Data Processing Agreement

Last updated: May 13, 2026

Data We Collect

We process: voice call audio, transcripts, caller phone numbers, call metadata (duration, outcome, timestamps). We do not process medical records or payment card data.

How We Use Your Data

Voice calls are processed by Vapi/Twilio for telephony. Audio is transcribed by Deepgram. Call metadata and transcripts are stored in Supabase. We do not sell your data.

Subprocessors

  • Vapi — Voice telephony and AI routing
  • Twilio — Voice telephony (optional)
  • Deepgram — Speech-to-text transcription
  • Supabase — Database and authentication
  • Resend — Transactional email

Encryption

All data is encrypted in transit (TLS 1.2+). Data at rest uses AES-256 encryption via Supabase's storage layer. Encryption keys are managed via ENCRYPTION_KEY environment variable.

Retention

Call records are retained for 365 days by default. Organizations can configure retention between 30 and 3650 days in workspace settings. After retention period, records are permanently deleted.

Your Rights

You may request erasure of all personal data at any time. Contact privacy@voiceforge.ai or use the account deletion feature in your settings.

Contact

For data privacy inquiries: privacy@voiceforge.ai