Home / Privacy Policy

Privacy Policy

How WhautoVoice collects, uses, discloses, protects and retains personal data, including the call recordings, transcripts and provider credentials that pass through the platform.

Last updated: 15 September 2026

Introduction
Our role: controller and processor
How we collect personal data
Types of personal data we collect
How we use personal data
Call recordings, transcripts and AI processing
Who we disclose personal data to
Consent, withdrawal and cookies
Accuracy
Security
Retention
Access and correction
Deletion
International transfers
Children
Contacting us
Changes to this notice

1. Introduction

WhautoVoice is operated by The Clinic Place Pte. Ltd, a company incorporated in Singapore ("WhautoVoice", "we", "us"). We respect the privacy and confidentiality of the personal data of our customers, their team members, the people who call or are called through our platform, and everyone else we interact with while providing our services.

We are committed to policies, practices and processes that safeguard the collection, use and disclosure of personal data in compliance with the Singapore Personal Data Protection Act 2012 (PDPA). Where our customers serve people in the European Economic Area or the United Kingdom, we also support their obligations under the GDPR and UK GDPR, as described below.

This notice explains how we collect, use, disclose, process, protect and retain personal data in our possession or under our control.

2. Our role: controller and processor

WhautoVoice handles personal data in two capacities:

As a controller of the data of our customers and their users: the account owner, team members invited to a workspace, billing contacts and website visitors. We decide how this data is used, as set out in this notice.
As a processor of the data of our customers' end users: the people who call our customers' phone numbers or are called by them, the contacts our customers import, and the recordings and transcripts of those calls ("Call Data"). Our customer is the controller of Call Data and decides what is collected, whether calls are recorded, how long it is kept and who may access it. We process Call Data only on the customer's instructions, which are given through the settings of the platform and our Terms & Conditions.

If you are a caller and have a question about how a business that uses WhautoVoice handles your data, please contact that business directly. We will assist them in responding.

3. How we collect personal data

Personal data is any information that can identify an individual, on its own or combined with other information. We collect personal data when you:

Create an account or are invited to a workspace on WhautoVoice
Connect a telephony provider account or an AI engine account (OpenAI, xAI, ElevenLabs or Sarvam) to a workspace
Purchase, import or configure phone numbers, AI voice agents, call flows, queues or campaigns
Make or receive calls through the platform, or are a party to such a call
Import contacts or receive them through our API or integrations
Contact us by email, our help centre, or a demo booking
Visit our website, which uses cookies and analytics as described in section 8
Respond to marketing emails we send

4. Types of personal data we collect

4.1 Account and user data

Name, email address, mobile number, password (hashed), language and time zone preferences
Company name, address, country and tax identifiers where required for invoicing
Billing details processed by our payment providers. We do not store full card numbers.
Support correspondence and demo booking details

4.2 Workspace configuration

Telephony provider credentials (for example a Twilio Account SID and Auth Token, a Plivo Auth ID and Token, or a Vonage application key) and AI engine API keys (OpenAI, xAI, ElevenLabs or Sarvam). These are encrypted at rest with AES-256-GCM and are used only to operate your workspace.
Phone numbers, routing rules, business hours, AI voice agent prompts, tool definitions, MCP server endpoints and credentials, call flow definitions and campaign settings

4.3 Call Data (processed on behalf of our customers)

Call metadata: calling and called numbers, timestamps, duration, direction, outcome, queue and agent assignment, and the provider's call identifiers
Call recordings, where the customer has enabled recording
Transcripts of AI-handled and recorded calls, and summaries and structured data the AI extracts (for example an appointment time)
Voicemail messages
Contact records the customer imports or creates: names, phone numbers, email addresses, tags, notes and custom fields

4.4 Usage and technical data

Log data: IP address, browser type, pages visited, actions taken in the application, and error reports
Metering data used for billing: processed minutes consumed, calls handled, seats active, storage used
Agent presence and availability status while logged in
Product analytics: which setup steps you reach, complete or abandon, which screens you open, and the errors you encounter, together with your user and account identifiers, your role and your plan status. This is how we find the places where new customers get stuck and offer the right help article at that moment. See section 4.5.

4.5 What product analytics does not collect

Product analytics records what you did in the application, never what was said on a call or who called. Specifically:

No call audio, recordings or transcripts
No caller phone numbers, contact records or message content
No session replay. We do not record your screen, and there is no setting that turns this on.
No automatic capture of the text on buttons, fields or rows you click. Only the specific events listed in section 4.4 are sent, and each one is written by hand.
Identifiers in page addresses are removed before an event is sent, so a contact or call record cannot be identified from one.

5. How we use personal data

We use personal data for the following purposes:

To provide, operate and secure the WhautoVoice platform, including routing calls, running AI voice agents, connecting agents, storing recordings and generating reports
To verify identity, manage accounts and workspaces, and provide customer support
To meter usage, calculate charges, issue invoices and collect payment
To send service communications: security alerts, plan limit notices, billing notices, changes to terms
To send marketing communications about WhautoVoice and related Whautomate products, where you have not opted out. Every marketing email includes an unsubscribe link.
To monitor, detect and prevent fraud, abuse, spam calling and violations of our Terms
To analyse aggregated, de-identified usage so we can improve the product
To see where customers get stuck while setting up, so we can offer relevant help at that moment and fix the steps that cause the most trouble
To comply with legal obligations and respond to lawful requests from authorities

We do not sell personal data. We do not use Call Data to train machine learning models.

6. Call recordings, transcripts and AI processing

6.1 Where audio goes

WhautoVoice is a control plane. On AI agents running on OpenAI, xAI Grok or ElevenLabs, call audio flows directly between the telephony provider you connect (Telnyx, Twilio, Plivo or Vonage) and the AI engine you selected. That audio is not streamed through WhautoVoice servers.

Sarvam AI is the exception. Sarvam does not accept a call leg from a telephony provider, so AI agents on Sarvam work differently: your carrier streams the call to a WhautoVoice media service, which relays it to Sarvam and relays Sarvam’s speech back, in both directions, in real time. That audio is held only in memory for as long as it takes to pass on, is never written to disk and is never retained by us. If you would rather no call audio passed through our infrastructure at all, choose one of the other three engines.

Recordings are created by your telephony provider on your instruction and are stored in your provider account; WhautoVoice stores a reference to them and, where configured, retrieves them to display in your workspace and to produce transcripts.

6.2 Recording consent is your responsibility

Laws on recording calls and on informing callers that they are speaking with an automated system vary by country and state. As the controller of Call Data, you are responsible for obtaining any consent and giving any notice the law requires in the jurisdictions you call and are called from, including disclosing that a call may be recorded and that the caller is speaking with an AI agent where that disclosure is required. The platform provides greeting messages, recording toggles per number and AI agent prompt controls to help you do this. WhautoVoice does not itself obtain consent from callers.

6.3 AI processing by the engine you choose

AI voice agents run on the AI engine you select per AI agent, using the API key you connect: OpenAI's Realtime API, xAI's Grok voice API, ElevenLabs Conversational AI or Sarvam AI's speech and language APIs. Audio, transcripts and the context you configure are sent to that vendor under your own account and are subject to its terms and data usage policies (OpenAI, xAI, ElevenLabs). ElevenLabs processes and stores call data in India when you connect its India data residency region. Sarvam AI processes speech and text on infrastructure in India (Sarvam). At the time of writing each states that API data is not used to train its models by default. You should review those policies and any data processing agreement the vendor offers for your account.

6.4 Tools and MCP servers

If you configure custom HTTP tools or remote MCP servers for an AI voice agent, the AI agent may send call context, including things the caller says, to those endpoints during a call. Those endpoints are controlled by you or by third parties you choose, and their handling of data is governed by their own terms.

6.5 Transcripts

Transcripts and AI summaries are stored in your workspace for the retention period of your plan (section 11). They may include personal data the caller chose to share. Access is limited to the team members you authorise.

7. Who we disclose personal data to

We disclose personal data only as needed to operate the service, and under contracts that require recipients to protect it:

Telephony providers you connect (Telnyx, Twilio, Plivo, Vonage): call metadata, routing instructions and, for AI calls, the SIP connection details needed to bridge the call. These providers act under your own account with them.
AI engines you connect (OpenAI, xAI, ElevenLabs, Sarvam): as described in sections 6.1 and 6.3, under your own account. For Sarvam AI, call audio is relayed to the engine by WhautoVoice rather than sent to it directly by your carrier.
Cloud hosting and database providers that host the WhautoVoice platform
Payment processors (Stripe and Chargebee) for subscription billing
Email delivery providers for transactional and, unless opted out, marketing emails
Analytics providers: Google Analytics for website usage, and PostHog for product analytics inside the application, both as described in sections 4.4, 4.5 and 8
Professional advisers, regulators and law enforcement where required by law or to protect our rights
A successor entity in the event of a merger, acquisition or sale of assets, with notice to you

A current list of sub-processors is available on request from dpo@whautovoice.com.

9. Accuracy

We rely on you to provide accurate and complete personal data and to keep it up to date through your account settings. Where we become aware that personal data is inaccurate, we will correct it or ask you to.

10. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include:

Encryption in transit (TLS) for all traffic between your browser, our servers and the providers we call
Encryption at rest with AES-256-GCM for provider credentials, API keys and tool secrets, using keys that are never stored alongside the data
Role-based access control per workspace, with audit logs of administrative actions
Keeping call audio off our infrastructure, other than the real-time relay that AI agents on Sarvam AI require, which holds audio in memory only and writes none of it to disk (section 6.1)
Restricted, logged access to production systems by our staff, on a need-to-know basis
Regular backups, monitoring and dependency updates

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

11. Retention

Transcripts and call history are retained for the period of your plan: 60 days on Starter, 6 months on Growth and 12 months on Scale, after which they are deleted from WhautoVoice.
Call recordings and voicemail audio are stored on your own telephony provider account, not by WhautoVoice. We hold only a reference to the file so it can be played back in the app. That reference is deleted on the retention schedule above and when you close your account; the audio itself remains in your provider account and is governed by your provider's settings and retention rules, so delete it there if you want it removed.
Call metadata and reports are retained while your account is active so that historic reports remain accurate.
Contacts and workspace configuration are retained while your account is active.
Account data is retained while your account is active and for 30 days after you request deletion, so the account can be restored if you change your mind, after which it is permanently deleted or anonymised except where we must keep it for legal, tax or dispute purposes.
Provider credentials and API keys are deleted immediately when you disconnect a provider or delete a workspace.

12. Access and correction

You may access and correct most of your personal data directly in the application. For anything else, or for a copy of the personal data we hold about you, contact us at the address in section 16. We will respond within 30 days. We may charge a reasonable fee for requests that are manifestly excessive, and we may decline requests where the law permits, giving reasons.

If you are an end user of one of our customers and wish to exercise rights over Call Data, please contact that customer. We will help them respond.

13. Deletion

You can delete individual contacts, recordings and transcripts inside the application at any time, and they are removed from live systems immediately. You can delete a whole workspace or your entire account from Settings; account deletion requires typing a confirmation. A deleted account is closed at once and permanently erased 30 days later. During those 30 days the account owner can ask us to restore it; after that it cannot be recovered. Backups exist only to recover the service after a failure. They are deleted within 14 days, and we do not restore individual records or accounts from them.

14. International transfers

WhautoVoice is operated from Singapore with engineering support in India, and our hosting and sub-processors may be located in other countries. Where personal data is transferred outside the country it was collected in, we take steps to ensure it receives a standard of protection comparable to the PDPA, and for EEA and UK data we rely on appropriate safeguards such as standard contractual clauses. The telephony providers and AI engines process data in the regions you select in your own accounts with them.

15. Children

WhautoVoice is a business tool and is not directed at children under 18. We do not knowingly collect account data from children. Our customers are responsible for how they handle calls from minors under applicable law.

16. Contacting us

For any query, feedback or complaint about this notice or how we manage your personal data, contact our Data Protection Officer at dpo@whautovoice.com, or write to The Clinic Place Pte. Ltd, Singapore. Please include your full name, contact information and a brief description of your query. We treat such queries seriously and confidentially and will respond within a reasonable time.

17. Changes to this notice

We may update this notice from time to time. We will post the latest version on this page with a new "last updated" date, and for material changes we will notify account owners by email. Changes take effect when posted.