Privacy Policy

1. Scope

The policy covers the marketing site on voxlin.ai, the console, the APIs and our support channels. Voice agents our customers embed in their own websites and the third-party systems they connect are subject to their own privacy policies.

2. Data we collect

Some data you give us, and some is generated automatically as you use the service:

• Account data: name, company, email, phone, billing details.
• Usage and technical data: login records, IP address, browser and device information, request logs, credit consumption records.
• Content data: agent flows, knowledge base texts, audio files you upload, generated audio and transcripts, conversation and outcome records.
• Payment data: amount, currency, date and payment reference. Card data stays with the payment institution and is not passed to us.
• Communication data: information you share in demo, reseller and support requests, and the correspondence history.

3. Why we use data

We use data to provide and operate the service, meter and invoice usage, keep the service secure, provide support, meet our legal obligations and improve the service. Wherever possible, improvement work uses aggregated or non-identifiable data.

We do not sell your data; we do not share it with advertising networks and do not pass it to third parties for profiling.

4. Your content and AI models

Content you upload to your account or generate through the service belongs to you. We do not use it to train general-purpose AI models without your explicit written consent, and we do not provide it to third parties for that purpose.

Content is processed only to carry out the operation you requested (for example narrating a text or transcribing a recording), to investigate faults and to prevent abuse. Where model providers are involved, we contractually secure that the data supplied is not used for training.

5. Service providers

To deliver the service we work with cloud hosting, database, email delivery, payment, e-invoicing, telephony and AI model providers. These providers access only the data needed to deliver the service and are bound by confidentiality and data processing commitments.

You can request the current list of sub-processors from [email protected].

6. Transfers abroad

All our servers are located in Türkiye. Your personal data is stored and processed in Türkiye and is not transferred abroad.

7. Security

To protect data we apply TLS encryption in transit, encryption at rest, role-based access control, logging of privileged access, regular backups and the principle of least privilege. Our staff are bound by confidentiality obligations.

No system is entirely without risk. In the event of a personal data breach, the Board and the affected individuals are notified as soon as possible and within 72 hours at the latest, in line with Article 12 of KVKK and the Board's decisions.

8. Retention and deletion

We keep data for as long as the purpose requires and for the retention periods set by law. When you close your account, your content data is deleted or anonymised after a reasonable transition period; financial records continue to be kept for their statutory periods.

You can delete recordings, transcripts and agent content from the console at any time.

9. Cookies

The site uses one strictly necessary cookie to remember your language preference, and measurement cookies may be present only in the public production environment. See the Cookie Policy for the details and the full list.

10. Children

The service is aimed at businesses and is not open to people under the age of 18. If we identify data belonging to someone under 18, we delete it.

11. Your rights and contact

You can exercise your rights to access, correct, erase and object to processing through the procedure in the KVKK Privacy Notice. For privacy questions write to [email protected]; for anything else write to [email protected].

12. Google user data

This section applies when a business user connects a Google Calendar to Voxlin. Calendar access is requested only when you choose to connect Google Calendar under Integrations > Calendar in the console, never when you sign in. If you sign in with Google, we receive only the basic profile information needed to create your account and sign you in: your name, email address and profile picture (the openid, email and profile scopes).

Data we access: with the calendar.calendarlist.readonly scope, the list of calendars in your Google account (calendar names and IDs), so that you can choose which calendars Voxlin may use; with the calendar.events scope, the events on the calendars you select, and on no other calendar. We also keep the email address of the connected Google account so that the console can show which account is connected.

How we use it: Voxlin uses Google user data only to provide the booking and meeting features you turn on: (1) to find busy times and the blocks you mark as "available for booking" on the selected calendars, so that the AI agent offers your customers only times that are actually free; (2) to create, update or cancel the appointment event when a customer books, reschedules or cancels through the AI agent; (3) if you turn on automatic meeting joining, to read the Meet, Zoom or Teams link of the meetings you opt in for, so that the Voxlin AI meeting agent can join them. The AI agent receives only the free times Voxlin calculates; the titles, descriptions and attendees of your events are not passed to the AI model.

Your customers' data: for the personal data of your customers contained in calendar events, your business is the data controller, and Voxlin acts as a data processor that processes it only on your instructions, as described in the KVKK Privacy Notice. Appointment details Voxlin writes to your calendar are stored by Google under your agreement with Google.

Storage and security: OAuth tokens are encrypted at rest (AES-256-GCM) and are used only by Voxlin's servers to access Google on your behalf. Event contents read to calculate availability are processed in memory and are not stored. Voxlin stores only the IDs of the calendars you assign to booking resources, the calendar and event IDs of the appointment events it created (so that it can update or cancel them later), the email address of the connected account and, for meetings you opt in for, the meeting link and time needed to schedule the AI meeting agent. This data is protected by the measures described in section 7.

Retention: OAuth tokens are kept only while the connection is active. When you disconnect, Voxlin revokes its access at Google and deletes the tokens immediately. The email address of the connected account is kept only while booking resources still refer to it, so that you can reconnect the same account; it is deleted when you delete those resources or the connection. Calendar and event IDs are kept with your booking resources and appointment records and are deleted with them. When you close your account, all data received from Google is deleted together with your other data under section 8.

Disconnecting and deletion: you can disconnect Google Calendar at any time under Integrations > Calendar in the console, or remove Voxlin's access from your Google Account at https://myaccount.google.com/connections; Voxlin can then no longer access your calendar. To have data received from Google deleted, write to [email protected]; your request is completed within 30 days at the latest.

Voxlin's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is published at https://developers.google.com/terms/api-services-user-data-policy. In particular:

• We do not sell Google user data.
• We do not use it for advertising, including personalised, retargeted or interest-based advertising, and we do not use it to determine credit-worthiness or for lending purposes.
• We do not use it to develop, improve or train generalised AI or machine learning models.
• Voxlin staff do not read it, except with your explicit consent for specific data (for example to resolve a support request), where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.
• We share it only with the sub-processors needed to operate the service (section 5), under the same restrictions, and with authorities only where the law requires it.

13. Changes

When the policy is updated, the new version is published on this page and the update date at the top of the page changes. Material changes are notified to your account before they take effect.