VoiceDesk

Privacy Policy

Last updated: 15 September 2026

1. Who we are

VoiceDesk ("we", "us") provides an AI-powered phone receptionist for small businesses: it answers inbound calls, books appointments into the business's Google Calendar and keeps a log of calls. The service is operated from Cyprus. Contact: hello@voicedesk.online.

2. Data we process

Account data. Your name, email address and, if you sign in with Google, your Google account identifier. Passwords (when used) are stored hashed.

Business data. Business name, type, address, contact phone, working schedule, languages and the instructions you configure for your agent.

Call data. Inbound calls to your VoiceDesk number are recorded and transcribed to provide the service (callers are informed at the start of each call). We store call transcripts, summaries, caller phone numbers, detected caller language and caller names given during calls, and appointment details. Transcripts are automatically deleted 90 days after the call.

Billing data. Payments are processed by Stripe. We do not store card numbers; we keep your Stripe customer reference, subscription status and usage (voice minutes).

3. Google user data

When you connect Google Calendar (or sign in with Google), we request the following scopes: openid, email, profile (to identify your account) and calendar.readonly, calendar.events. We use Calendar access solely to:

  • list your calendars so you can choose one for bookings;
  • read free/busy information to offer available appointment slots to callers;
  • create, update and delete booking events made through your VoiceDesk agent.

We do not read the content of your other calendar events beyond free/busy status, and we never use Google user data for advertising, profiling or training AI models. Google OAuth tokens are stored encrypted and are deleted when you disconnect the integration (Dashboard → Integrations) or revoke access at myaccount.google.com/permissions.

Sharing of Google user data. We do not sell, rent or trade Google user data, and we do not share, transfer or disclose it to any third party except in the limited cases below:

  • Google LLC — to which the data belongs and with which we exchange it through the Google Calendar API to read availability and manage your booking events;
  • our EU-region cloud hosting provider, which stores the encrypted data on our behalf as a processor under a data-processing agreement, solely to operate the service;
  • where required by law, court order or to protect our legal rights.

We do not share Google user data with our telephony or speech providers (Retell AI, DIDWW) or with Stripe; those providers process only call and billing data, never your Google account or calendar data. Google user data is used solely to provide and improve the user-facing calendar-booking features described above and for no other purpose.

VoiceDesk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Service providers (subprocessors)

We share data only as needed to run the service: Google (calendar, sign-in), Stripe (payments), Retell AI and its speech providers (call handling, transcription), DIDWW (telephony), and our EU-region hosting provider. We do not sell personal data.

5. Cookies, analytics and advertising

Our website uses cookies only if you accept them in the cookie banner. With your consent we use Google Analytics to understand how visitors use the website and Google Ads to measure which of our ads lead to sign-ups and subscriptions (conversion measurement). These cookies may collect your IP address, device and browser information, pages visited and actions such as starting a subscription, and Google may use this data to measure and personalise ads. If you decline, these cookies are not set. You can change your choice at any time by clearing this site's data in your browser, after which the banner is shown again. Strictly necessary cookies (e.g. keeping you signed in) are always used.

6. How we protect your data

We apply technical and organisational safeguards to protect all personal data, with additional measures for sensitive data such as Google OAuth tokens, call recordings and transcripts:

  • Encryption in transit. All data is transmitted over encrypted connections (TLS/HTTPS), including every call to Google APIs.
  • Encryption at rest. Google OAuth tokens and other secrets are encrypted at the application level (AES-256), and our database and backups are encrypted at rest by our EU-region host.
  • Access controls. Access to production data is restricted to authorised personnel on a need-to-know basis, protected by strong authentication, and logged. Each customer can only access their own data.
  • Data minimisation and retention limits. We request the narrowest Google scopes needed, read only free/busy status of unrelated events, and automatically delete call transcripts 90 days after the call. OAuth tokens are deleted immediately when you disconnect the integration.
  • Operational security. Infrastructure is hosted in the EU, kept patched, and monitored; we review access and follow the principle of least privilege.

7. Legal basis and retention

We process data to perform our contract with the business (Art. 6(1)(b) GDPR) and on the basis of legitimate interest in operating and securing the service. Analytics and advertising cookies are used only with your consent (Art. 6(1)(a) GDPR). Call transcripts are deleted after 90 days; other data is kept while your account is active and deleted upon account deletion, except where law requires longer retention (e.g. invoices).

8. Your rights

Under GDPR you may request access, correction, export or deletion of your personal data, and object to or restrict processing. Callers of our customers may direct requests to the business they called or to us. Write to hello@voicedesk.online; you may also lodge a complaint with the Cyprus Commissioner for Personal Data Protection.

9. Changes

We will post any changes to this policy on this page and update the date above.