Privacy policy

EXTRAVOX AI, LLC (“EXTRAVOX”, “we”, “us”) of 131 Continental Dr, Suite 305, Newark, DE 19713, United States, is responsible for the personal data described in this policy. This policy explains what we collect, why, who we share it with, and the rights you have.

1. Two different roles, and why it matters

EXTRAVOX handles personal data in two distinct ways, and your rights differ depending on which applies.

• As a controller — for data about you as our customer: your account, your billing, your use of the platform. We decide how that data is used, and this policy governs it.
• As a processor — for data about the people your assistants speak to: call audio, transcripts, caller numbers and anything a caller says. You are the controller of that data. We process it only to provide the service to you and on your instructions. You are responsible for having a lawful basis for it, and for telling those people what you do with it.

2. What we collect

2.1 Account and billing

• Name and email address.
• Password (stored only as a cryptographic hash — we never see it).
• Purchase history and plan details.
• Billing information handled by our payment providers. We do not store full card numbers — they go directly to the payment provider.

2.2 Call data

When your assistants make or receive calls we process:

• Call audio recordings.
• Transcripts of what was said by both parties.
• Telephone numbers, call times, durations and outcomes.

This is the most sensitive data on the platform. Recordings and transcripts can contain anything a caller chose to say, including special-category data if they volunteered it. Please see section 6 on your obligations.

2.3 Usage and technical data

• Minutes consumed, assistants created, features used.
• Log data such as IP address, browser type and timestamps, used for security and diagnostics.

2.4 Support

• Messages you send us, and our replies.

3. Why we use it, and our lawful basis

We do not sell personal data, and we do not use your call recordings or transcripts to train our own AI models.

4. Who we share it with

We share data only with the providers needed to run the service. Each is bound by contract to protect it and to use it only on our instructions.

We may also disclose data where the law requires it, to protect our rights or someone’s safety, or to a buyer as part of a merger or acquisition — in which case we will tell you.

5. International transfers

We are based in the United States and our providers are largely US-based, so data about people in the UK or EEA is transferred outside their home region. Where that happens we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK Addendum. You can request details at [email protected].

6. Call recording — your responsibilities

Calls are recorded and transcribed by default so you can review them. Recording a call without adequate consent is unlawful in many places. Several US states require every party to consent; the UK, EEA and other jurisdictions require a lawful basis and clear notice.

As the controller of that data, you must obtain any consent required and give any notice required — normally by having your assistant announce at the start of the call that it is being recorded. We provide the tools; meeting the obligation is yours.

7. How long we keep it

You can delete individual recordings and transcripts from the dashboard at any time, and you can ask us to delete your account entirely.

8. Security

We protect data with encryption in transit, hashed passwords, encrypted storage of sensitive credentials, access controls, and audit logging. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant regulator where the law requires it.

9. Your rights

9.1 If you are in the UK or EEA

You have the right to access your data; to correct it; to have it erased; to restrict or object to processing; to data portability; and to withdraw consent at any time. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner’s Office.

9.2 If you are in California

Under the CCPA/CPRA you have the right to know what we collect and why, to delete it, to correct it, to opt out of “sale” or “sharing” (we do neither), to limit use of sensitive personal information, and not to be discriminated against for exercising these rights.

9.3 How to exercise them

Email [email protected]. We respond within 30 days, and will verify your identity before acting. Using these rights is free.

10. Cookies

Our website and dashboard use cookies that are strictly necessary to sign you in and keep your session secure, plus limited analytics to understand how the product is used. We do not use advertising cookies or third-party tracking pixels for advertising.

11. Children

EXTRAVOX is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact [email protected] and we will delete it.

12. Changes

We may update this policy. Material changes will be notified by email or in the dashboard before they take effect, and the date at the top will always show the current version.

13. Contact