Last updated May 25, 2026
This Privacy Policy describes how VoiceCraft Inc. (“VoiceCraft,” “we,” “us,” or “our”) collects, uses, and discloses personal data through our website and when you create an account with us.
When VoiceCraft acts as a data processor on behalf of a business customer (for example, when a caller speaks with that business's AI receptionist), the business is the data controller for the caller's personal data. In that role, this Privacy Policy does not govern how the business collects or uses caller data. Please refer to the relevant business's privacy policy. VoiceCraft's processing obligations to its business customers are set out in our Data Processing Addendum at /dpa.
We collect the following categories of information:
Name, email address, and password. Passwords are stored using a one-way hashing function. We never store your password in plain text.
IP address, user agent string, device information, and geolocation derived from IP are captured on authentication events including signup, login, logout, password reset, and OAuth connection. This data is retained for compliance and fraud detection.
Business name, operating hours, services offered, agent configuration, greeting preferences, tone settings, escalation rules, and transfer phone number that you provide when setting up your AI voice agent.
Caller phone numbers, call duration, call outcome, call transcripts, and AI-generated call summaries.
Client names, phone numbers, scheduled appointment times, and the type of service booked.
Phone numbers, names, email addresses, and any notes added to contacts. We also track call frequency and last contact date to help you manage client relationships.
SMS message content sent on behalf of businesses to their customers, as well as WhatsApp message content and conversation history.
Order items, quantities, totals, customer-provided contact details, and order status transitions when the voice-commerce feature is enabled.
Responses submitted through forms you create and publish via VoiceCraft, including any fields you define.
Files you upload to the knowledge base are stored in Cloudflare R2. Files are subject to plan-level storage quotas.
Conversations you have with the AI builder tool when setting up or configuring your voice agent.
IP address, browser type, and device information collected automatically when you use our website.
We use your information to:
VoiceCraft does not use Customer Content to train, retrain, or fine-tune any AI or machine-learning models. We require the same commitment from our AI sub-processors, including Anthropic, Google, and OpenAI. Customer Content includes call recordings, transcripts, builder conversations, message bodies, and any business configuration you provide.
VoiceCraft uses artificial intelligence to power voice agents, process conversations, and generate agent configurations. Your business information and call conversations are processed by third-party AI providers to deliver these features. Your information is used solely to provide the service to you.
AI-generated responses and configurations may not always be accurate. You are responsible for reviewing your agent's setup before deploying it to handle live calls.
Each call's system prompt sent to the voice agent's language model includes: the business name, agent name, services offered, operating hours, timezone, escalation rules, and the transfer phone number if configured. This context is required for the AI to respond accurately on behalf of the business.
VoiceCraft does not include caller PII in system prompts beyond what the caller voluntarily disclosed during the same call session.
Inbound calls to your VoiceCraft phone number are handled by an AI voice agent. Call audio is processed in real-time for speech recognition and response generation. Callers interact with an AI assistant, not a human.
You are responsible for complying with applicable call recording and consent laws in your jurisdiction. Some US states require the consent of all parties to a call before it may be recorded or monitored.
VoiceCraft sends automated SMS messages on behalf of businesses to their customers. This section explains how phone numbers are collected, how consent is obtained, and how mobile numbers are handled.
SMS messages are sent only to customers who have provided explicit verbal consent during an inbound phone call handled by a VoiceCraft AI agent. After completing a booking or fulfilling a customer request, the AI agent asks: “Can I send that to your phone by text message? You'll receive appointment-related messages. Message and data rates may apply. Reply STOP to unsubscribe.” No SMS is sent unless the customer verbally confirms. The complete consent process, including the exact script and technical safeguards, is documented at /sms-consent.
The mobile phone number used to deliver SMS is the same number the customer used to place the inbound call, captured via caller ID. We do not send SMS to any number other than the originating caller's number without that caller's explicit consent.
Mobile phone numbers collected for SMS purposes are not sold, rented, leased, or shared with any third party for marketing, advertising, or any purpose other than delivering the messages the customer consented to receive. Phone numbers are transmitted to Twilio solely as a delivery mechanism. Twilio acts as a service provider, not as a co-marketer or data broker.
Message frequency varies. Customers typically receive 1 to 4 messages per appointment cycle (booking confirmation, reminder, and any information they requested during the call). Message and data rates may apply.
Customers may opt out of SMS messages at any time by replying STOPto any message. After opting out, no further SMS messages will be sent from that business's number. Customers may re-subscribe at any time by replying START or YES.
VoiceCraft supports WhatsApp Business messaging for appointment reminders, booking confirmations, order updates, and replies to customer-initiated conversations.
WhatsApp messaging is inherently opt-in. Either the customer initiates the conversation directly, or the business contacts them within the 24-hour session window or via a pre-approved Meta message template after obtaining explicit prior consent. VoiceCraft does not send WhatsApp messages to numbers that have not engaged with the business or provided consent.
Customers may reply STOP at any time. The platform stops sending further messages from that business once an opt-out is received.
Messages sent outside the 24-hour session window use Meta-approved message templates (UTILITY category) for appointment reminders, booking confirmations, and order updates.
WhatsApp messages are routed through Twilio as the Business Solution Provider. Each customer business is onboarded with its own WhatsApp Business Account via Meta Embedded Signup. VoiceCraft does not share WhatsApp Business Accounts across customers.
WhatsApp phone numbers are not sold, rented, or shared with any third party for marketing purposes.
We share personal data with carefully selected third-party service providers (sub-processors) that help us deliver the service. These providers act on our instructions and are bound by written contracts with appropriate security and confidentiality safeguards.
Categories of sub-processors include:
A complete, current list of our sub-processors, including the data they process and their location, is available at /subprocessors. We provide at least 30 days advance notice of new sub-processors via email to organization owners.
VoiceCraft does not, and contractually requires sub-processors not to, train AI or machine-learning models on Customer Content.
We maintain appropriate physical, technical, and administrative measures designed to protect personal data from unauthorized access, use, disclosure, alteration, or destruction. These include encryption of data in transit and at rest, access controls based on the principle of least privilege, multi-tenant isolation at the application layer, signed-URL access to stored recordings, audit logging of sensitive operations, and webhook signature verification for all inbound integrations.
Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. While we apply industry-standard controls, we cannot guarantee absolute security. For a more detailed overview of our security architecture, see /security.
We retain your personal data only for as long as reasonably necessary to provide the service and fulfill the purposes set out in this Privacy Policy. We may retain it longer where required for legal, tax, or accounting purposes; fraud prevention or dispute resolution; security investigations; or to enforce our agreements.
For details on specific retention windows for call recordings, transcripts, and other product-specific data, see our Data Processing Addendum at /dpa or contact privacy@voicescraft.app.
You may request deletion of your data at any time (see Your Rights and Choices).
You have the right to:
Contact us at privacy@voicescraft.app to exercise these rights. We will respond within 30 days.
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
To exercise these rights, contact us at privacy@voicescraft.app.
VoiceCraft is a business tool and is not directed at individuals under 18. We do not knowingly collect personal information from children.
VoiceCraft is operated from the United States. Your data is processed and stored in the United States. By using the service, you consent to the transfer and processing of your data in the United States.
We may update this policy from time to time. Material changes will be communicated via email to your registered address.
The “Last updated” date at the top of this page will reflect the most recent revision. Continued use of the service after changes constitutes acceptance.
For privacy questions or to exercise your rights, contact us at: