Privacy and data protection by design.

The General Data Protection Regulation (Regulation (EU) 2016/679) establishes strict protections for the personal data of individuals within the European Economic Area (EEA) and the United Kingdom (UK GDPR). Agentic VAI has incorporated Privacy by Design and Privacy by Default into our platform architecture, enabling enterprise clients to automate voice conversations while honoring individual privacy rights.

Under the GDPR framework, roles are clearly demarcated:

• Customer as Data Controller: You (the business deploying the voice agent) determine the purposes and means of processing personal data collected from your callers and website visitors. You determine what instructions to provide to your agent and what integrations to enable.
• Agentic VAI as Data Processor: We process personal data exclusively in accordance with your documented instructions, our Terms of Service, and our Data Processing Addendum (DPA).

Customers must ensure a valid lawful basis under Article 6 of the GDPR before collecting personal data via voice agents. Common legal bases include:

• Consent: The visitor verbally agrees to interact with an AI voice agent after clear greeting disclosure.
• Performance of a Contract: The caller is booking an appointment or querying order status under an existing contract.
• Legitimate Interests: Providing high-availability customer support to website visitors.

Agentic VAI processes only the data required to facilitate real-time conversational streaming and fulfill connected tool operations. This includes audio packet frames (ephemeral memory buffer), generated text transcripts, and structured tool arguments (e.g., meeting start times, customer email).

Articles 12 to 23 of the GDPR grant individuals specific rights regarding their personal data. Agentic VAI provides technical self-service tools in the customer dashboard to assist controllers in responding to data subject requests without delay.

When a data subject submits a Subject Access Request (SAR), organization administrators can search conversation records by caller ID, email address, or session timestamp and export all associated dialogue logs in structured JSON or CSV format.

Under Article 17 (“Right to Erasure”), individuals may request the deletion of their personal records. Administrators can trigger single-conversation deletion or purge all logs associated with a specified caller directly from the analytics dashboard or via our administrative REST API.

Customers can export customer knowledge bases, conversation transcripts, and agent configuration templates in universally supported machine-readable formats (JSON and CSV) at any time.

In accordance with the principle of storage limitation (Article 5(1)(e)), we allow customers to set automated retention thresholds: conversational transcripts can be scheduled for automatic deletion after 30, 60, or 90 days.

We engage third-party subprocessors who assist in providing infrastructure, speech recognition, and database services. All subprocessors are bound by written data processing agreements imposing equivalent data protection standards. Review our active vendor roster on our Subprocessors Directory.

Where customer data originating from the EEA, UK, or Switzerland is processed in the United States, we rely on the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) incorporated into our DPA.

We maintain state-of-the-art technical measures to ensure a level of security appropriate to the risk, including TLS 1.3 transport encryption, AES-256 disk encryption, multi-tenant row-level access control, and 24/7 infrastructure monitoring.

We offer a standard Data Processing Addendum (DPA) incorporating European Commission Standard Contractual Clauses to all business and enterprise customers. You can review and initiate a DPA request directly from our DPA Workflow Page.

In the event of a confirmed personal data breach affecting customer data, Agentic VAI will notify affected Data Controllers without undue delay and, where feasible, not later than 72 hours after becoming aware of it, assisting controllers in meeting their Article 33 obligations.