VoiceAI collects the following categories of data:
Account Data: Name, email, company name, billing information (processed by Stripe). We do not store credit card numbers.
Voice Data: Call audio recordings, real-time voice streams (processed by AssemblyAI for transcription and voice agent responses), and call metadata (phone numbers, duration, timestamps).
AI Processing Data: Transcripts, LLM prompts and responses, sentiment analysis, call summaries, and analytics. This data is processed by the customer's configured LLM provider (OpenAI, Anthropic, Google, etc.).
Usage Data: API calls, feature usage, agent configurations, CRM data (contacts, leads, appointments) entered by the customer.
2. How Voice Data Is Processed
When a call occurs, voice data flows through the following pipeline:
Twilio handles the PSTN connection (phone number routing, call setup)
VoiceAI Bridge streams audio between Twilio and AssemblyAI in real-time
AssemblyAI performs speech-to-text and generates AI voice agent responses
LLM Provider (customer-configured) processes the transcript to generate responses
Supabase stores transcripts, call logs, and analytics in the customer's tenant
Call audio recordings are stored in Supabase Storage and are accessible only to the customer's tenant. Customers can delete recordings at any time. VoiceAI does not access, listen to, or use customer call recordings for any purpose.
3. Data Retention
Data retention is controlled by the customer:
Call recordings: Retained until customer deletes them. No automatic deletion unless configured.
Transcripts & analytics: Retained for the life of the account.
LLM logs: Request/response data retained for 90 days for debugging, then auto-deleted.
Account data: Retained until account termination. Deleted within 30 days of termination.
No-retention mode: Available on Scale plan — transcripts processed then immediately deleted, no recordings stored.
4. Subprocessors
We use the following subprocessors to deliver the service. Each is bound by data processing agreements:
Subprocessor
Purpose
Data Accessed
Region
Twilio
Telephony
Phone numbers, call metadata, audio stream
US/EU
AssemblyAI
Speech processing
Audio stream, transcripts
US
Supabase
Database & auth
All stored data
US/EU
Stripe
Billing
Email, billing address, card token
Global
LLM Providers
AI generation
Transcript text, prompts
Varies
Resend
Email delivery
Email address, message content
US
5. Data Security
All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
Per-tenant data isolation via Row Level Security (RLS) policies
API keys stored as SHA-256 hashes (never stored in plaintext)
Webhook signatures use HMAC-SHA256
SSO/SAML 2.0 available for enterprise customers
Audit trail for all administrative actions
Customer-managed encryption keys available on Scale plan
6. Your Rights (GDPR/CCPA)
Customers have the right to:
Access their data (export via API or dashboard)
Delete their data (account deletion removes all tenant data)
Export all data (CSV/JSON export available in dashboard)