1. Scope and our role

Voice Labs provides AI voice agents that answer, qualify and book calls for trade and home-service businesses. This policy covers our website and the Voice Labs platform (together, the “Service”).

We act in two different roles, and which one applies changes who you should contact:

• As controller — when you visit our website, request a demo, or contact us. We decide why and how your information is used.
• As processor — when a customer deploys a Voice Labs agent on their phone line. That business is the controller of the calls it receives; we process call data on its instructions under a Data Processing Agreement.

If a Voice Labs agent answered your call to a contractor, that contractor is the business responsible for your information. We will help them respond to your request.

2. Information we collect

Information you give us

Your name, business name, work email address, phone number, trade, service area, and anything you tell us in a demo request, support conversation or contract.

Information the Service processes

Call audio and transcripts, caller phone numbers, and the details a caller provides during a call — service address, appointment window, description of the problem, access notes such as gate codes, and booking records. We also hold your agent configuration: scripts, pricing rules, service area and escalation rules.

Information collected automatically

IP address, browser and device type, pages viewed, referring URL, and timestamps.

Voice Labs agents are configured not to request payment card numbers, government identification numbers, or health information. If a caller volunteers this information anyway, our redaction rules remove it from stored transcripts where detected.

3. Call recordings and transcripts

Calls handled by a Voice Labs agent may be recorded and transcribed in order to deliver the Service, produce job notes for the technician, resolve disputes about what was agreed, and maintain quality.

Notice and consent

Call recording law varies by jurisdiction. Several US states and many countries require the consent of every party on the call. Our customers are responsible for giving legally required notice on their lines. We provide a configurable recording disclosure that plays at the start of every call, and we strongly recommend customers keep it enabled.

Customer controls

• Recording can be disabled entirely, keeping transcripts only.
• Transcript retention can be shortened or switched off.
• Redaction rules can strip specified categories from stored text.
• Individual recordings can be deleted on request.

Model quality

We do not sell call content, and we do not use it to train third-party foundation models. We use de-identified call data to improve Voice Labs’ own recognition and routing accuracy only where a customer has enabled that setting on their account.

4. How we use information

• Answer calls, qualify callers, book appointments and send confirmations
• Write jobs and notes into the customer’s scheduling software
• Page on-call staff when a call meets the customer’s urgency rules
• Provide support, investigate faults and resolve disputes about a call
• Monitor and improve quality, accuracy and safety of the Service
• Detect and prevent fraud, spam and abuse
• Send service, billing and security notices
• With your consent, send product and marketing communications you can withdraw from at any time
• Meet legal, tax and regulatory obligations

5. Legal bases

If you are in the EEA or the UK, we rely on the following bases:

• Performance of a contract — to provide the Service to our customer.
• Legitimate interests — to secure the Service, prevent abuse, and improve quality, balanced against your rights.
• Consent — for marketing communications, non-essential cookies, and call recording where consent is the applicable basis.
• Legal obligation — where we must retain or disclose information by law.

6. How we share information

Service providers

We use vendors for cloud hosting, telephony, speech processing, error monitoring and customer support. Each is bound by written terms, may process data only on our instructions, and is security reviewed before onboarding. Our current subprocessor list is available on request and on our Security page.

Your own integrations

Where a customer connects ServiceTitan, Housecall Pro, Jobber, Salesforce, a calendar or an SMS provider, we transmit booking and job data to that system at the customer’s direction. Once received, that system’s own privacy terms apply.

Legal and safety

We disclose information where required by law, subpoena or court order, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of any person. Where legally permitted, we notify the affected customer first.

Business transfers

If Voice Labs is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. How long we keep it

• Call recordings and transcripts — customer-configurable. 30 days by default; 24 months maximum.
• Booking and job records — for the life of the account.
• Account and billing records — for the life of the account, then seven years for tax and audit purposes.
• Website analytics — 14 months.
• Security and audit logs — 12 months.

When an account is terminated, customer data is deleted or irreversibly de-identified within 30 days, unless we are required to retain it by law.

8. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your information
• Receive a portable copy in a machine-readable format
• Restrict or object to certain processing
• Withdraw consent at any time, without affecting prior processing
• Opt out of the sale or sharing of personal information and of targeted advertising — we do neither
• Appeal a decision we make about your request
• Not be discriminated against for exercising any of these rights

To exercise a right, email privacy@voicelabs.example. We verify your identity before acting and respond within 30 days, or 45 where the law allows an extension. An authorised agent may act for you with written permission.

If a Voice Labs customer handled your call, send your request to that business. We will assist them as their processor.

You may also complain to your data protection authority. In the UK that is the Information Commissioner’s Office; in the EEA it is your national supervisory authority.

9. Cookies and tracking

We use strictly necessary cookies to run the site and keep sessions secure, and analytics cookies to understand which pages are used. We do not use advertising cookies and we do not allow third-party ad networks to track you here.

You can refuse non-essential cookies in our banner or clear them in your browser at any time. We honour the Global Privacy Control signal as a valid opt-out request.

10. International transfers

The Service is hosted in the United States. If you are in the EEA, the UK or Switzerland, your information will be transferred outside your country. We rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum, and we carry out a transfer impact assessment for each recipient. A copy of the clauses is available on request.

11. Security

We encrypt data in transit and at rest, isolate customer data per tenant, restrict staff access to a documented need, and test our systems independently. Our controls are described in full on the Security page.

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you and the relevant regulator as required by law.

12. Children

The Service is built for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information, contact us and we will delete it.

13. Changes to this policy

We update this policy when our practices change. The date at the top always reflects the current version. For material changes we give at least 30 days’ notice by email to account administrators before the change takes effect.

14. Contact us

Voice Labs, Inc.
[Registered address]
Privacy: privacy@voicelabs.example
Security: security@voicelabs.example

EEA and UK representative: [name and address of appointed representative].

1. Infrastructure

The Service runs on a major cloud provider in US regions, inside isolated virtual private clouds. Databases are not reachable from the public internet. Production, staging and development are separate accounts with no shared credentials.

Infrastructure is defined as code and applied through reviewed pipelines, so changes are versioned, auditable and reversible.

2. Encryption

• In transit — TLS 1.2 or higher on every external connection, with modern cipher suites and HSTS.
• At rest — AES-256 for databases, object storage, backups and log archives.
• Telephony — SRTP for call media where the carrier supports it.
• Key management — keys held in a managed KMS, access-controlled and rotated annually.

3. Access control

• Single sign-on with enforced multi-factor authentication for all staff.
• Role-based permissions on a least-privilege basis; no shared logins.
• Production access is time-boxed, requires approval, and every session is logged.
• Access is reviewed quarterly and revoked within 24 hours of a role change or departure.
• Company devices are encrypted, patched and centrally managed.

4. Call data handling

Recordings and transcripts are written to encrypted object storage and separated by tenant, so one customer’s call data is never reachable from another’s account.

• Retention is set by the customer, defaulting to 30 days.
• Redaction rules remove detected card numbers and identification numbers from stored text.
• Support staff cannot open a recording without an explicit customer request, and every access is logged and shown in the customer’s audit trail.
• Deletion requests are honoured across primary storage and backups within 30 days.

5. Application security

• Every change is peer reviewed before merge.
• Automated dependency, secret and static analysis scanning runs in continuous integration.
• An independent third party performs an annual penetration test; a summary report is available to customers under NDA.
• Findings are prioritised by severity, with critical issues remediated within 7 days and high within 30.

6. Monitoring and logging

Application, infrastructure and access logs are centralised in a write-once store with anomaly alerting to an on-call engineer 24 hours a day. Audit logs are retained for 12 months and can be exported by account administrators.

7. Availability and recovery

• Target of 99.9% monthly uptime for call answering.
• Multi-availability-zone deployment with automated failover.
• Redundant telephony carriers, so a single carrier outage does not silence a customer’s line.
• Encrypted backups taken daily and tested by restore.
• Recovery point objective of 1 hour; recovery time objective of 4 hours.
• Disaster recovery exercised at least annually.

8. Subprocessors

We use a small set of vendors for hosting, telephony, speech processing and support tooling. Each is security reviewed before onboarding and bound by written data protection terms. The current list is available on request, and we give account administrators 30 days’ notice before adding a new subprocessor that handles customer data.

9. Compliance

• SOC 2 Type II — audited annually; the report is available to customers and prospects under NDA.
• GDPR and UK GDPR — Data Processing Agreement with Standard Contractual Clauses and the UK Addendum available on request.
• CCPA and US state privacy laws — we act as a service provider and do not sell or share personal information.
• Call recording — configurable disclosure and per-state rules to support all-party consent requirements.
• TCPA — outbound calling honours do-not-call lists, calling-hour windows and revocation of consent.

10. Incident response

We maintain a documented incident response plan with defined severities, a 24-hour on-call rotation and a named incident commander. Suspected incidents are triaged within one hour of detection.

If an incident affects customer data, we notify affected account administrators without undue delay and within 72 hours of confirming the breach, with what we know, what we are doing, and what action you should take. A written post-incident review follows.

11. Report a vulnerability

Email security@voicelabs.example. We acknowledge reports within two business days and keep you updated until the issue is closed.

We offer safe harbour for good-faith research: if you follow this policy, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before disclosing it, we will not pursue legal action.

Please do not run automated scanning against production, access accounts that are not yours, or attempt denial-of-service testing.

12. Controls you hold

Security is shared. Your account administrators can:

• Turn call recording on or off, and set the retention window
• Configure redaction rules for sensitive fields
• Enforce single sign-on and assign role-based permissions to staff
• Export the audit trail of who accessed what, and when
• Request deletion of any recording, transcript or job record