Privacy Policy
Last updated
("we", "us") operates (the "Service"), a voice agent API, console and website. This policy covers two groups of people:
- Developers: people and organizations with an account who build agents. For their account data we are the controller.
- End Users: people who talk to an agent a developer built. For their data, the developer is the controller and we are a processor acting on the developer's instructions. If you are an End User, the developer's privacy notice applies, and you should contact the developer first about your data (see section 7).
1. Developer data
| Data | Why | How long |
|---|---|---|
| Account: email, sign-in provider, display name, and optional company, website and use case | To run your account, contact you about it, and prevent free-credit abuse | Until you delete your account |
| API keys: a one-way hash of each key, its name, prefix and limits | To authenticate requests. We cannot recover a key from the hash. | Until you delete your account |
| Agent configurations: name, prompts, model and voice settings, custom vocabulary, tool definitions, webhook URLs and signing secrets, and their version history | To run your agents exactly as you configured them | Until you delete the agent or your account |
Test users you create in the console: name, customer_id, variables and notes | To try your agents as different users in the Playground | Until you delete them, the agent or your account |
| Session and usage records: session and turn times, model, token and character counts, connected time, tool-call counts, latency, cost, status and errors. No conversation content. | To bill you, show usage and logs, and debug problems | days. Kept under ZDR too, because they contain no content. |
| Speech request logs for direct text-to-speech requests and voice previews: time, voice, character count, audio length, latency, cost, status, and the input text | So you can open a log entry and see exactly what you sent | days. Not written under ZDR. |
| Billing records: daily usage and cost totals per key, credit ledger, Stripe customer id, card brand and last four digits | To bill you accurately, issue refunds and meet accounting obligations | As long as required by tax and accounting law (typically 7 years), including after account deletion |
| Cloned voice profiles: an encrypted numeric voice profile derived from your recording and, for premium voices, an encrypted copy of the recording trimmed to at most 20 seconds of speech and resampled (the premium model speaks from a reference clip) | To speak in that voice | Until you delete the voice or your account |
| Consent records: the version and fingerprint of the voice cloning terms you accepted, the name you typed, the time, your browser user agent and a salted hash of your IP address | To show that cloning terms were accepted, and to respond to misuse reports | For the life of the account and up to 6 years after, for legal defense |
We never keep full card numbers (payments are handled entirely by Stripe), raw API keys (you see a key once, at creation), or the original files you upload to clone a voice (a reference clip is decoded in memory, turned into the encrypted profile and, for premium voices, the trimmed copy above, and the upload itself is discarded).
2. End User data (processed for developers)
| Data | What happens to it | How long |
|---|---|---|
| Voice audio streamed by the End User | Transcribed in memory and discarded. Never stored. | Not retained |
| Agent audio spoken to the End User | Streamed to the End User. If the connection drops, finished replies are held so they can be replayed on reconnect, in memory and, for long gaps, in private storage. | Deleted when the session ends, at most |
| Transcripts (what the End User said and what the agent replied, including tool calls and results) | Used as conversation memory so the agent can continue later, and shown to the developer | Per the agent's retention setting: none, 1, 7 (default), 30 or 90 days. Not stored under ZDR. |
| Conversation summaries (only if the developer turns on memory summaries) | A short rolling summary that lets the agent remember the gist of past conversations | Per the agent's summary retention setting, at most after the last activity. Not stored under ZDR. |
customer_id and session variables supplied by the developer | To link conversations to the same End User and fill in the agent's prompt | Same as the transcripts they belong to |
While a session is live, its working state (recent messages, buffered replies) is held in memory and in storage tied to that session, and is removed on the same schedule. Developers must use opaque customer_id values and not put email addresses, phone numbers or other direct identifiers in them.
Where End User data goes
- Language models. Transcripts and prompts are processed by AI models running on Cloudflare Workers AI to generate replies. Cloudflare does not use this data to train models.
- Speech. Speech recognition runs on Cloudflare, and the text of agent replies is turned into speech on Cloudflare (standard voices) or Fly.io (premium voices), in memory. Premium speech servers suspend themselves a few seconds after their last request; suspending saves their memory, which can include recently spoken text and cached voice data, to Fly.io storage until the server resumes, is replaced on our next software update, or is removed.
- The developer's systems. When an agent calls a tool or sends a webhook, the data the developer configured (for example tool arguments or a transcript at session end) is sent to the developer's own servers or app. What happens there is governed by the developer's privacy notice.
3. Zero data retention (ZDR)
Developers can turn on ZDR for their whole account or for individual API keys. With ZDR on, we store no transcripts, conversation summaries or speech request logs, and no input text; conversations are processed in memory and discarded when the session ends (subject to the premium speech server snapshots described above). Agents therefore start every ZDR session without memory of earlier conversations. We still record session and usage records (which contain no content) and daily usage and cost totals, because those are needed for billing.
4. How we use data
- To provide, secure and support the Service, including fraud and abuse prevention.
- To bill developers, have Stripe send payment receipts, and email developers about important account, billing, service or policy changes.
- To investigate credible reports of misuse, such as unauthorized voice cloning or illegal calls.
We do not sell or share personal data for advertising, and we do not use conversation audio, transcripts, summaries, prompts, replies, recordings or voice profiles to train or improve models. Our staff access content only when a developer asks for support, or when needed to investigate abuse, comply with law or secure the Service.
5. Service providers
We use the providers listed on our subprocessors page to run the Service: Cloudflare (hosting, API, AI models, speech, databases and storage), Fly.io (premium speech servers), Google (Firebase sign-in) and Stripe (payments). The sign-in provider you choose (Google or GitHub) shares your email and basic profile with us when you sign in. Each provider processes data only on our instructions. Data may be processed in the United States and other countries where these providers operate. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
6. Cookies and local storage
We use no advertising or analytics cookies. The console keeps your sign-in session in your browser's storage (managed by Firebase Authentication), and we store a small flag so the public pages can show a "Dashboard" link. Account creation and abuse reports use Cloudflare Turnstile, a privacy-preserving bot check.
7. Your rights
Depending on where you live (for example, under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete, export or restrict processing of your personal data, and to object to processing.
- Developers: correct your profile and delete your account on the Account page of the console. Deleting your account revokes all keys and deletes your agents, conversations, summaries, test users, cloned voices, logs and stored input text, and removes your profile details. We keep billing records and consent records as described above. View your usage and logs on the Logs page.
- End Users: contact the business whose agent you spoke with; they control your data and can erase it through our API. If you can't reach them, email us with as much detail as you can (the business name, the date and time of the conversation) and we will pass your request to them or help where the law requires.
Developers can erase a single conversation (DELETE /v1/conversations/{id}) or everything stored for one End User (DELETE /v1/customers/{customer_id}); erasure takes effect immediately. Deleting an agent deletes its stored conversations and summaries. Expired transcripts and summaries are purged automatically by a daily sweep.
For anything else, email . We respond within 30 days. You may also complain to your local data protection authority. Our legal basis for processing developer data is performance of our contract, our legitimate interests in securing the Service and preventing abuse, and compliance with legal obligations. We process End User data on the developer's instructions.
8. Security
Data is encrypted in transit (TLS) and at rest. Voice profiles are additionally encrypted with a key held only by the speech service. API keys are stored only as hashes, webhook payloads are signed, and conversations are isolated per account and per End User so one customer's agent cannot read another's data. No system is perfectly secure; if a breach affects your data, we will notify you (and developers will notify their End Users) as required by law.
9. Children
Developer accounts are for adults only. Developers who deploy agents that children may use are responsible for complying with children's privacy laws (such as COPPA) and must not knowingly send us children's personal data without the consent those laws require.
10. Changes
We will post updates here and email developers about material changes before they take effect.