Privacy Policy

1. Who we are

This Privacy Policy describes how Mengary LLC (“we”, “us”, or “our”) collects, uses, stores, and shares information when you use the VoiceAgent website, dashboard, APIs, and related services (the “Service”).

VoiceAgent is a multi-tenant platform operated by Mengary LLC for building and operating AI voice agents. Account holders configure agents, phone numbers, knowledge bases, tools, and third-party integrations. Callers who interact with those agents may have their voice, phone number, and conversation content processed as described below.

Contact for privacy questions: sales@voiceagent.chat.

2. Scope

This Policy applies to:

• Visitors to our marketing site and authenticated dashboard users (“Customers”).
• End users who call or are called by agents configured on the Service (“Callers”), to the extent their data is processed through our systems.

Customers are typically the controllers of Caller data they collect through their agents. We process that data on Customers’ behalf to provide the Service. Customers are responsible for providing appropriate notices and obtaining any required consents from Callers under applicable law.

3. Information we collect

3.1 Account and profile information

When you register or manage an account, we collect:

• Name and email address
• Password (stored only as a one-way hash; we do not store plaintext passwords)
• Optional profile picture, if you provide one
• Account identifiers (such as internal user IDs and API keys we generate for your account)

3.2 Agent configuration and content you upload

To run voice agents, we store configuration and content you create, including:

• Agent name, description, system prompts, first messages, language, LLM, timezone, and voice settings
• Knowledge base materials (files, URLs, or text you upload) and related metadata
• Custom tools (names, descriptions, webhook URLs, parameter schemas, headers you configure)
• Phone numbers linked to your account and which agent they are assigned to

3.3 Call and conversation data

When an agent handles a call or conversation, we process and may store:

• Caller and destination phone numbers (or other channel identifiers)
• Call status, start/end times, and duration
• Conversation transcripts (what the agent and caller said, turn by turn)
• Call audio recordings, when available (stored on our infrastructure under your account’s data directory)
• Technical metadata (e.g. latency metrics, language detection, agent version)
• Analysis or summary fields produced by the voice stack (when enabled by the provider)
• Usage/cost-related metrics associated with conversations for billing and analytics in the dashboard
• Tool call inputs/outputs generated during a conversation (for example, booking parameters an agent sends to a scheduling tool)

3.4 Third-party integration credentials and profile data

If you connect external apps, we store credentials and profile details needed to operate those integrations on your behalf:

• Calendly: personal access token (encrypted at rest), and account name/email/URI returned by Calendly when you connect
• Google Calendar: OAuth access and refresh tokens (encrypted at rest), Google account email/name/ID, granted scopes, and token expiry; used to check availability and create calendar events when your agent uses those tools
• Airtable: personal access token (encrypted at rest), the scopes you grant on that token (typically data.records:read, data.records:write, and schema.bases:read), account email/ID returned by Airtable when you connect, and the default base and table you select; used to look up and update records when your agent uses those tools
• Salesforce: OAuth access and refresh tokens (encrypted at rest), Salesforce user email/name/ID, instance URL, organization ID, granted scopes, and token expiry; used for contact lookup and activity when your agent uses those tools

We do not sell integration credentials. Tokens are used only to call the relevant provider APIs for your account.

3.5 Technical and usage data

• IP address, browser type, device information, and approximate location derived from IP (as provided by hosting/analytics)
• Pages viewed, referring URLs, and interaction events on the website/dashboard
• Authentication session data and security logs
• Language preference and UI preferences (e.g. theme, sidebar state)

3.6 Communications

If you contact us or if the Service sends transactional messages (for example, booking-related emails when a scheduling tool is used), we process the content of those communications and the email addresses involved.

4. How we use information

We use information to:

• Provide, operate, and maintain the Service (agents, calls, tools, dashboard)
• Authenticate users and secure accounts
• Sync agent configuration, tools, knowledge, and phone routing with voice and telephony providers
• Display conversation history, audio, analytics, and usage statistics to the Customer who owns the account
• Execute Customer-configured tools (scheduling, webhooks, etc.) during calls
• Send transactional emails related to the Service when enabled
• Improve reliability, debug issues, and monitor abuse or security incidents
• Comply with legal obligations and enforce our terms

We do not sell personal information. We do not use Caller audio or transcripts to train our own foundation models independent of providing the Service, except as described under third-party providers (who may process data under their own terms when you use their APIs).

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use Google user data to create, train, or improve generalized or foundational AI models, and we do not transfer that data to any AI provider for that purpose.

5. Legal bases (EEA/UK where applicable)

Where GDPR/UK GDPR applies, we process personal data on these bases:

• Contract: to provide the Service you sign up for
• Legitimate interests: security, product improvement, fraud prevention, and service analytics (balanced against your rights)
• Consent: where required (e.g. certain cookies/analytics, or optional marketing if we offer it)
• Legal obligation: when we must retain or disclose data under law

For Caller data processed for a Customer, the Customer typically determines the legal basis for collecting that data (e.g. legitimate interest in handling business calls, or consent for recording where required).

6. How we share information

We share data with subprocessors and service providers only as needed to run the Service:

We may also disclose information if required by law, regulation, legal process, or governmental request; to protect rights, safety, and security; or in connection with a merger, acquisition, or asset sale (with appropriate safeguards).

Customer tool webhooks that you configure may receive parameters your agent sends during a call (including Caller-provided data). Those destinations are controlled by you, not by us.

7. International transfers

We and our providers may process data in the United States, the European Union, and other countries where infrastructure is located. Where required, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) or provider terms that support lawful transfers. Your use of global providers (e.g. voice AI, Google, Calendly, Airtable, Salesforce) may involve processing outside your country of residence under those providers’ policies.

8. Security

We implement technical and organizational measures designed to protect personal data, including:

• Encryption of integration secrets (e.g. Calendly/Airtable tokens, Google/Salesforce OAuth tokens) at rest using application-level encryption with integrity checks
• Hashed passwords
• Authenticated API access (session/JWT) and multi-tenant isolation so one Customer’s data is not exposed to another via normal application logic
• HTTPS for data in transit to our public endpoints
• Access controls on production infrastructure

No method of transmission or storage is 100% secure. You are responsible for keeping account credentials confidential and for configuring integrations and tools appropriately.

9. Data retention

• Account data: retained while your account is active and for a reasonable period afterward for backups, disputes, or legal requirements
• Conversations, transcripts, audio, and analytics: retained so you can review history in the dashboard until you delete them (where deletion is available) or close your account, subject to backup cycles and legal holds
• Knowledge base files: retained until you remove them or delete your account
• Integration credentials: retained until you disconnect the integration or delete your account; disconnecting removes stored tokens and associated auto-created tools where the product supports that cleanup
• Logs and security records: retained for operational and security periods that we periodically review

Third parties (ElevenLabs, Twilio, Calendly, Google, etc.) may retain data according to their own retention policies after we send it to them.

10. Cookies and similar technologies

We use cookies and local storage for:

• Essential: authentication/session so you stay signed in; security
• Preferences: language (e.g. locale cookie), theme, and UI state (e.g. sidebar)
• Analytics/performance: Vercel Analytics and Speed Insights may collect aggregated usage and performance data on the web app. ChatGPT Ads measurement (OpenAI pixel) may record conversion events such as checkout started so we can attribute ads in ChatGPT

You can control cookies through your browser settings. Blocking essential cookies may prevent sign-in or core dashboard features from working.

11. Your rights and choices

Depending on your location, you may have rights to:

• Access personal data we hold about you
• Correct inaccurate data
• Delete data (subject to legal exceptions)
• Export/port data
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority

Customers can update much of their account and configuration data in the dashboard. To request account deletion or exercise privacy rights, contact sales@voiceagent.chat. We may need to verify your identity before fulfilling requests.

Callers should contact the Customer (business) they spoke with for rights requests about that Customer’s agents; we will assist Customers as required by applicable law and our agreements.

12. Children

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

13. Call recording and Caller notice

Voice conversations may be transcribed and recorded so Customers can review quality, train their own processes, and use tool outputs. Recording and monitoring laws vary by jurisdiction (including one-party vs. two-party consent rules). Customers are responsible for lawful notice and consent to Callers before recording or monitoring calls, and for configuring agent scripts/prompts accordingly.

14. Third-party services and links

The Service integrates with and links to third-party products. Their privacy practices are governed by their own policies. We encourage you to review:

• ElevenLabs Privacy
• Twilio Privacy
• Calendly Privacy
• Airtable Privacy
• Salesforce Privacy
• Google Privacy
• Vercel Privacy

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Material changes may be communicated by email or an in-product notice when appropriate. Continued use of the Service after an update constitutes acceptance of the revised Policy, except where applicable law requires otherwise.

16. Contact

For privacy requests or questions about this Policy:

Mengary LLC
Product: VoiceAgent
Email: sales@voiceagent.chat
Website: https://www.voiceagent.chat