Privacy Policy

Agentic VAI (“we,” “us,” or “our”) provides conversational voice AI agents, automated workflow tools, and website telephony interfaces for commercial businesses. This Privacy Policy describes how we collect, process, store, protect, and share personal data when you visit our website at https://agenticvai.com, use our web application at https://app.agenticvai.com, or interact with an Agentic VAI voice agent deployed on a customer website or phone line.

We are committed to operating transparently and respecting individual privacy rights. When you use our services as a business customer, we typically act as a Data Processor on your behalf. When you browse our public website or create an account, we act as a Data Controller.

We collect information in three primary categories:

• Information You Provide Directly: Account registration details (name, email address, password hash, company name, billing address), contact form inquiries, and customer support communications.
• Information Processed Through Voice Interactions: Voice audio packets transmitted during active conversations, real-time speech transcripts, caller phone numbers (where telephony is utilized), and structured tool execution data (such as appointment requests).
• Automatically Collected Device & Usage Data: IP addresses, browser type, operating system, HTTP referral headers, time spent on pages, and basic telemetry to diagnose audio streaming latency.

We use the data we collect solely for the following legitimate business purposes:

• To provide, stream, and maintain low-latency conversational voice agent experiences.
• To execute requested business workflows, such as updating CRM records and creating calendar bookings.
• To process subscription billing and authenticate authorized user sessions.
• To detect and prevent fraudulent use, spam, denial-of-service attacks, and security vulnerabilities.
• To fulfill our legal and regulatory compliance obligations.

Because voice conversations can contain sensitive spoken remarks, we enforce strict data handling principles:

• Ephemeral Audio Processing: Inbound user audio is framed into streaming 20ms Opus chunks over WebRTC or secure WebSockets. Audio frames are converted to text in volatile streaming memory. We do not permanently store raw audio voice recordings unless our business customer explicitly enables call recording in their administrative dashboard.
• Zero Foundation Model Training: Under our enterprise commercial agreements with model providers (including OpenAI and Deepgram), customer conversational transcripts and voice audio are never used to train or fine-tune public foundation AI models.
• Scoped Retention: Conversation transcripts are retained solely according to the data retention settings configured by the business customer administering the voice agent.

When you register for an Agentic VAI organization account, we store your name, business email, organization name, and encrypted access credentials. Passwords are never stored in plaintext and are hashed using industry-standard bcrypt or Argon2 algorithms through our managed authentication infrastructure.

When you browse our public informational pages, our edge CDN servers record standard HTTP request logs (IP address, user agent, requested URL, response code). These server logs are retained for a maximum of 30 days for network security diagnostics and DDoS defense before being purged.

We use cookies and local storage tokens primarily to maintain authenticated dashboard sessions, remember audio playback volume preferences, and prevent CSRF attacks. We do not sell user data to advertising data brokers. For a complete itemization of cookies, please review our Cookie Policy.

We do not sell, rent, or monetize your personal information. We share information only under these circumstances:

• With Authorized Subprocessors: Cloud infrastructure, speech recognition, database, and payment processing vendors under strict confidentiality agreements.
• With Customer-Configured Integrations: When you connect Google Calendar, HubSpot, Salesforce, or webhooks, we transmit conversation data strictly per your instructions.
• For Legal Compliance: When required by enforceable court subpoena, law enforcement warrant, or applicable statutory mandate.

We maintain an up-to-date, publicly available registry of all third-party vendors who process customer personal data on our behalf. For provider details, processing locations, and security certifications, visit our Subprocessors Directory.

Account credentials and organization configurations are retained for the duration of an active commercial subscription. Customers may configure automatic transcript deletion rules (e.g., auto-purge after 30, 60, or 90 days). Upon account termination, customer data is deleted from active databases within 30 days and purged from disaster recovery backups within 90 days.

We implement robust technical and organizational measures (TOMs), including TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control (RBAC), multi-tenant logical database isolation, and automated vulnerability monitoring. For full details on our defense-in-depth security model, visit our Security & Trust Page.

If you access our services from the European Union, United Kingdom, or Switzerland, your data may be transferred to and processed in the United States. We execute Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate data protection safeguards across international borders.

Depending on your jurisdiction (including under GDPR, UK-GDPR, and the California Consumer Privacy Act / CCPA as amended by CPRA), you may have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data (“Right to be Forgotten”).
• Request data portability in a structured, machine-readable format.
• Object to or restrict certain processing activities.

To exercise any of these rights, email us at privacy@agenticvai.com.

Agentic VAI is an enterprise business SaaS platform and is not directed to children under the age of 16. We do not knowingly collect personal information from children. If we become aware that a minor has provided us with personal information, we take immediate steps to delete the data.

We may update this Privacy Policy from time to time to reflect modifications in our services, technological infrastructure, or statutory obligations. Material changes will be communicated via dashboard notification or email to registered organization administrators prior to the effective date.