Privacy Policy

Submissions sent through our contact form are emailed to our team and stored in our database so we can reply, investigate abuse, and audit traffic patterns. We do not use contact form submissions for marketing unless you ask us to.

• Processing and transcribing Voicegram recordings
• Generating AI summaries of Voicegrams
• Delivering Voicegrams to Customers via email
• Showing you the text of your own message so you can reuse it, for example as a review, where the business has chosen a review location
• Telling the business whether you used that option
• Providing access to the dashboard and analytics
• Processing payments and managing subscriptions

• Verifying caller email addresses to prevent spam
• Detecting and preventing fraudulent or abusive activity
• Enforcing rate limits and usage restrictions
• Protecting against unauthorized access

• Analyzing usage patterns to improve features
• Monitoring system performance and reliability
• Developing new features and functionality
• Conducting aggregated analytics (non-identifying)

• Responding to legal requests and court orders
• Complying with applicable laws and regulations
• Enforcing our Terms of Service
• Protecting our legal rights and interests

Processing necessary to provide the Service you have requested, including account management, Voicegram processing, and subscription handling.

Processing necessary for our legitimate business interests, such as fraud prevention, security, analytics, and service improvement, where these interests are not overridden by your rights.

Processing necessary to comply with legal requirements, such as tax obligations, court orders, or regulatory requests.

Where required, we will obtain your explicit consent before processing your data. You may withdraw consent at any time by contacting us.

If you accept the advertising category in our cookie banner, our marketing site shares data with TikTok so we can measure how our ads perform and show them to people who are likely to be interested. TikTok does not act on our behalf for this. It uses the data under its own privacy policy. The pixel runs only on our public marketing pages. It does not run inside the dashboard, on our customers' hosted campaign pages, or in the widget on our customers' websites, and recordings and message content are never sent to TikTok. See Cookies and Tracking for the details and how to opt out.

When a workspace admin searches for their business by name on the Google Reviews page, the text they type is sent from our servers to the Google Maps Platform so it can return matching places. The request carries that text and nothing else: no sender or visitor data, and no cookie or IP address from your browser, because our server makes the request rather than your browser. We store only Google's identifier for the place you choose, never the name or address Google returned. Google's handling of that request is governed by the Google Privacy Policy, which is incorporated here by reference for that feature.

When someone leaves you a Voicegram, the contact details they provide (an email address, or a phone number if they give one instead) are shared with you, the business operating the widget, so you can identify and respond to them. This applies whether or not they confirmed those details with a verification code. If you have connected integrations such as a webhook, Zapier, or a CRM, that contact information is also delivered to those services you chose. We share only what is needed to deliver the message and identify the sender, and we do not sell it.

If you have chosen a review location, we will also tell you whether the sender copied their message text or opened your Google review link. We do not receive or store what they post on Google. We record only that they copied their text or opened the link.

Our transcription provider automatically attempts to detect and redact certain personally identifiable information (PII) such as Social Security numbers, credit card numbers, and similar sensitive data. However, this redaction is not guaranteed to be complete.

Anthropic generates summaries of Voicegram transcripts. These summaries are created automatically without human intervention and are designed to provide a quick overview of the message content.

Where a business has chosen a review location, we show you your own message as text, exactly as it was transcribed, so you can reuse it. The only automatic changes are that card numbers and Social Security numbers spoken aloud are masked, and a very long message is shortened to the length Google's review form accepts. If we spot a phone number, an email address or a web link in the text, we point that out, because Google does not allow them in reviews, and you can edit the text before using it.

Your recordings and transcriptions are processed entirely by automated systems. Voicegram employees do not listen to or read your Voicegram content unless specifically requested by you for support purposes.

Your Voicegram recordings, transcriptions, and summaries are never used to train Voicegram's systems or any third-party AI models. Your content is processed solely to provide the Service.

Voice recordings are stored and transcribed to deliver your message, as described in the Data Retention section of this policy. We do not identify individuals by their voice: our transcription can distinguish between different speakers within a single message, but it does not determine who any speaker is, and we do not create, collect, or store voiceprints or any other biometric identifiers. We do not use voice data for authentication, identification, or verification of any person.

Storage period is set by the plan that was active when each Voicegram was recorded, and it never shortens afterwards. Upgrading extends everything already in your archive to the new plan’s period. If your subscription ends, Voicegrams recorded under a paid plan keep the period they were recorded with.

After the storage period expires, Voicegram recordings and transcripts are automatically and permanently deleted from our systems.

Review text is deleted together with the recording and transcript.

Account information is retained for as long as your account is active. Upon account deletion, your data will be removed within 30 days, except where retention is required for legal or compliance purposes.

If you request a sign-in link but never complete sign-in, we keep the email address you entered, and any plan or discount code you had selected, for up to 90 days so we can help if the link did not arrive, then delete it. You can ask us to delete it sooner at any time by emailing security@voicegram.io.

Contact form submissions and the IP addresses associated with them are retained for up to 12 months so we can respond to follow-up replies and investigate abuse patterns. After 12 months they are deleted from our database. You may request earlier deletion at any time by emailing security@voicegram.io.

If you accepted advertising cookies on our website and then ask for a sign-in link to create an account, we may keep a scrambled, one-way version of your email address, TikTok’s cookie ID and click ID, and the IP address and browser details from that request. We keep them for 30 days, even if you never finish creating the account. We use them to tell TikTok when you create an account, start a trial or pay, and then we delete them automatically.

We delete them sooner if you withdraw your advertising consent in the browser you used or delete your workspace. We keep and use them only if you accepted advertising cookies.

Certain records, such as deletion audit logs and billing records, may be retained for longer periods as required by law (typically 7 years for financial records).

• TLS encryption for all data transmitted to and from our servers
• AES-256 encryption for data stored at rest
• Encrypted database connections

• Database access controls so each account only sees its own data
• Strong authentication requirements for all accounts
• Limited employee access to production systems on a need-to-know basis
• Secure keys that verify each website using the widget

• Hosting on enterprise-grade cloud infrastructure (Vercel, Supabase, Cloudflare)
• Regular security audits and vulnerability assessments
• Automated security monitoring and alerting
• Incident response procedures

You have the right to request a copy of the personal data we hold about you.

You have the right to request correction of any inaccurate or incomplete personal data.

You have the right to request deletion of your personal data ("right to be forgotten"), subject to certain exceptions.

This extends to the providers listed on our Subprocessors page.

You have the right to request that we limit how we use your personal data.

You have the right to receive your personal data in a structured, commonly used, machine-readable format.

You have the right to object to processing of your personal data based on legitimate interests.

Where processing is based on consent, you have the right to withdraw that consent at any time.

You have the right to lodge a complaint with a supervisory authority in your country of residence.

You have the right to know what personal information we collect, use, disclose, sell, and share.

You have the right to request deletion of your personal information, subject to certain exceptions.

We do not sell your personal information for money. If you accept the advertising category in our cookie banner, our marketing site shares identifiers and activity data with TikTok for advertising, which California law calls sharing for cross-context behavioral advertising.

It is off until you accept it, and it never starts if your browser sends a Global Privacy Control signal, which we treat as your opt-out request. You can opt out at any time by turning off the advertising category under Cookie preferences in the footer of this site, or by contacting us as described in Contact Us.

We will not discriminate against you for exercising your privacy rights.

You have the right to request correction of inaccurate personal information.

You have the right to limit how we use sensitive personal information.

When transferring data from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding corporate rules where applicable
• Other valid transfer mechanisms under applicable law

Regardless of where your data is processed, we apply the same security measures and data protection standards described in this policy.

We use strictly necessary cookies for authentication, session management, and security purposes. These cookies are required for the Service to function and cannot be disabled. We also use browser storage (localStorage) for functional, non-tracking purposes such as keeping you signed in and remembering interface preferences.

We use Cloudflare Turnstile to protect against automated abuse. This service may collect IP addresses and browser signals to verify that requests come from real users.

We use Vercel Analytics to understand aggregate traffic on our marketing site. It is cookieless: it sets no cookies and stores no identifiers on your device, and the temporary visit identifier it derives from the request is discarded within 24 hours.

If you arrive through one of our affiliate partners, we use Tolt to credit that partner when you sign up. Tolt sets a referral cookie only after you accept the advertising category in our cookie banner. If you decline, close the banner, or do nothing, no referral cookie is set. You can change your choice at any time using the Cookie preferences link in the footer of this site.

We advertise Voicegram on TikTok and use the TikTok Pixel to measure how those ads perform. The pixel stores an identifier on your device and tells TikTok which pages of our marketing site you viewed and the page you came from, along with your IP address and browser and device details. It also tells TikTok when you have stayed on a page for about ten seconds or gone on to a second page. TikTok uses that to show our ads to people who are likely to be interested and to report which ads led to signups. It only starts after you accept the advertising category in our cookie banner. If you decline, close the banner, or do nothing, it never starts and nothing is sent. It also never starts if your browser sends a Global Privacy Control signal. You can change your choice at any time using the Cookie preferences link in the footer of this site. If you withdraw consent, we delete what the pixel stored on your device and reload the page so it stops immediately.

If you accept, we may also send TikTok a record of key actions, such as starting a trial, from our servers, so that ad results are not lost to ad blockers. Where we do, TikTok matches the record to you using a scrambled, one-way version of your email address or phone number, never the readable value, and we send it only for people who accepted the advertising category.

Other than the consent-gated referral, analytics, and advertising tools described in this section, we do not use advertising cookies or tracking pixels, and we do not sell your data.

We use CookieYes to manage consent on this site. The table below is generated and kept current by CookieYes and lists each cookie in use, its duration, and its purpose.