Privacy by design: your conversations, your rules
At VOIZ, privacy is not an added layer—it is the foundation of our engineering. We safeguard every phone call under the strictest European regulatory framework.
Three fundamental principles of data protection
How we safeguard every phone call from the very first second:
Recording Disabled
We do not store audio recordings. Call audio is processed in real time to enable transcription and voice service delivery, but no persistent recording of the call is generated or retained.
Protection through de-identification and aggregation
Level 1 Immediate: Automatic de-identification of names, phone numbers, emails, or amounts prior to any analysis.
Level 2 Sector-level: Patterns used for industry intelligence are generated through a deterministic de-identification and aggregation protocol (N3) applied to transcripts. This process removes direct and indirect identifiers that could reasonably link the information to a specific individual, company, or conversation, consolidating solely aggregate industry-level patterns (k ≥ 20 conversations from at least 3 distinct companies).
Limited transcript retention
While the contractual relationship with the client remains active, VOIZ retains transcripts and logs necessary to deliver, maintain, audit, and technically enhance the service. Once the contract ends, transcripts are kept for a maximum period of 12 months and subsequently deleted in accordance with VOIZ deletion procedures.
Legal compliance in the European Union
Engineered to pass any enterprise corporate legal and security audit:
Binding DPA
Data Processing Agreement (DPA, Art. 28 GDPR) signed with strict legal delimitation of responsibilities.
Transparency
Transparent identification of the voice agent as an AI system during the initial greeting of each call, in compliance with Regulation (EU) 2024/1689.
EU-based Hosting
Proprietary VOIZ infrastructure hosted within the EU. Transfers to global technology providers rely on valid adequacy mechanisms (DPF, SCCs).
Lifecycle of a phone call
How data travels and is processed in every interaction:
Reception & Notice
The call connects; the agent identifies itself as an AI and discloses data processing pursuant to Art. 50 of the EU AI Act.
Call Processing
The agent handles the call; audio is processed in real time to perform transcription and voice response generation without persistent physical storage.
PII De-identification
Contact details are isolated, and direct identifiers are automatically replaced prior to any technical analysis.
Retention & Erasure
Transcripts are retained during service duration and up to a maximum of 12 months post-contract termination, after which they are permanently deleted.
Legal Grounds for Continuous Auto-Improvement
How our system optimizes voice agents while strictly adhering to European and Spanish regulatory frameworks:
Private Layer: Dedicated Client Optimization
Analysis and optimization of each client's agent are contractually grounded in the Data Processing Agreement (DPA) signed with your company, focused solely on the proper delivery of the entrusted service:
- Data Minimization (Art. 5.1.c GDPR): Prior de-identification of personal data (N1) before technical analysis stages.
- Environment Isolation: Independent client data repositories (and segregated databases with Row Level Security on advanced plans), preventing cross-company access.
- Limited Retention (Art. 17 GDPR): Scheduled purging of transcripts 12 months after contract termination, or early deletion upon client request.
Industry Layer: Deterministic N3 Anonymization
Under Clause 6.3 of the DPA (pursuant to Art. 28.3.a and Recital 26 of the GDPR), the Client authorizes VOIZ.ES to apply irreversible N3 anonymization to consolidate general market statistics:
- Aggregation Threshold: Patterns are extracted only when consolidated across k ≥ 20 conversations originating from at least 3 distinct business clients.
- Identifier Stripping: Direct removal of names, phone numbers, emails, tax IDs, addresses, or specific amounts.
- Non-Personal Data: Being strictly anonymous and statistical data (Recital 26), it is legitimately utilized to enrich baseline industry models.
Technical Supervision & Control Guardrails
Full compliance with transparency, quality, and technical governance obligations for AI systems under Regulation (EU) 2024/1689:
- Transparency by Design (Art. 50): Clear identification of the agent as an AI virtual assistant in the initial greeting of every call.
- Containment Guardrails: Pricing, catalog, and commercial terms are hard-bounded by code to the knowledge base verified by your company.
- Traceability & Version Control: Auditable log of every optimization with agile rollback capabilities for any adjustment.
Human Operator Transfer Protocol
Ensuring full compliance with consumer rights regarding requests for assistance from a human representative during telephone communication:
- Intent Detection: Predefined code trigger that promptly recognizes any request to speak with a human operator.
- Seamless Routing: Immediate transfer to the designated telephone line or priority callback request registration.
- Unalterable Rule: The handover protocol remains permanently active and protected regardless of agent model adjustments.
Frequently Asked Questions about Privacy and Security
We safeguard your business information with full transparency and regulatory rigor:
No. Audio recording is disabled by default across all plans. Voice is processed strictly in volatile memory in real time solely to generate text transcription and the call business report, without storing persistent physical audio files.
Only your team has access to your leads and conversations. Information is delivered directly to your own repositories (Google Sheets or email in standard tiers) or managed in databases featuring dedicated isolation policies (Row Level Security in Pro and Enterprise plans), ensuring that no unauthorized third party can access your data.
No. We operate exclusively through enterprise API connections under strict zero-data-retention and no-training policies. Your conversations are never used to train third-party public models. Any industry-level learning is conducted exclusively on anonymous, irreversible statistical patterns (pursuant to Recital 26 of the GDPR).
The agent transparently introduces itself as an AI virtual assistant in the opening greeting. If the user asks to speak with a human agent, the system routes the call to your designated team line or logs the request so you can follow up with top priority.
Certainly. You can request data erasure or export at any time. Following contract termination, operational call transcripts are retained for a maximum period of 12 months and subsequently deleted according to VOIZ erasure protocols, except for records required to satisfy mandatory legal obligations.