Privacy Policy

1. Introduction

WhautoVoice is operated by The Clinic Place Pte. Ltd, a company incorporated in Singapore ("WhautoVoice", "we", "us"). We respect the privacy and confidentiality of the personal data of our customers, their team members, the people who call or are called through our platform, and everyone else we interact with while providing our services.

We are committed to policies, practices and processes that safeguard the collection, use and disclosure of personal data in compliance with the Singapore Personal Data Protection Act 2012 (PDPA). Where our customers serve people in the European Economic Area or the United Kingdom, we also support their obligations under the GDPR and UK GDPR, as described below.

This notice explains how we collect, use, disclose, process, protect and retain personal data in our possession or under our control.

2. Our role: controller and processor

WhautoVoice handles personal data in two capacities:

• As a controller of the data of our customers and their users: the account owner, team members invited to a workspace, billing contacts and website visitors. We decide how this data is used, as set out in this notice.
• As a processor of the data of our customers' end users: the people who call our customers' phone numbers or are called by them, the contacts our customers import, and the recordings and transcripts of those calls ("Call Data"). Our customer is the controller of Call Data and decides what is collected, whether calls are recorded, how long it is kept and who may access it. We process Call Data only on the customer's instructions, which are given through the settings of the platform and our Terms & Conditions.

If you are a caller and have a question about how a business that uses WhautoVoice handles your data, please contact that business directly. We will assist them in responding.

3. How we collect personal data

Personal data is any information that can identify an individual, on its own or combined with other information. We collect personal data when you:

• Create an account or are invited to a workspace on WhautoVoice
• Connect a telephony provider account or an OpenAI account to a workspace
• Purchase, import or configure phone numbers, voice bots, call flows, queues or campaigns
• Make or receive calls through the platform, or are a party to such a call
• Import contacts or receive them through our API or integrations
• Contact us by email, our help centre, or a demo booking
• Visit our website, which uses cookies and analytics as described in section 8
• Respond to marketing emails we send

4. Types of personal data we collect

4.1 Account and user data

• Name, email address, mobile number, password (hashed), language and time zone preferences
• Company name, address, country and tax identifiers where required for invoicing
• Billing details processed by our payment providers. We do not store full card numbers.
• Support correspondence and demo booking details

4.2 Workspace configuration

• Telephony provider credentials (for example a Twilio Account SID and Auth Token, a Plivo Auth ID and Token, or a Vonage application key) and AI engine API keys (OpenAI, xAI or ElevenLabs). These are encrypted at rest with AES-256-GCM and are used only to operate your workspace.
• Phone numbers, routing rules, business hours, voice bot prompts, tool definitions, MCP server endpoints and credentials, call flow definitions and campaign settings

4.3 Call Data (processed on behalf of our customers)

• Call metadata: calling and called numbers, timestamps, duration, direction, outcome, queue and agent assignment, and the provider's call identifiers
• Call recordings, where the customer has enabled recording
• Transcripts of AI-handled and recorded calls, and summaries and structured data the AI extracts (for example an appointment time)
• Voicemail messages
• Contact records the customer imports or creates: names, phone numbers, email addresses, tags, notes and custom fields

4.4 Usage and technical data

• Log data: IP address, browser type, pages visited, actions taken in the application, and error reports
• Metering data used for billing: AI minutes consumed, calls handled, seats active, storage used
• Agent presence and availability status while logged in

5. How we use personal data

We use personal data for the following purposes:

• To provide, operate and secure the WhautoVoice platform, including routing calls, running voice bots, connecting agents, storing recordings and generating reports
• To verify identity, manage accounts and workspaces, and provide customer support
• To meter usage, calculate charges, issue invoices and collect payment
• To send service communications: security alerts, plan limit notices, billing notices, changes to terms
• To send marketing communications about WhautoVoice and related Whautomate products, where you have not opted out. Every marketing email includes an unsubscribe link.
• To monitor, detect and prevent fraud, abuse, spam calling and violations of our Terms
• To analyse aggregated, de-identified usage so we can improve the product
• To comply with legal obligations and respond to lawful requests from authorities

We do not sell personal data. We do not use Call Data to train machine learning models.

6. Call recordings, transcripts and AI processing

6.1 Where audio goes

WhautoVoice is a control plane. Call audio flows between the telephony provider you connect (Twilio, Plivo or Vonage) and, for AI-handled calls, the AI engine you selected. Audio is not streamed through WhautoVoice servers. Recordings are created by your telephony provider on your instruction and are stored in your provider account; WhautoVoice stores a reference to them and, where configured, retrieves them to display in your workspace and to produce transcripts.

6.2 Recording consent is your responsibility

Laws on recording calls and on informing callers that they are speaking with an automated system vary by country and state. As the controller of Call Data, you are responsible for obtaining any consent and giving any notice the law requires in the jurisdictions you call and are called from, including disclosing that a call may be recorded and that the caller is speaking with an AI agent where that disclosure is required. The platform provides greeting messages, recording toggles per number and bot prompt controls to help you do this. WhautoVoice does not itself obtain consent from callers.

6.3 AI processing by the engine you choose

AI voice agents run on the AI engine you select per bot, using the API key you connect: OpenAI's Realtime API, xAI's Grok voice API or ElevenLabs Conversational AI. Audio, transcripts and the context you configure are sent to that vendor under your own account and are subject to its terms and data usage policies (OpenAI, xAI, ElevenLabs). At the time of writing each states that API data is not used to train its models by default. You should review those policies and any data processing agreement the vendor offers for your account.

6.4 Tools and MCP servers

If you configure custom HTTP tools or remote MCP servers for a voice bot, the bot may send call context, including things the caller says, to those endpoints during a call. Those endpoints are controlled by you or by third parties you choose, and their handling of data is governed by their own terms.

6.5 Transcripts

Transcripts and AI summaries are stored in your workspace for the retention period of your plan (section 11). They may include personal data the caller chose to share. Access is limited to the team members you authorise.

7. Who we disclose personal data to

We disclose personal data only as needed to operate the service, and under contracts that require recipients to protect it:

• Telephony providers you connect (Twilio, Plivo, Vonage): call metadata, routing instructions and, for AI calls, the SIP connection details needed to bridge the call. These providers act under your own account with them.
• AI engines you connect (OpenAI, xAI, ElevenLabs): as described in section 6.3, under your own account.
• Cloud hosting and database providers that host the WhautoVoice platform
• Payment processors (Stripe and Chargebee) for subscription billing
• Email delivery providers for transactional and, unless opted out, marketing emails
• Analytics providers (Google Analytics) for website usage, as described in section 8
• Professional advisers, regulators and law enforcement where required by law or to protect our rights
• A successor entity in the event of a merger, acquisition or sale of assets, with notice to you

A current list of sub-processors is available on request from dpo@whautovoice.com.

8. Consent, withdrawal and cookies

8.1 Obtaining consent

By creating an account, connecting providers, inviting team members, importing contacts and using the platform, you consent to the collection, use and disclosure of personal data described in this notice, and you confirm that you have the authority to provide the personal data of others that you enter into the platform.

8.2 Withdrawing consent

You may withdraw consent at any time by contacting us at the address in section 16. Withdrawing consent for data we need to run the service means we will have to close your account. You can unsubscribe from marketing emails using the link in any such email.

8.3 Cookies

Our website uses a small number of cookies and similar technologies: strictly necessary cookies for things like remembering your theme preference and cookie choice, and Google Analytics cookies to understand how visitors use the site. You can block cookies in your browser settings; the website will continue to work. The application uses session storage required for you to stay logged in.

9. Accuracy

We rely on you to provide accurate and complete personal data and to keep it up to date through your account settings. Where we become aware that personal data is inaccurate, we will correct it or ask you to.

10. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. These include:

• Encryption in transit (TLS) for all traffic between your browser, our servers and the providers we call
• Encryption at rest with AES-256-GCM for provider credentials, API keys and tool secrets, using keys that are never stored alongside the data
• Role-based access control per workspace, with audit logs of administrative actions
• Keeping call audio off our infrastructure entirely
• Restricted, logged access to production systems by our staff, on a need-to-know basis
• Regular backups, monitoring and dependency updates

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

11. Retention

• Recordings, transcripts and voicemails are retained for the period of your plan: 30 days on Starter, 6 months on Growth and 12 months on Scale, after which they are deleted from WhautoVoice. Recordings in your telephony provider account are governed by your provider settings.
• Call metadata and reports are retained while your account is active so that historic reports remain accurate.
• Contacts and workspace configuration are retained while your account is active.
• Account data is retained while your account is active and for up to 90 days after closure, so you can reactivate, after which it is deleted or anonymised except where we must keep it for legal, tax or dispute purposes.
• Provider credentials and API keys are deleted immediately when you disconnect a provider or delete a workspace.

12. Access and correction

You may access and correct most of your personal data directly in the application. For anything else, or for a copy of the personal data we hold about you, contact us at the address in section 16. We will respond within 30 days. We may charge a reasonable fee for requests that are manifestly excessive, and we may decline requests where the law permits, giving reasons.

If you are an end user of one of our customers and wish to exercise rights over Call Data, please contact that customer. We will help them respond.

13. Deletion

You can delete individual contacts, recordings and transcripts inside the application at any time. You can delete a whole workspace or your entire account from Settings; account deletion requires typing a confirmation and is irreversible. Deletion from live systems is immediate and from backups within 35 days.

14. International transfers

WhautoVoice is operated from Singapore with engineering support in India, and our hosting and sub-processors may be located in other countries. Where personal data is transferred outside the country it was collected in, we take steps to ensure it receives a standard of protection comparable to the PDPA, and for EEA and UK data we rely on appropriate safeguards such as standard contractual clauses. The telephony providers and AI engines process data in the regions you select in your own accounts with them.

15. Children

WhautoVoice is a business tool and is not directed at children under 18. We do not knowingly collect account data from children. Our customers are responsible for how they handle calls from minors under applicable law.

16. Contacting us

For any query, feedback or complaint about this notice or how we manage your personal data, contact our Data Protection Officer at dpo@whautovoice.com, or write to The Clinic Place Pte. Ltd, Singapore. Please include your full name, contact information and a brief description of your query. We treat such queries seriously and confidentially and will respond within a reasonable time.

17. Changes to this notice

We may update this notice from time to time. We will post the latest version on this page with a new "last updated" date, and for material changes we will notify account owners by email. Changes take effect when posted.