Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") is established by AI PRO, a legal entity registered in Israel operating under the trade name Vocal AI, with its registered address in Tel Aviv, Israel ("Company", "we", "our", "us"). Wherever the name Vocal AI appears in this document, it refers to AI PRO. We operate the Vocal AI platform, accessible at www.vocalai.biz.

This Policy governs the collection, use, processing, storage, disclosure, and protection of information, including personal information, received from users ("you", "your") on our website (www.vocalai.biz), our AI-powered voice receptionist services, our AI-powered WhatsApp chatbot services, and any other services we provide (collectively: "Services").

By accessing or using our Services, you expressly consent to the practices described in this Policy. This Policy is an integral part of our Terms of Service.

For privacy-related inquiries, contact us at: support@vocalai.biz

2. Information Collection and Categories

2.1 Personal Information You Provide Directly

We collect various categories of personal information you provide to us, including:

• Identifiers: Full name, address, unique identifier, IP address, email address, account name, and similar identifiers.
• Account information: Name, email address, WhatsApp phone number, password (hashed using bcrypt; never stored in plain text).
• Commercial information: Purchase records, consumption history.
• Voice/visual/electronic information: Call recordings, transcriptions.
• Employment/professional information.
• Bot configuration: System instructions, FAQ content, Q&A knowledge base cards, calendar links, webhook URLs, Gemini API key.
• Website URLs submitted for knowledge base scraping.
• Payment information: Processed by our payment provider (Grow Payments); we do not store card numbers.

2.2 Information Generated Through Use of the Services

2.2.1 Voice Service Data

• Call recordings, transcriptions, and call/session logs.
• Call metadata, including timestamps and duration.

2.2.2 Chatbot (WhatsApp) Service Data

• WhatsApp conversations handled by your bot: phone number, message content, AI responses.
• Message timestamps and language detection results.
• Usage statistics: number of messages sent per month.
• Performance analytics data: daily message counts, peak activity hours, language distribution, response rates (aggregated per bot, retained for 14 days).
• Media files received from customers: images, voice messages, videos, and documents (processed for AI responses, subject to the same retention as messages).

2.3 Website Scraping Data (Chatbot Knowledge Base)

• When you submit a website URL for the knowledge base, we crawl and extract text content from the pages of that site.
• Scraped content is stored as processed text associated with your bot — it is not shared with other users.
• Website content is retained for as long as your bot exists or until you remove the URL from your settings.
• We do not store raw HTML, cookies, or login-protected content from scraped sites.

2.4 Usage Data

Information automatically collected about equipment, browsing patterns, and activity in the Services. Includes traffic data, location, call/session logs, and metadata.

2.5 Technical Information

• WhatsApp session data stored on our servers to keep your bot connected.
• Push notification tokens if you install the PWA and enable notifications.

2.6 Cookies and Tracking Technologies

See Section 11 (Cookies & Local Storage) for our specific approach. Vocal AI does not use advertising cookies. We use a third-party product-analytics tool (PostHog) on our website and dashboard, subject to your consent.

2.7 Location Data

If you grant permission, we will collect location data for personalization and service improvement.

3. Use of Information

3.1 Primary Purposes

• Provision and maintenance of the Services.
• Authenticating your account and operating the voice agent and WhatsApp bot.
• Delivering AI responses (chatbot Service).
• Displaying your inbox: showing conversations and calls handled on your behalf.
• Enforcing plan limits: tracking monthly message and call usage against your subscription limit (including API-sent and follow-up messages).
• Processing payments: sharing billing details with Grow Payments to charge your subscription.
• Providing analytics: generating performance dashboards including daily message counts, language distribution, and response rates.
• Sending push notifications: if you install the PWA and opt in, we send notifications for new messages, connection status changes, and usage alerts.
• Sending notifications and updates.
• Service improvement and problem identification.
• Management of transactions and accounts.

3.2 Secondary Purposes

• Development and training of AI models.
• Creation of anonymized data for research.
• Development of new products.
• Analyzing aggregate usage patterns (not individual messages or calls) to improve the Services.

3.3 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract performance: Processing necessary to provide the Vocal AI Services you signed up for, including account management, voice agent and bot operation, message and call delivery.
• Legitimate interest: Processing necessary for our legitimate business interests, such as improving the Services, preventing fraud, and ensuring platform security, where these interests are not overridden by your rights.
• Consent: Where you have given us explicit consent, such as opting in to push notifications or providing website URLs for knowledge base scraping.
• Legal obligation: Processing necessary to comply with legal requirements, such as tax and accounting obligations or responding to lawful government requests.

4. Information Sharing and Disclosure

4.1 No Sale of Personal Information

Vocal AI does not sell or rent your personal information or your customers' personal information.

4.2 Access and Use of Information

The Company maintains full access to the information and may use it for legitimate internal purposes consistent with this Policy.

4.3 Sharing with Third Parties

We share data only with the following categories:

• Service providers: For operating the Services.
• Google Gemini (AI): Message and call content is sent to Google's Gemini API to generate responses. Governed by Google's Privacy Policy.
• Grow Payments: Billing information for payment processing. Governed by Grow Payments' privacy policy.
• WhatsApp / Meta: If you choose the unofficial connection method, your bot connects to WhatsApp through an unofficial, third-party method (not the official WhatsApp Business API). Message delivery passes through WhatsApp's infrastructure. Vocal AI is not affiliated with, endorsed by, or officially connected to WhatsApp Inc. or Meta Platforms, Inc. Your use of WhatsApp is subject to Meta's Terms of Service. For full risk disclosure, see Section 11 of our Terms of Service.
• Outbound API consumers: If you use the Outbound API, message delivery status and content are processed through our servers to WhatsApp.
• Push notification services: If you enable push notifications via the PWA, notification tokens are processed through standard web push protocols.
• Legal requirements: To comply with legal obligations.
• Strategic partnerships: Sharing anonymized/aggregated information.

4.4 Consent to Information Sharing

By using the Services, you consent to the information sharing practices described herein.

4.5 Sub-Processors

We use the following sub-processors to provide our Services:

• Sub-Processor — Purpose — Location
• Google Gemini — AI response generation — United States
• Grow Payments — Payment processing — International
• WhatsApp / Meta — Message delivery — United States
• GCP — Application hosting — United States
• PostHog — Product analytics & session recording — European Union (Frankfurt)

We will provide at least 14 days' prior notice before adding any new sub-processor, by updating this page and notifying active users by email.

5. Data Retention and Security

5.1 Retention Periods

We will retain personal information only as long as there is a business or legal need. Specific retention periods include:

• Conversation messages (chatbot): Retained for 90 days, after which they are automatically deleted.
• Per-bot message cap: Each bot retains a maximum of 5,000 most recent messages.
• WhatsApp session files: Deleted after 30 days of bot inactivity.
• OTP verification codes: Expire within 10 minutes and are purged within 1 hour.
• Website knowledge base content: Retained until you remove the URL or delete your bot.
• Product feed data: Retained and refreshed on each import; removed when you delete the feed or your bot.
• Analytics data (charts, peak hours, language split): Retained for 14 days on a rolling basis.
• Push notification tokens: Retained until you uninstall the PWA or revoke notification permissions.
• Account data: Retained until you delete your account.

5.2 Security Measures

We employ commercially reasonable measures to secure information, including the following specific measures:

• Passwords are hashed using bcrypt and never stored in plain text.
• Gemini API keys are stored encrypted at rest and are never exposed in the dashboard after initial entry.
• Outbound API keys are generated securely and can be regenerated at any time from your settings.
• All connections use HTTPS/TLS.
• WhatsApp sessions are stored on persistent volumes with restricted access.
• Webhook URLs and third-party integration credentials are stored encrypted.

We cannot guarantee complete security; no method of transmission or storage is 100% secure.

5.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify affected users by email within 72 hours of becoming aware of the breach.
• Notify the relevant supervisory authority where required by law.
• Provide details of the nature of the breach, the data affected, likely consequences, and the measures taken to address it.

6. User Rights and Data Protection Rights

Depending on your location (including under GDPR and the Israeli Protection of Privacy Act, 1981 ("PPA")), you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you. You are entitled to review the information collected and stored about you in Vocal AI's databases.
• Right to rectification: Request correction of inaccurate, outdated, unclear or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data and account, subject to exceptions where retention is required by law or necessary for proper business operations.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time (this may require closing your account).
• Right to lodge a complaint: File a complaint with a supervisory authority. For EEA residents, this is your local Data Protection Authority. For Israeli residents, this is the Israeli Privacy Protection Authority (PPA).

To exercise any of these rights, email us at support@vocalai.biz. We will respond to your request within 30 days. If we need additional time, we will notify you of the extension and the reasons for the delay. Vocal AI may refuse a request to delete information if there is a legal obligation to retain it or if the information is necessary for proper business operations.

7. Controller–Processor Relationship

When your voice agent or bot interacts with your callers and customers, their data (such as phone numbers, message content, and call recordings) is stored in your account.

• You (the user) are the data controller for your customers' data. You determine the purposes and means of processing your customers' personal data through the voice agent and bot.
• AI PRO acts as a data processor on your behalf. We process your customers' data solely to provide the Vocal AI Services as instructed by you.

As the data controller, you are responsible for:

• Ensuring you have a lawful basis to process your customers' data (e.g., consent, legitimate interest).
• Providing your customers with appropriate privacy notices.
• Responding to your customers' data subject requests.
• Complying with all applicable data protection laws in your jurisdiction.

A Data Processing Agreement (DPA) is available upon request. Contact support@vocalai.biz to obtain a copy.

8. International Data Transfer

Your information may be processed outside your country of residence, including in the United States. Specifically:

• Google Gemini (AI processing): United States
• Grow Payments (payment processing): International
• GCP (hosting): United States
• WhatsApp/Meta (message delivery): United States

Where data is transferred outside the EEA, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission and adequacy decisions where applicable. You may request a copy of the relevant safeguards by contacting us at support@vocalai.biz.

9. Children's Privacy

The Services are not directed at, or intended for, individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information, please contact us so that we can take appropriate action.

10. Service Providers

We may use third-party providers such as Google Gemini, PayProGlobal, Railway, Cloudflare, and others to operate the Services. The current list of sub-processors is set out in Section 4.5.

11. Cookies & Local Storage

We use your browser's localStorage to store your authentication token and keep you logged in, and — subject to your consent — cookies for product analytics. Specifically:

• We do not use advertising cookies.
• We use PostHog for product analytics and session recording to understand how the product is used and improve it. PostHog is hosted in the European Union (Frankfurt), and typed input is masked in recordings.
• With your consent, we set first-party cookies for analytics (a consent record and PostHog's own cookies); without consent, only localStorage for session management is used.
• We show a consent banner before enabling analytics, and you can withdraw consent at any time from the Privacy section of your account settings or the privacy page, which stops recording immediately.

Where any other component of the Services uses cookies, web beacons, or similar technologies (for example, on the public website), they are used solely for service management and user identification and are described in the relevant interface.

12. Payments

Payments are processed through a secure third party (Grow Payments); we do not store credit card details.

13. Trademark Notice

"WhatsApp" and "Meta" are registered trademarks of Meta Platforms, Inc. "Google" and "Gemini" are trademarks of Google LLC. Vocal AI is an independent product and is not affiliated with, endorsed by, sponsored by, or officially connected to Meta Platforms, Inc., WhatsApp Inc., or Google LLC. All trademarks referenced herein belong to their respective owners.

14. Policy Changes

We may update this Privacy Policy from time to time. We will notify you by email or by displaying a notice on the website or in the dashboard. Continued use of the Services after changes constitutes acceptance.

15. Governing Law and Jurisdiction

This Privacy Policy is subject to the laws of the State of Israel. Exclusive jurisdiction is granted to the competent courts in the State of Israel (Tel Aviv-Jaffa district).

16. Contact

Questions about this Policy or privacy-related inquiries (including requests to exercise your data protection rights) can be directed to: support@vocalai.biz