Privacy Policy

1. Introduction

Vocito.ai B.V. ("Vocito", "we", "us", or "our") is committed to protecting the privacy and personal data of our customers, their end users, and visitors to our website. This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with the Vocito platform and related services.

We process personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG), the EU AI Act (Regulation (EU) 2024/1689), and other applicable data protection laws.

2. Data Controller

2.1 Vocito as Controller

For personal data related to customer accounts, website visitors, and marketing, Vocito.ai B.V. is the data controller within the meaning of Article 4(7) GDPR.

2.2 Vocito as Processor

For personal data processed on behalf of our customers through the Service (including call recordings, transcripts, lead data, SMS, and email communications), Vocito acts as a data processor on behalf of the customer, who is the data controller. The processing relationship is governed by our Data Processing Agreement.

2.3 Controller Contact Details

• Company: Vocito.ai B.V.
• Country: The Netherlands
• Email: privacy@vocito.ai

3. Scope of This Policy

This Privacy Policy applies to:

• Visitors to the Vocito.ai website.
• Customers who create accounts and use the Vocito platform.
• End users (callers) who interact with Vocito-powered AI voice agents.
• Individuals whose data is processed through the Service (e.g., leads, contacts).

4. Data We Collect

4.1 Account and Registration Data

Data Category	Examples	Purpose
Identity data	Full name, business name, job title	Account creation, identification
Contact data	Email address, phone number, business address	Communication, service delivery
Authentication data	Password (hashed), SSO tokens	Account security
Billing data	Payment method details, billing address, invoices	Subscription management, payment processing
Business data	Company size, industry, operating hours, services offered	AI agent configuration

4.2 Call and Communication Data

Data Category	Examples	Purpose
Call recordings	Audio files of inbound phone calls	Service delivery, quality assurance
Call transcripts	Text transcriptions of recorded calls	Lead extraction, review, analytics
Call metadata	Caller ID, call duration, timestamp, call status	Service delivery, analytics
SMS messages	Content of sent/received text messages	Follow-up communications
Email data	Email addresses, subject lines, email content (via Gmail/Microsoft 365 integration)	Email notifications, lead management

4.3 Lead and CRM Data

Data Category	Examples	Purpose
Lead information	Name, phone number, email, inquiry details	Lead management for customers
Booking data	Appointment dates, times, service types	Scheduling on behalf of customers
CRM records	Customer interaction history, notes, tags	Relationship management

4.4 Usage and Technical Data

Data Category	Examples	Purpose
Usage data	Features used, call volumes, login history, dashboard interactions	Service improvement, analytics
Device and browser data	IP address, browser type, operating system, screen resolution	Security, compatibility, analytics
Log data	Server logs, error logs, API request logs	Debugging, security monitoring
Cookie data	Session cookies, analytics cookies	See Cookie Policy section

4.5 Special Categories of Data

Vocito does not intentionally collect special categories of personal data (Article 9 GDPR), such as health data, biometric data, or data revealing racial or ethnic origin. However, callers may voluntarily disclose such information during phone calls. Customers are responsible for implementing appropriate safeguards if their business context is likely to involve special category data.

5. Legal Basis for Processing

We process personal data based on the following legal grounds under Article 6(1) GDPR:

Processing Activity	Legal Basis	GDPR Article
Providing the Service to customers	Performance of a contract	Art. 6(1)(b)
Processing customer data on behalf of customers	Performance of a contract (DPA)	Art. 6(1)(b)
Billing and payment processing	Performance of a contract	Art. 6(1)(b)
Call recording (platform level)	Legitimate interest / Consent (managed by customer)	Art. 6(1)(f) / Art. 6(1)(a)
Security monitoring and fraud prevention	Legitimate interest	Art. 6(1)(f)
Service improvement and analytics	Legitimate interest	Art. 6(1)(f)
Marketing communications	Consent	Art. 6(1)(a)
Compliance with legal obligations	Legal obligation	Art. 6(1)(c)
Responding to data subject requests	Legal obligation	Art. 6(1)(c)

6. How We Use Your Data

We use personal data for the following purposes:

• Service delivery: Operating the AI voice receptionist, processing calls, sending SMS, managing leads, and providing the dashboard.
• Account management: Creating and managing customer accounts, authentication, and authorization.
• Billing: Processing subscriptions, payments, invoicing, and handling billing disputes.
• Communication: Sending service notifications, updates, support responses, and (with consent) marketing communications.
• AI processing: Using large language models to understand caller intent, generate responses, extract lead information, and create transcriptions.
• Security: Detecting and preventing fraud, unauthorized access, and abuse of the Service.
• Analytics: Understanding usage patterns, improving the Service, and generating aggregated insights.
• Legal compliance: Complying with applicable laws, responding to legal requests, and enforcing our Terms of Service.

7. Call Recording and Transcription

7.1 How Calls Are Processed

When an inbound call is received by a Vocito AI Agent:

1. The call is routed through Twilio's telephony infrastructure.
2. The caller hears a disclosure that they are speaking with an AI assistant and that the call may be recorded.
3. The call audio is processed in real-time by ElevenLabs (voice AI) and Anthropic/Google/OpenAI (language models) to generate responses.
4. The call is recorded and stored in Supabase (EU region).
5. The recording is transcribed and analyzed to extract lead information.

7.2 Consent for Recording

Each Vocito AI Agent is configured to inform callers that the call may be recorded and transcribed at the beginning of the conversation. By continuing the call after this disclosure, the caller provides implied consent for recording. Customers (as data controllers) are responsible for ensuring this consent mechanism complies with the laws of their jurisdiction.

7.3 Recording Storage and Access

Call recordings and transcripts are stored in Supabase infrastructure in the EU region. Access is restricted to the Customer who owns the AI Agent configuration and authorized Vocito support personnel (only when necessary for technical support).

8. AI Processing and EU AI Act Transparency

In accordance with Article 50 of the EU AI Act, we provide the following transparency information:

• AI System Type: Vocito operates a conversational AI system that interacts with callers by voice. This is classified as an AI system that interacts directly with natural persons.
• Disclosure Obligation: Callers are informed at the start of each call that they are interacting with an AI system, fulfilling the Article 50(1) requirement.
• Synthetic Voice: The AI Agent's voice is generated synthetically using ElevenLabs voice technology. This constitutes AI-generated audio content as defined in Article 50(2).
• AI Providers: Caller speech is processed by large language models provided by Anthropic (Claude), Google (Gemini), and OpenAI (GPT) to interpret intent and generate responses.
• Human Oversight: Customers can review all AI interactions through the Vocito dashboard, and Vocito monitors AI performance for quality and safety.
• No High-Risk Classification: Vocito's AI voice receptionist is not classified as a high-risk AI system under Annex III of the EU AI Act, as it does not fall within the enumerated high-risk categories.

9. Sub-Processors

Vocito engages the following sub-processors to deliver the Service. We require all sub-processors to enter into data processing agreements that ensure an equivalent level of data protection.

Sub-Processor	Purpose	Data Processed	Location
Twilio Inc.	Telephony infrastructure, voice routing, SMS delivery	Phone numbers, call audio (real-time), call metadata, SMS content	USA (EU routing available); SCCs in place
ElevenLabs Inc.	AI voice synthesis, speech-to-text	Call audio (real-time streaming for voice generation)	USA; SCCs in place
Anthropic PBC	Large language model (Claude) for conversation understanding and response generation	Call transcripts (real-time), conversation context	USA; SCCs in place
Google LLC	Large language model (Gemini) for conversation processing	Call transcripts (real-time), conversation context	USA / EU; SCCs in place
OpenAI Inc.	Large language model (GPT) for conversation processing	Call transcripts (real-time), conversation context	USA; SCCs in place
Supabase Inc.	Database hosting, file storage, authentication	All Customer Data (account data, call recordings, transcripts, leads, CRM data)	EU (Frankfurt region)
Railway Corp.	Backend application hosting	Application data in transit and processing	EU region

We maintain an up-to-date list of sub-processors. Customers subscribed to our service will be notified at least 30 days in advance of any new sub-processor being engaged, providing the customer the opportunity to object.

10. International Data Transfers

10.1 Primary Data Storage

Customer Data is primarily stored in the European Union using Supabase infrastructure located in the Frankfurt (EU) region.

10.2 Transfers to Third Countries

Some of our sub-processors are based in the United States, which means personal data may be transferred outside the European Economic Area ("EEA"). For each transfer, we rely on one or more of the following safeguards:

• Standard Contractual Clauses (SCCs): We have entered into EU Commission-approved Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with each sub-processor located outside the EEA.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission (e.g., the EU-U.S. Data Privacy Framework for certified entities).
• Supplementary Measures: We implement additional technical and organizational measures, including encryption in transit and at rest, access controls, and data minimization, to ensure an adequate level of protection.

10.3 Transfer Impact Assessments

Vocito conducts transfer impact assessments for each international transfer to evaluate whether the legal framework of the recipient country provides adequate protection for personal data. These assessments are reviewed periodically and updated as needed.

11. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

Data Category	Retention Period	Basis
Account data	Duration of the account + 30 days after deletion	Contract performance
Call recordings	90 days from call date (default; configurable by customer)	Service delivery, customer configuration
Call transcripts	Duration of the account (default; configurable by customer)	Service delivery
Lead and CRM data	Duration of the account + 30 days	Service delivery
SMS messages	90 days from send date	Service delivery
Billing data	7 years after the transaction	Dutch fiscal retention obligations
Usage and log data	12 months	Security, analytics
Marketing consent records	Duration of consent + 3 years	Legal compliance
Cookie data	See Cookie Policy section	Consent

Customers may configure shorter retention periods for call recordings and transcripts through the dashboard. Upon account termination, Customer Data is deleted within 30 days unless a longer retention period is required by law.

12. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

12.1 Right of Access (Art. 15)

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about the processing.

12.2 Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data and completion of incomplete data.

12.3 Right to Erasure (Art. 17)

You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, you withdraw consent, or another ground under Article 17 applies. This right is subject to exceptions, such as legal retention obligations.

12.4 Right to Restriction (Art. 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or object to processing.

12.5 Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV) and to transmit it to another controller.

12.6 Right to Object (Art. 21)

You have the right to object to processing based on legitimate interest (Art. 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to processing for direct marketing purposes.

12.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

12.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Vocito.ai B.V. is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority):

• Website: autoriteitpersoonsgegevens.nl
• Phone: +31 (0)70 888 85 00

12.9 Exercising Your Rights

To exercise any of these rights, contact us at privacy@vocito.ai. We will respond to your request within 30 days. If we need more time (up to an additional 60 days), we will inform you of the extension and the reasons for the delay. We may request additional information to verify your identity before fulfilling your request.

12.10 End Users (Callers)

If you are a caller who interacted with a Vocito-powered AI Agent, your personal data is controlled by the business that deployed the AI Agent. Please contact that business directly to exercise your data protection rights. If you are unable to identify or reach the business, you may contact us at privacy@vocito.ai and we will assist in directing your request.

13. Cookie Policy

13.1 What Are Cookies

Cookies are small text files placed on your device when you visit our website. We use cookies and similar technologies to operate the website, analyze usage, and improve your experience.

13.2 Types of Cookies We Use

Cookie Type	Purpose	Duration	Legal Basis
Strictly necessary	Authentication, security, session management	Session / up to 30 days	Legitimate interest (no consent required)
Functional	Remembering preferences, language settings	Up to 12 months	Consent
Analytics	Understanding usage patterns, page views, feature adoption	Up to 12 months	Consent

13.3 Managing Cookies

You can manage your cookie preferences through the cookie banner displayed when you first visit our website. You can also control cookies through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the Service.

13.4 Third-Party Cookies

We do not use third-party advertising cookies. We may use analytics tools that set their own cookies, subject to your consent.

14. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access controls: Role-based access control (RBAC) with the principle of least privilege. Multi-factor authentication for administrative access.
• Infrastructure security: Hosting on SOC 2 and ISO 27001 certified infrastructure. Regular security patching and vulnerability scanning.
• Monitoring: Continuous monitoring for security events and anomalies. Logging of access to personal data.
• Employee measures: Confidentiality agreements with all personnel. Security awareness training.
• Incident response: Documented incident response procedures with defined escalation paths. See our Data Processing Agreement for breach notification commitments.

15. Children's Privacy

The Vocito Service is a business-to-business platform and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that data promptly. If you believe we have collected data from a child, please contact us at privacy@vocito.ai.

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date.
• Sending an email notification to registered customers for material changes.
• Displaying a notice in the Vocito dashboard.

We encourage you to review this policy periodically. Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the changes.

18. Contact Us

If you have questions or concerns about this Privacy Policy or our data processing practices, please contact us:

• Company: Vocito.ai B.V.
• Privacy inquiries: privacy@vocito.ai
• General support: support@vocito.ai
• Website: https://vocito.ai

For formal data protection inquiries or to exercise your rights, please email privacy@vocito.ai with the subject line "Data Protection Request".