Privacy Policy

1. Who We Are and What This Policy Covers

Virtual Vox is an enterprise conversational AI voice-agent platform provided by Aiidl Technologies Private Limited, an Indian company having its registered office at KH N. 146, 4th Floor, Sec-35, Baburam Mukhiya Complex, Noida, Gautam Buddha Nagar, Uttar Pradesh, 201301, India ("Virtual Vox", "we", "us", or "our"). We provide software for business voice conversations and connected workflows, using supported speech, AI, telecommunications and infrastructure services.

This Privacy Policy applies to our official websites (including virtualvox.io and virtualvox.ai), sales and support interactions, developer portals, APIs, and the cloud-hosted software and dashboards provided to business customers (collectively, the "Services").

This policy does not replace or supersede any signed Master Services Agreement (MSA), Data Processing Agreement (DPA), Business Associate Agreement (BAA), or specific order form. Where a negotiated customer agreement conflicts directly with this policy, that agreement controls for that specific customer.

The Services are engineered and offered strictly for commercial enterprises and authorised business users, not for personal, household, or individual consumer use.

2. Our Role When Processing Customer Data

Under data protection regulations, including the Digital Personal Data Protection Act, 2023 (DPDPA) and the General Data Protection Regulation (GDPR), responsibility is divided based on operational control:

• Data Processor / Processor Role: For all personal data contained within Customer Content—such as live call recordings, voice audio, synthesized speech, customer telephone numbers, and conversational transcripts—the customer is the Data Fiduciary (or Data Controller). Virtual Vox acts strictly as a Data Processor, processing that information exclusively on documented customer instructions and to deliver the agreed Services.
• Data Fiduciary / Controller Role: Virtual Vox acts as an independent Data Fiduciary regarding administrative user credentials, business contact records, billing transactions, security event logs, fraud prevention telemetry, and website analytics, as well as data retained to satisfy statutory audit and legal obligations.

3. Information We Collect

We collect and process the following categories of data in connection with the Services:

• Business and Account Data: Full names, enterprise email addresses, work telephone numbers, employer details, job titles, account roles, cryptographic authentication keys, and user preference settings.
• Customer Content: Audio files, live call streams, automated transcripts, system prompts, knowledge base documentation, conversational agent instructions, AI-generated responses, call summaries, CRM dispositions, and real-time evaluation outputs.
• Call and Integration Metadata: Calling and called telephone numbers (CLI/DID), call timestamps, call durations, termination reasons, carrier routing tags, opt-out/suppression signals provided by the customer, and identifiers ingested via third-party webhooks and CRM platforms.
• Device and Infrastructure Telemetry: IP addresses, browser agents, operating system metadata, API activity logs, latency measurements, error stack traces, token usage counts, and security incident alerts.
• Sales, Support, and Feedback Records: Product inquiry forms, demo requests, trouble tickets, onboarding communications, and voluntary feedback.
• Billing Records: Transaction history, invoicing details, corporate tax identifiers (e.g., GSTIN), and payment reference numbers. Payment card details are processed directly by certified payment gateways and are never stored on Virtual Vox servers.

4. How We Use Information

We process information for the following operational purposes:

• To provision, operate, route, monitor, secure, and maintain voice agents, API endpoints, and platform infrastructure.
• To transcribe incoming audio, run model inference, synthesize natural speech, evaluate conversational flows, and generate analytical dashboards requested by customers.
• To administer customer accounts, verify credentials, issue invoices, collect usage-based fees, and deliver essential service notices.
• To identify unauthorized system access, mitigate fraudulent robocalling or spoofing campaigns, enforce our Acceptable Use Policy, and comply with applicable statutory mandates.
• To monitor system uptime, inference latency, and error rates in order to optimize platform reliability and audio processing pipelines.
• To respond to enterprise inquiries, schedule technical demonstrations, and deliver relevant product updates (subject to standard opt-out controls).

Virtual Vox processes personal data lawfully to perform contractual commitments, execute documented customer instructions, fulfill statutory compliance duties, or support legitimate security operations. We do not sell personal data or monetize it for third-party behavioral advertising.

5. Customer Content and Model Improvement

• No Shared Model Training: Virtual Vox does not use Customer Content—including private audio streams, call transcripts, proprietary prompts, or knowledge bases—to train, fine-tune, or improve general-purpose public models or shared foundation models without explicit, prior written consent.
• Dedicated Customer Improvements: We process Customer Content solely to execute customer-directed inference, evaluation, retrieval-augmented generation (RAG), and debugging workflows. Where an order form provides for customer-specific fine-tuning or custom acoustic adapters, ownership and access rights are governed by that specific contract.
• System Telemetry: We may derive aggregated, anonymized telemetry metrics (such as aggregate packet latency, word error rate distributions, and model throughput) that cannot identify any individual or organization, using them solely to ensure cluster health and platform stability.

6. Voice Recordings, Notices, and Consent

Voice agents deployed through Virtual Vox interact directly with end-users and can be configured to record, transcribe, and analyze voice communications in real time.

• Customer Responsibility: The customer maintains sole operational discretion over whether call recording and transcription are activated. The customer is solely responsible for providing all legally mandated audible disclosures (e.g., announcing call recording and disclosing the artificial/AI nature of the voice agent), collecting verifiable consent, managing Do-Not-Call (DNC) suppressions, and maintaining immediate human escalation paths.
• No Legal Clearance: Virtual Vox provides the communication infrastructure only. Our platform features do not constitute legal advice, and our provision of the Services does not certify that any customer's specific call campaign, script, or recording setup complies with applicable telecom or privacy regulations.

7. How We Disclose Information

We share personal data strictly under controlled circumstances:

• Customer Team Members & Integrations: With authorized workspace members and connected third-party tools (CRMs, storage buckets, telephony providers) based on your dashboard settings.
• Vetted Subprocessors: With cloud hosting providers, SIP trunking carriers, database hosts, latency monitoring tools, and enterprise billing systems. All subprocessors are subject to confidentiality, data security, and compliance obligations aligned with applicable data protection laws.
• Professional Advisors: With legal counsel, certified public accountants, auditors, and insurers under standard professional non-disclosure duties.
• Legal and Regulatory Compliance: When required by applicable law, court order, or governmental authority, or when necessary to protect the security, assets, or rights of Virtual Vox and its users.
• Corporate Transactions: In connection with a corporate reorganization, merger, financing, or asset transfer involving Aiidl Technologies Private Limited, subject to customary confidentiality protections.

8. International Data Transfers

Virtual Vox and its subprocessors maintain infrastructure across India and select international data center regions. Where customer data is transferred across borders, we implement recognized contractual safeguards, including standard contractual clauses and relevant supplementary security controls. Customers requiring specific data residency zones may specify hosting preferences within their order schedule.

9. Data Retention and Deletion

• Customer Content: Audio files, transcripts, and model outputs are retained in accordance with the customer's selected retention settings, lifecycle rules, and contractual terms. Upon account termination or written request, Customer Content is permanently deleted or anonymized from production clusters in line with our operational backup schedules, subject to statutory preservation requirements.
• Administrative & Billing Data: We retain customer contact information and support tickets for the duration of the commercial relationship plus an appropriate audit period. Tax, transaction, invoicing, and dispute records are preserved for the statutory periods mandated by applicable tax and corporate legislation.

10. Security Safeguards

Virtual Vox utilizes technical and organizational security measures, including:

• Transport Layer Security (TLS 1.3) for all data in transit across public networks;
• Industry-standard encryption algorithms (such as AES-256) for data at rest;
• Role-based access controls (RBAC) and strict multi-factor authentication requirements for administrative systems;
• Continuous endpoint monitoring, network logging, and structured vulnerability assessments.

Customers are responsible for securing their account credentials, managing API secret keys, and avoiding the submission of unencrypted passwords or prohibited sensitive data categories through open prompt inputs. In the event of a verified security incident affecting Customer Content, Virtual Vox will notify affected enterprise customers without undue delay and provide relevant details to support statutory reporting obligations.

11. Cookies and Analytics

Our marketing and documentation websites use essential technical cookies to maintain sessions and enforce security. We may also use analytical tools (such as privacy-conscious web telemetry platforms) to measure visitor interactions, page load speeds, and API documentation performance. Users can control non-essential tracking cookies via browser preferences.

On virtualvox.io, you can manage optional website measurement through the Privacy choices control. With your permission and when configured, PostHog receives selected page and interaction events with a temporary browser identifier. We exclude form contents, contact details, verification codes and voice conversations from these events; session recording is disabled. Our own conversion counts expire after 30 days, while PostHog event retention is managed separately in the analytics project. The Cookie Policy explains storage and withdrawal of permission.

12. Individual Rights

Depending on their jurisdiction, individuals whose personal data is held by Virtual Vox as a Data Fiduciary may have the right to request access, correction, completion, erasure, or restriction of their personal data, or to withdraw consent.

• Customer-Controlled Data: Because Virtual Vox acts strictly as a data processor for call transcripts, voice audio, and CRM records submitted by our customers, end-users interacting with a customer's voice agent should direct their privacy requests directly to the organization operating the agent. Virtual Vox will assist the customer in responding to such requests in accordance with our contractual commitments.
• Virtual Vox Account Data: Inquiries regarding business contact information or account-level data processed directly by Virtual Vox may be directed to [email protected].

13. Children's Data

The Services are intended exclusively for commercial business operations and are not directed to minors. Customers are strictly prohibited from configuring Virtual Vox agents to collect or process personal data from children without a separate written agreement and the implementation of all statutory age-verification, parental consent, and data minimization mechanisms required by applicable law.

14. Statutory Compliance and Policy Updates

This Privacy Policy is governed in accordance with applicable Indian laws, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (along with its associated rules as they take effect). Where applicable, our contractual data protection provisions support customer compliance with regional regulations, including the GDPR.

We may update this Privacy Policy periodically to reflect technological adjustments, regulatory developments, or workflow enhancements. The updated version will be posted on this page with a revised effective date.

15. Contact and Grievance Redressal

For privacy inquiries, rights requests, or regulatory grievances, you may contact our designated Grievance Officer:

• Attn: Grievance Officer
• Company: Aiidl Technologies Private Limited (Brand: Virtual Vox)
• Office Address: KH N. 146, 4th Floor, Sec-35, Baburam Mukhiya Complex, Noida, Gautam Buddha Nagar, Uttar Pradesh, 201301, India
• Email: [email protected] (or [email protected])

This Privacy Policy is governed by the laws of India. Subject to mandatory protections under applicable data privacy statutes, the competent courts located in Gautam Buddha Nagar, Uttar Pradesh, India, have exclusive jurisdiction over any disputes arising under or relating to this policy.