How Vosy LLC collects, uses, and protects personal information · Last updated: August 11, 2026
Vosy LLC, a Nevada limited liability company ("Vosy," "we," "us," or "our"), operates the Vosy AI voice-agent platform, including the websites, dashboard, APIs, and related services available at vosy.ai (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Service. By accessing or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Service. Capitalized terms not defined here have the meanings given in the Vosy Terms of Service or, if applicable, your Enterprise Agreement with Vosy.
This Privacy Policy is written for our business customers — the organizations and individuals who register for and use the Service to build and operate AI voice agents ("Customers," "you") — and for visitors to our websites. It describes how Vosy handles:
This policy is not a substitute for the notices and consents that Customers must provide to the individuals their agents call ("Call Recipients"). As described in Sections 4 and 6, the Customer is solely responsible for those notices and consents. If you are a Call Recipient with questions about a call you received, please contact the business that operated the agent; Vosy processes that data on the business's behalf.
"Customer Content" means the data a Customer submits to or generates through the Service, including agent prompts, uploaded knowledge documents, contact lists, extraction schemas, call recordings, transcriptions, voice data, and extracted information.
"Call Recipient" means an individual who places a call to, or receives a call from, a Customer's agent through the Service.
"Message Recipient" means an individual who sends a text message to, or receives a text message from, a number a Customer uses with the Service. Where this policy describes Vosy's role with respect to Call Recipients, the same role and the same limits apply to Message Recipients.
"Personal Information" means information that identifies, relates to, or could reasonably be linked with a particular individual or household, as defined under applicable U.S. state privacy law.
"Sensitive Personal Information" means the subset of Personal Information treated as sensitive under applicable law, including the contents of communications and biometric information processed to identify an individual. Voice recordings processed by the Service are treated with heightened care as described in this policy.
We may receive information from service providers (such as payment processors), from carriers and telephony providers (such as number-registration and traffic data), and from publicly available business sources.
For purposes of the CCPA/CPRA and similar state laws, in the preceding 12 months we have collected the following categories of Personal Information, from the sources and for the purposes described in this policy: identifiers (name, email, phone number, IP address, account identifiers); commercial information (subscription, billing, and transaction records); internet and network activity (usage, log, and device data); approximate geolocation derived from IP address; audio and electronic information (call recordings and transcripts, processed as a service provider on Customers' behalf); and professional information (business name and role). We do not collect government identifiers, precise geolocation, or biometric identifiers, and we do not use Personal Information to draw inferences for profiling in furtherance of decisions with legal or similarly significant effects. We retain each category for the periods described in Section 8. We do not sell or share any category of Personal Information, and we have not done so in the preceding 12 months. We collect and use Sensitive Personal Information (the contents of communications processed through the Service) only to provide the Service as requested, to ensure security and integrity, and for other purposes permitted by applicable law without a right to limit; we do not use it to infer characteristics about individuals.
When a Customer's agent places or receives a call, the Service processes the call audio in real time (speech-to-text, language-model processing, and text-to-speech) and, depending on the Customer's configuration, may record the call, generate a transcript, and extract structured information. This call data is Customer Content. Vosy processes it solely on the Customer's behalf and instructions, to provide, secure, support, and maintain the Service, to prevent fraud and abuse, and to comply with law. Vosy does not use call data for advertising and does not sell it.
The Customer — not Vosy — determines the purposes of processing: the Customer decides whom its agents contact, the purpose and content of each call, what information is collected from Call Recipients, which prompts, scripts, and AI models are used, and, where configurable, what retention and integration settings apply. Vosy's role is limited to processing that data as the Customer's service provider, pursuant to the Customer's configurations and instructions.
The third-party AI providers that power the Service (speech-to-text, text-to-speech, and large-language-model providers) operate processing infrastructure only: they acquire no ownership of Customer Content, their processing is temporary and solely to deliver the requested function, and, pursuant to Vosy's agreements and configurations with them, they may not use Customer Content to train their models. Vosy does not make, and the Service is not used by Vosy to make, decisions producing legal or similarly significant effects concerning any individual; whether and how to act on any information is determined by the Customer. Content generated by the Service is not treated as Personal Information except to the extent it identifies or is reasonably linkable to an individual, in which case it is handled as described in this policy.
No biometric identification. Vosy does not create voiceprints or other biometric identifiers, and does not use voice recordings or any other data to identify or authenticate individuals. Voice audio is processed solely to transcribe and conduct the conversation the Customer has configured. Customers are contractually prohibited from using the Service to create biometric identifiers or to collect "consumer health data" as defined under the Washington My Health My Data Act, Nevada SB 370, and similar laws, and the Service is not intended for those uses.
Customers are solely responsible for the legality of their calls, including providing any legally required notices that a call is automated or AI-generated, obtaining consent to call and to record (including in all-party consent states), honoring Do-Not-Call requests, and providing any required privacy notices to Call Recipients. Privacy and consumer-protection laws governing AI systems and automated communications continue to evolve, and Customers remain responsible for ensuring their use of the Service complies with applicable law as it changes.
Text messages. Where a Customer's Plan includes messaging, the Service also sends and receives SMS and MMS messages on the Customer's behalf. The message body, the sending and receiving numbers, and the delivery status are Customer Content and are processed on the same service-provider basis described above: the Customer decides whom to message, what the message says, and how often, and Vosy processes that data on the Customer's instructions. Vosy does not use message content for advertising, does not sell it, and does not use it to train or fine-tune AI models (Section 6). Vosy is not the sender of a Customer's messages — if you received a text message you did not expect, the business that operated the messaging program is the party responsible for it, and Section 13 explains what you can do.
Opt-out register. To honor STOP requests, the Service maintains a per-organization opt-out register. When a recipient replies STOP (or an equivalent keyword) to a Customer's number, we record that the number is opted out of that organization's messages, together with an encrypted copy of the number, a keyed hash of the number used only to match future sends, the number's last four digits, the keyword received, how the opt-out was received, and the time. We use this record for one purpose: to block further messages from that organization to that number. It is not used for marketing, is not shared with other Customers, and — because it is what prevents unwanted messages from resuming — survives a deletion request in the reduced form described in Section 8. Because the register is scoped to one organization, an opt-out recorded for one Vosy Customer does not opt you out of messages sent by a different Vosy Customer.
Vosy does not use Customer Content — including call recordings, transcriptions, voice data, prompts, or knowledge documents — to train, fine-tune, or improve any artificial-intelligence or machine-learning models, whether ours or a third party's. We contractually restrict the AI providers that power the Service from using data submitted through the Service to train their models.
We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising. We disclose Personal Information only as follows:
California "Shine the Light" (Civil Code § 1798.83): we do not disclose Personal Information to third parties for those third parties' own direct-marketing purposes.
We retain Personal Information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Specifically: call recordings (audio) are automatically and permanently deleted 30 days after creation on a Service-wide basis; transcripts and call records are retained for the life of the Customer's account; and Customers may request earlier deletion of specific recordings, transcripts, or call data by written request to contact@vosy.ai. Following account closure, Customer Content is deleted or de-identified within 90 days, except for backup copies deleted in the ordinary course and records we must retain for legal, security, or billing purposes. Automatic deletion schedules may be suspended for specific data when and to the extent required by law or legal process, including litigation holds, subpoenas, governmental or regulatory investigations, fraud investigations, and security-incident response; suspended data is retained only for the duration and purpose of the hold. Account and billing records may be retained as required by tax and accounting law.
Text messages and opt-out records. Message records are retained for the life of the Customer's account as part of the Customer's message history and billing record. Where we act on a deletion request covering a phone number, the message record is anonymized rather than removed — the number and the message text are stripped and the remaining row is kept as the record that a message was sent — and the opt-out record is reduced rather than removed: the encrypted number and its last four digits are deleted, and only the one-way hash the Service matches against, plus the opt-out status and timestamp, are kept. We keep that much on purpose. A suppression record is the mechanism that stops messages; deleting it would let a business that you told to stop messaging you begin messaging you again, so erasure must not undo an opt-out. If you want an organization's messages to stop, ask us to suppress the number rather than to erase it — suppression is the outcome that actually protects you.
We use administrative, technical, and physical safeguards designed to protect Personal Information, including encryption in transit, access controls, and monitoring. No security system is impenetrable, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Customers are responsible for securing their own credentials, API keys, integrations, connected systems, and endpoint devices, and for maintaining appropriate access controls within their organizations, including for their Authorized Users. If a security incident affects Personal Information, we will assess and respond to it, and provide any notifications, as required by applicable law and our contractual commitments, within the timeframes those require or, where none apply, within a commercially reasonable time.
Depending on your state of residence, you may have rights under applicable U.S. state privacy laws — including the California Consumer Privacy Act as amended (CCPA/CPRA) and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Indiana, Kentucky, Maryland, Minnesota, Rhode Island, and other states as they take effect — such as the right to know/access, correct, and delete Personal Information, the right to data portability, the right to opt out of targeted advertising, profiling in furtherance of significant decisions, and the sale or sharing of Personal Information (Vosy does not sell or share Personal Information, does not engage in cross-context behavioral advertising, and does not profile individuals in furtherance of decisions producing legal or similarly significant effects), and the right not to be discriminated against for exercising your rights.
To exercise rights, email contact@vosy.ai with the subject line "Privacy Request." We will verify your request using your account information and respond within the time required by law. We may deny requests we cannot verify, requests that are manifestly unfounded, excessive, or repetitive (or charge a reasonable fee where the law permits), and requests where an exception applies (such as legal-compliance, security, or fraud-prevention retention); if we deny a request in whole or part, we will explain why. You may use an authorized agent where the law permits, subject to verification. If we decline to act on your request, you may appeal by replying to our decision or emailing contact@vosy.ai with the subject line "Privacy Appeal" within a reasonable time; we will respond to appeals within the period your state's law requires, and if your appeal is denied you may contact your state Attorney General. If your request concerns call data processed on behalf of one of our Customers, we will refer you to, or forward your request to, that Customer, and will assist the Customer as required by law and our agreement with them.
Because we do not sell or share Personal Information, opt-out preference signals such as the Global Privacy Control do not change how we process your data; we will honor such signals as legally required if our practices change. Our websites do not respond to browser "Do Not Track" signals, for which no standard has been adopted.
The Service is a business tool intended for users 18 and older. We do not knowingly collect Personal Information from anyone under 18, and Customers are prohibited from directing agents at children or knowingly collecting information from individuals under 18. If you believe a person under 18 has provided Personal Information to us, contact us at contact@vosy.ai and we will delete it.
The Service is offered only in the United States (meaning the 50 states, the District of Columbia, and the U.S. territories), and information we collect is stored and processed in the United States. If you access the Service from outside the United States, you do so at your own initiative and consent to processing in the United States. The Service is not directed to individuals in the European Economic Area, the United Kingdom, or any other foreign jurisdiction, and nothing in this policy is intended to create obligations under, or evidence applicability of, the GDPR, the UK GDPR, or any other foreign privacy regime.
If you received a call from, or placed a call to, an AI agent operated through the Service, the business that operated that agent — not Vosy — decided to contact you, determined what information to collect, and controls that data. Vosy processes call data solely as that business's service provider. For questions about the call, to opt out of future calls, or to exercise privacy rights with respect to the call, please contact that business directly. If you contact us, we will forward your request to the relevant business where we can identify it, and we will assist as required by law. Vosy is not responsible for the calling practices, disclosures, or consent practices of the businesses that use the Service, which are contractually required to comply with all applicable laws.
If you received a text message. The same is true of text messages: the business that runs the messaging program chose to message you, wrote the message, and decides how often it sends. Vosy transmits the message on that business's behalf and is not the sender.
How to stop the messages. Reply STOP to the message. You may also reply STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, or REVOKE — any of them works. We record the opt-out and that business's messages to your number stop. You will normally get one final confirmation reply and nothing after it; the confirmation is a courtesy and is not always delivered, but the opt-out itself is recorded either way, so the absence of a confirmation does not mean your STOP was missed. Reply START (or YES, UNSTOP, or OPTIN) if you later want the messages again. Reply HELP (or INFO) for help information; HELP does not change whether you are opted out. These replies are handled automatically; Vosy does not charge you anything for them, though your carrier's normal rates still apply.
What to expect. Message frequency varies and is set by the business that messages you, not by Vosy. Message and data rates may apply — those are charged by your mobile carrier, not by Vosy. Carriers may also delay, filter, or block messages, so we cannot guarantee any message is delivered.
If STOP does not work. An opt-out applies to the business that messaged you; it does not opt you out of messages from other businesses that happen to use Vosy, and it does not affect calls. Not every number can receive replies — if you replied STOP and the messages continue, or you cannot reply at all, email contact@vosy.ai with the subject line "Stop Messages" and the number that messaged you and the number you received it on, and we will suppress it and refer your request to the business responsible.
The Service and our websites may link to or interoperate with third-party sites and services, including BYOC carriers, BYOK providers, and integration destinations Customers configure. When a Customer connects or configures a third-party integration, the Customer authorizes the transmission of the associated data to that third party and assumes responsibility for evaluating and selecting that provider; the third party's handling of the data is governed by the Customer's relationship with it, and Vosy is not responsible for the security, privacy practices, or acts or omissions of any third-party service. This policy does not apply to third parties. We encourage you to review the privacy policies of any third-party service you use.
Any dispute arising out of or relating to this Privacy Policy or our data practices is governed by the dispute-resolution provisions of the Vosy Terms of Service (or, for Enterprise customers, the Master Services Agreement), including the requirement of informal resolution, binding individual arbitration, the class action waiver, the one-year claims period, Nevada governing law, and Placer County, California venue, each to the maximum extent permitted by law.
We may update this Privacy Policy from time to time. Material changes will be announced by email, in-product notice, or by posting the updated policy with a revised "Last Updated" date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
Vosy LLC — Attn: Privacy
885 Tahoe Blvd STE C7, Incline Village, NV 89451
contact@vosy.ai