1. Who we are
Voicematrix.ai ("Voicematrix", "we", "us") is the data controller for personal data collected through our website and platform. You can reach our Data Protection Officer at dpo@voicematrix.ai.
2. Data we collect
- Account data: name, work email, hashed password, organisation, role.
- Usage data: dashboard interactions, feature usage, device and browser metadata, IP address.
- Voice data (controller for our customers' end-users): call audio, transcripts and metadata processed on behalf of our customers under the DPA.
- Billing data: processed by our payment provider; we receive only the last four digits of the card and invoicing metadata.
- Support correspondence: messages you send to hello@voicematrix.ai or via in-app chat.
3. How we use your data
- Provide, secure and improve the platform (lawful basis: contract, legitimate interest).
- Send service emails — security alerts, billing, product updates (contract, legitimate interest).
- Send marketing emails only with your opt-in consent — and you can withdraw at any time.
- Comply with legal obligations (tax, audit, lawful requests).
4. Sharing & sub-processors
We share data only with vetted sub-processors required to operate the platform (cloud hosting, email delivery, error monitoring, payments). A live list is at our DPA page. We do not sell personal data — ever.
5. International transfers
Personal data may be processed in the EU/EEA, the UK and the US. Where data leaves the EEA we rely on the EU Standard Contractual Clauses (SCCs), the UK IDTA, and equivalent safeguards.
6. Retention
We keep account data while your account is active and for up to 24 months after deletion to honour legal and accounting obligations. Voice data is retained according to the customer's chosen retention setting (default: 30 days).
7. Your rights
Under GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to lodge a complaint with your supervisory authority.
To exercise any right, email privacy@voicematrix.ai. We respond within 30 days.
8. Security
We follow SOC 2 Type II controls and the ISO 27001 framework. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). See our Security page.
9. Children
The platform is not intended for individuals under 16 and we do not knowingly collect their data.
10. Changes
We will post material changes here and email account owners at least 30 days before they take effect.