Privacy Policy

Account and billing data

• Name, email address, and authentication identifiers
• Organization and workspace names, and team membership roles
• Subscription plan, billing status, invoices, and payment history

Product usage data

• Agent configurations, prompts, versions, and knowledge base documents you upload
• Minutes consumed, call counts, and quota state
• Audit records of significant actions, such as publishing an agent or changing settings
• Technical logs including IP address, browser type, timestamps, and error traces

Call data

• Call audio recordings, where recording is enabled
• Transcripts of what was said
• Caller and called phone numbers
• Call metadata: duration, direction, outcome, timestamps, and the tool actions the agent took
• Contact records that customers import for outbound campaigns

We do not process payment card numbers. Card details are entered directly into Stripe and never reach our servers. We do not intentionally collect health records or other special category data, and the platform is not intended for that use.

• To provide the service — running agents, placing and receiving calls, producing transcripts and analytics. This is necessary to perform our contract with you.
• To bill you — metering minutes, taking subscription payments, and issuing receipts.
• To keep the platform safe and lawful — enforcing do-not-call suppression, quiet hours, consent checks, rate limits, and abuse detection. This is our legitimate interest and, in places, a legal obligation.
• To support you — investigating the problems you report to us.
• To operate and improve reliability — error monitoring and aggregate product analytics.

We do not sell personal data, and we do not use your call content or agent configuration to train our own general-purpose models.

We rely on the following providers to deliver the service:

• Vapi — voice telephony and AI call routing
• Twilio — voice telephony, where you connect it
• Deepgram — speech-to-text transcription
• Supabase — database, storage, and authentication
• Stripe — payment processing and subscription billing
• Resend — transactional email

Each is bound by its own data protection terms and processes data only to provide its part of the service. If you connect additional integrations yourself, data you send through them is also governed by those providers' terms.

Where recording is enabled, calls are recorded and transcribed so that our customers can review and improve their agents. Our customers are responsible for having a lawful basis to call each person and to record the conversation, including any requirement to announce the recording or to obtain consent. If you received a call from an agent built on VoiceForge and want it deleted, contact the business that called you; if you cannot identify them, write to us and we will route the request.

Call records, including recordings and transcripts, are retained for 365 days by default. Organizations can configure retention between 30 and 3,650 days in workspace settings. Once the retention period passes, records are permanently deleted.

Account, billing, and audit records are kept for as long as your account is active and then for as long as we are required to retain them for tax and accounting purposes. Backups are rotated on a rolling schedule, so deleted data may persist briefly in backups before being overwritten.

Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Provider credentials you store are encrypted with authenticated encryption before being written to the database and are never displayed back to you. Access to production data is limited to the personnel who need it, and significant actions are written to an audit log.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected customers without undue delay.

We operate from Indiaand our subprocessors are located in several countries, including the United States and the European Union. Where personal data is transferred across borders, we rely on our subprocessors' standard contractual clauses and equivalent safeguards.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate
• Request erasure of your personal data
• Receive a portable copy of your data
• Object to or restrict certain processing
• Withdraw consent where processing relies on consent

You can delete your account from your settings, which removes your workspace data subject to the retention rules above. To make any other request, email support@incfrog.ai. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

We use cookies and equivalent local storage that are necessary to sign you in, keep your session, and remember interface preferences. We also use privacy-respecting product analytics to understand which features are used. We do not run third-party advertising trackers.

The service is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

If we make a material change to how we handle personal data, we will update the date at the top of this page and notify account owners by email. Continuing to use the service after a change takes effect means you accept the updated policy.

Privacy questions and data requests: support@incfrog.ai

See also our data processing addendum, services, and refund policy.