI assistant on the website and in the dashboard answers using the language models of our providers (see section 6), based on information about Voxiora and, for signed-in customers, the current state of their account. At the start of every conversation it says that it is an AI. It can make mistakes: in billing and contractual matters our documents and our team are authoritative. It cannot change anything in your account by itself.

6. Recipients of data

We entrust data to service providers who process it on our behalf under data processing agreements, for hosting and database (Supabase, Vercel), voice transport (LiveKit), telephony and SMS (Telnyx, with SMSAPI and Twilio as backups), speech recognition (Soniox), language models (OpenRouter and Google, Anthropic), e-mail delivery (Twilio SendGrid with the authenticated voxiora.com domain; as backups, our own mail server of the voxiora.com domain, aderlo.cloud hosting, and Resend, if enabled) and statistics (Google). The full list, with the purpose and location of processing, is available on the subprocessors page.

For phone number verification, we pass the details and documents described in section 3 to Telnyx, the carrier that provides the number. Telnyx uses them to register the number’s user as required by telecom law and, where the law so requires, passes them to the local network operator or regulator. We do not use these documents for any other purpose.

Stripe processes payment data as an independent controller under its own privacy policy. Integrations connected by the customer (e.g. Google Calendar, Microsoft Outlook, HubSpot, Pipedrive) receive data on the customer’s instructions.

Data may also be disclosed to providers of accounting and legal services and to public authorities where required by law. We do not sell personal data.

7. Where data is processed and transfers outside the EEA

Our main database and recording storage are in the European Union (Frankfurt, Germany). Voice processing during calls takes place in LiveKit Cloud in the EU and on servers operated by us in Poland, which run, among other things, speech synthesis and quality analysis.

Some providers (in particular providers of language models, speech recognition, e-mail delivery and payments) may process data in the United States or other countries outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified entities) or on standard contractual clauses approved by the European Commission, together with supplementary measures. You can obtain a copy of the safeguards by writing to support@aiagenthub.pl.

8. People who call our customers

If you speak with the Voxiora assistant of a business you are calling, that business is the controller of your data. It decides whether calls are recorded and how long recordings and transcripts are kept (from deletion the day after the call to indefinite storage), and we process the data only on its instructions.

Every call starts by telling you that you are speaking with an AI assistant. If recording is enabled, the greeting also says that the call is recorded. You can ask to be put in touch with a person at any time.

For requests about your data, please contact that business first; at its request, we will help it handle your request. If you do not know which business uses Voxiora, write to support@aiagenthub.pl and we will forward your request to the relevant customer.

9. How long we keep data

• Account data and configuration content: for the term of the agreement and up to 30 days after it ends (except data we must keep longer); if the account owner deletes the account in the dashboard — immediately.
• Invoices and billing records: 5 years from the end of the calendar year in which the tax payment deadline expired.
• Data processed to defend against claims: until the limitation period for claims expires (as a rule up to 6 years).
• Recordings and transcripts of customers’ calls: for the period set by the customer in the dashboard (Privacy mode); call summaries until deleted by the customer or until the agreement ends.
• Recordings and transcripts of demo calls: 30 days. Hashes of phone numbers and IP addresses from demo calls: 90 days. Notes from demo calls (your name if given, type of business, the website you mentioned and a short summary, kept under the number hash without the number or transcript, so the assistant can continue the conversation in the next call or in a callback you asked for) and scheduled demo callbacks (number encrypted until the call is made): 30 days.
• Contact form messages: up to 12 months after the correspondence ends.
• Conversations with Voxiora’s own AI assistant: the content of the conversation (transcript) for 30 days, the conversation summary and technical data for 12 months, the hash of the IP address for 90 days. Contact requests passed on by the assistant: up to 12 months after the correspondence ends; support tickets it creates: like the other data of the customer account.
• Data processed on the basis of consent: until consent is withdrawn; cookies for the periods stated in the cookie policy.
• E-mail preferences and marketing consent: while the account exists. Records of consents and withdrawals: while the consent is valid and then for 3 years, so that we can demonstrate them. History of service and marketing e-mails, including opens and clicks: 2 years. The list of addresses that unsubscribed or bounced contains only a one-way hash of the address and is kept for as long as it is needed to respect your objection.
• Phone number verification details and documents: while the number is in use and for 24 months after it is released (to settle claims and meet the obligations of telecom law), then deleted; unfinished or rejected verifications without activity: 90 days; cancelled verifications: 30 days. The carrier keeps the data it has received for the period required by the law that applies to it.
• Satisfaction survey answers: for the duration of the contract — deleted together with the account; support requests opened from them — like other account data; the survey e-mail in the e-mail history — 2 years.
• Security logs and the API request log: up to 90 days, unless needed to investigate an incident.

10. Cookies and Google Analytics

We use strictly necessary cookies (for example for signing in, language, currency and remembering your cookie banner choice). Analytics cookies (Google Analytics 4) and marketing cookies (partner attribution) are stored only after you consent to the relevant category in the cookie banner. You can change or withdraw your consent at any time using the “Cookie settings” link in the website footer; withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Google Analytics 4 gives us aggregated visit statistics (e.g. number of visits, pages viewed, traffic sources, approximate location and device type). The service is provided by Google Ireland Limited; data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework. Details are in the cookie policy.

11. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interests (and always to direct marketing) and the right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to support@aiagenthub.pl. We will reply without undue delay and at the latest within one month. We may ask for information needed to confirm your identity.

Account owners can delete the account and its data themselves at any time in the dashboard (Settings → Danger zone → Delete account). Deletion takes effect immediately: we cancel the subscription, release the phone numbers, revoke integration access and delete the assistant, calls, recordings and contacts. We keep only the invoices and payment records that tax law requires us to retain. You can also request deletion by e-mail to support@aiagenthub.pl.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Business (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the country of your habitual residence or place of work.

12. Data from Google accounts

If you connect Google Calendar, Voxiora only uses: free/busy information, the list of your calendars (so you can choose one), and the events it creates, moves or deletes for bookings made by the assistant. We also read the Google account’s e-mail address to show which account is connected.

Voxiora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, do not sell it and do not train AI models on it; humans do not read it unless you ask us to, for security purposes or where required by law.

Access tokens are stored encrypted. You can disconnect at any time in the dashboard (Integrations) or at myaccount.google.com/permissions; when you disconnect, we revoke and delete the token.

13. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular encryption in transit (TLS) and at rest, encryption of integration tokens, role-based access control and least privilege, private recording storage accessible via short-lived signed links, event logging, backups and limits that protect against abuse.

14. Changes to this policy

This policy may be updated, in particular when the law, the service’s features or its providers change. The current version is always available on this page together with the date of the last update. We inform customers of material changes by e-mail or in the dashboard at least 14 days in advance.