Privacy Policy · VocoBook, your intelligent front desk

Vocobook answers business telephone calls with an AI receptionist. That means we handle recordings of what people say on the phone to businesses we work for. This page says plainly what we take, why we take it, who else sees it, how long we keep it, and how to make us delete it.

01Who we are and who this covers

Vocobook is a product of Puzzle Business Group LLC, registered at 2415 W Bradley Ave, Champaign, IL, United States. In this policy, "we", "us" and "Vocobook" mean that entity.

This policy covers three different groups of people, and it matters which one you are:

Business customers. The owners and staff of the businesses that buy Vocobook and sign in to the dashboard.
Callers. The members of the public who telephone one of those businesses and are answered by the Vocobook receptionist. If you called a salon, a clinic, a garage or a contractor and spoke to an automated voice, this is you.
Visitors. Anyone who visits our marketing website or tries the public voice demo.

02Controller and processor

When our customer's receptionist answers a call, the business you called is the data controller for that call. They decide that their phone is answered this way, they decide what the receptionist may say and ask, and they decide how long the record is kept. We are their processor: we handle that call data on their written instructions and for no purpose of our own.

For our own business customer accounts — the sign-in credentials, the billing record, the audit log of who changed what — we are the controller.

The practical consequence for a caller: if you want a call record deleted, the fastest route is to ask the business you called. You can also ask us directly, using the contact details in section 16, and we will act on it and tell them.

03What we collect

From callers

Your telephone number as it is presented to the telephone network (caller ID), and the business number you dialled.
A written transcript of the call — every turn of the conversation, yours and the receptionist's, with timestamps.
A short written summary of the call, a sentiment label, the call's length, and what the call produced — an appointment, a message for the team, an answered question, or a transfer to a person.
The contact details you give. Typically your name, the phone number you want to be reached on, and an email address if you offer one for a confirmation.
What you asked for. The service you wanted, the appointment you booked, and any note the receptionist took for the business.
Text messages sent to or from you through the platform, including the message body.

The receptionist is explicitly instructed not to collect payment card numbers, Social Security numbers or insurance identifiers, and not to repeat sensitive personal details back at greater length than is needed to confirm them. It is a software instruction, not a filter: if a caller volunteers such a number anyway, it can end up in the transcript, and section 7 is how it gets removed.

From business customers

Account details: name, email address, password hash if you set a password, and profile photo if you upload one.
Business configuration: your services and prices, opening hours, staff names, the answers you approve for the receptionist to give, and your logo.
Sign-in records: session records with the IP address and browser user-agent they were created from, and an audit log of significant actions taken in your workspace.
Billing records: your plan, your subscription status, and the Stripe customer and subscription identifiers. We do not see or store your card number.
Your connected calendar: the Google account email, the calendar you chose, and the access tokens needed to write appointments into it.

From website visitors

If you use the public voice demo, the email address you enter, any note you write about your business, a hashed form of your IP address, and your browser user-agent. The demo call itself is a real call and produces a transcript in the same way.
Ordinary server logs kept by our hosting provider, which include IP addresses.

04Call audio, transcripts and recording consent

This is the part most people want a straight answer on, so here it is in the order it actually happens.

While a call is in progress, the audio of your voice is streamed in real time to the speech model that produces the receptionist's replies. That audio leaves our systems and reaches the model provider we work with, under a data processing agreement. In return we receive a written transcript of each turn.

We do not currently store an audio recording of your call. What we store is the written transcript, the summary and the call metadata described above. The platform has a field reserved for a recording URL and it is not in use. If we ever begin storing call audio, we will update this policy and the date at the top of it before we do, not after.

Consent to being recorded and transcribed. Some US states require that all parties to a call consent to it being recorded — California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington among them, and the list changes. A transcript produced from your speech may count as a recording under those laws.

The business you called is responsible for making that disclosure, and our terms of service require them to. In practice it is made as a spoken line at the start of the call. If you do not want the call transcribed, say so and ask to be called back, or ask to be transferred to a person; you can also ask the business to delete the record afterwards.

05Why we use it

To answer the call. Audio has to be processed to be understood and replied to. There is no version of this product that does not do that.
To book the appointment and write it into the business's calendar.
To send the confirmation by text message and email.
To show the business what happened — the transcript, the summary and the outcome on their dashboard, so a call that needs following up gets followed up.
To recognise a returning caller within one business, so you are not asked for your name and number every time. Contacts are matched on the phone number, and only within that one business.
To bill correctly. We count call minutes and message counts per billing period.
To keep the service working and honest — diagnosing failures, investigating abuse, and keeping the audit log.
To comply with the law and to establish or defend legal claims.

Where a legal basis is required, ours is the performance of our contract with the business customer, our legitimate interest in running and securing the service, and, for callers, the controlling business's own basis for handling your enquiry.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

06Who processes it with us

We are a small company and we build on other people's infrastructure. These are the sub-processors that actually touch data, named honestly, with what each one gets:

Sub-processor	What it does	What it receives
Speech and language model provider	The realtime speech model that listens and speaks, and the text models that summarise a call. Named on request to business customers under NDA.	Live call audio, the conversation as it happens, and the business configuration included in the receptionist's instructions
Telephony provider	Telephone numbers, call carriage and SMS delivery. Named on request to business customers under NDA.	Caller and called numbers, call timing, and the text of every SMS we send or receive
Stripe	Payments and subscription billing	Business customer billing details and card data, which goes to Stripe directly and never through us
Google	Google Calendar, connected by the business through OAuth	The appointments we book: time, service, and the caller's name and contact details as the event's details
Railway	Application hosting and the PostgreSQL database	Everything the product stores, at rest
Resend	Delivery of transactional email, reached through our parent company's mail relay	Recipient email address and the content of confirmation and account emails

We may also disclose data where the law requires it, and to a buyer as part of a sale or reorganisation of the business, in which case this policy travels with the data.

We do not claim to have negotiated bespoke data-processing terms with every provider above beyond their standard published terms. If your business needs a signed data processing agreement, ask us and we will tell you what we can and cannot sign.

07How long we keep it, and deletion

Each business account carries a retention setting, measured in days, that applies to transcripts and call records. The business chooses it. Where a business has not set one, the default is to keep call records for the life of the account.

An honest limitation. The retention setting is stored per account and respected when we act on it, but scheduled automatic purging is not yet running as a background job. Today, deletion on request or on schedule is performed by our team. We are building the automated job, and we will change this paragraph when it enforces the setting on its own — not before.

Transcripts, call records and contacts — for the account's retention period, or the life of the account where none is set.
Business account and configuration data — for as long as the account exists.
Billing and usage records — kept after an account closes, for as long as tax and accounting law requires.
Audit logs and session records — kept as a security record; sessions expire on their own.
Voice demo requests — kept until we no longer need them to follow up, and deleted on request.

When a business closes its account, we delete or anonymise its workspace data on request and, in any case, within a reasonable period after the account ends, except for the billing records above and anything we are required to keep.

08Your rights over your data

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy of it;
have it corrected if it is wrong;
have it deleted;
limit or object to how it is used;
receive it in a portable form; and
not be discriminated against for exercising any of these.

California residents have these rights under the CCPA/CPRA. Residents of Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws have closely similar ones. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

How to exercise them. Email us at info@voco-book.com. If you are a caller, tell us the business you called and the phone number you called from, so we can find the record. We will verify that a request really comes from you before acting on it, and we will respond within the time the applicable law allows — 45 days under most US state laws, extendable once where permitted.

Where the business you called is the controller, we will forward your request to them and act on their instruction, unless the law requires us to act directly.

You may use an authorised agent where the law allows it, and you may appeal a refusal by replying to our decision; we will review the appeal and give you a written answer.

09How we protect it

What is actually true today:

Tenant isolation. Every record belonging to a business carries that business's identifier, and the code reaches it only through a layer that filters on it. One customer's calls, contacts and calendar are not reachable from another customer's session.
Encrypted OAuth tokens. Google Calendar access and refresh tokens are encrypted at rest with a key held outside the database, and are never returned to a browser.
Sessions. The session cookie carries an opaque identifier; the secret behind it is stored hashed, sessions expire, and they can be revoked.
Passwords are stored as hashes, never in readable form.
Transport encryption. The website, the dashboard and our API are served over HTTPS; connections to our sub-processors are encrypted in transit.
Redaction in the event log. Diagnostic events recorded against a call are redacted before they are written; secrets and tokens are not stored there.
Least access. Access to production data is limited to the people who operate the service.

What we do not claim. Vocobook is not SOC 2 certified, not ISO 27001 certified, and not HIPAA compliant. We have not completed a third-party security audit or penetration test. We will not tell you otherwise to win an order. If your business requires any of those, we are not the right supplier today, and we will say so.

No system is perfectly secure. If we discover a breach affecting personal information, we will notify affected customers and, where required, regulators, without undue delay.

10Healthcare and other sensitive businesses

An account can be switched into a healthcare compliance mode. In that mode the receptionist is held to stricter rules: it will not diagnose, will not comment on whether a symptom is serious, will not discuss medications or aftercare, records only what is needed to book or route the call, and, if a caller describes a medical emergency, tells them to hang up and call 911 and ends the call.

This is a safety setting, not a compliance certification. We are not a HIPAA business associate, we do not currently sign Business Associate Agreements, and nothing in this product should be treated as a HIPAA-compliant channel for protected health information. A medical practice that needs a BAA should not put Vocobook in front of its phone line until we can sign one.

11Children

Vocobook is a business tool sold to businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 13.

We are aware that a child can pick up a telephone and call a business. If we learn that we hold information about a child under 13, we will delete it. A parent or guardian who believes we hold such information should contact us at the address in section 16 and we will remove it promptly.

12International transfers

Vocobook is operated from the United States and sold to businesses with United States telephone numbers. Our application, our database and our sub-processors process and store data in the United States. the United States

If you call one of our customers from outside the United States, your call data will be processed in the United States, which may not offer the same legal protections as your own country. Our sub-processors operate globally and may route or support traffic from other countries under their own published terms.

We do not currently offer EU or UK data residency, and we do not currently offer Standard Contractual Clauses as a matter of course. If you need either, ask before you buy.

13Cookies and the website

Our marketing website sets no cookies and carries no advertising or cross-site tracking. It does count page views, using a first-party script served from app-url.com, which we run ourselves rather than an analytics company. Each view sends only the page address and the page that referred you. It sets no cookie, assigns no identifier, and cannot follow you across sites or sessions — which is why there is no consent banner: nothing is stored on your device to consent to. We use it to know which pages people read, and for nothing else. It loads a web font from Google Fonts, which means your browser contacts Google's servers to fetch it.

The dashboard sets cookies, and only these:

A session cookie that keeps you signed in. It holds an opaque identifier, nothing about you, and it is necessary for the dashboard to work at all.
A short-lived cookie used during single sign-on to protect the sign-in exchange itself. It is discarded once you are signed in.

Both are strictly necessary cookies, so there is no consent banner and nothing to turn off; blocking them means you cannot sign in. We set no advertising, profiling or cross-site tracking cookies anywhere.

14Automated decisions and AI training

The receptionist is an automated system. It decides what to say, whether an appointment can be offered, and when to hand the call to a person. It does not make decisions with legal or similarly significant effects about you — it books appointments and takes messages. A caller can always ask to speak to a person, and the receptionist is built to escalate when asked.

We do not use your calls to train our own models. We do not have our own models. Call audio and transcripts are sent to our model provider in order to produce the reply, and their handling is governed by that provider's terms for business customers, which at the time of writing do not use customer data to train their models by default. That is their commitment, not ours to give, so we state it as what it is.

15Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we handle personal information — most obviously, if we ever begin storing call audio — we will notify business customers by email before it takes effect.

16How to contact us

Privacy questions, access requests and deletion requests: info@voco-book.com

Everything else: info@voco-book.com

By post: Puzzle Business Group LLC, 2415 W Bradley Ave, Champaign, IL, United States

If you are a caller and your request concerns one specific call, tell us the business you called, the number you called from, and roughly when. Without those we may not be able to find your record, and we will not go looking through other businesses' data to try.