Voxicat Privacy Policy
Effective date: October 28, 2026
This Privacy Policy explains how Voxicat handles personal information when you visit voxicat.com, join our waitlist, use our business application, contact support, or interact with communications delivered through our platform. It covers website visitors, business account holders, their team members, and people whose service requests are managed using Voxicat. Feature-specific sections apply when the relevant feature is enabled.
1. Who is responsible for your information
Voxicat is operated by Kostyantyn Savchenko, a sole proprietor (Einzelunternehmer) established in Germany, operating Voxicat under his registered business designation VoxiGO.
Business address: Am Europakanal 36, 91056 Erlangen, Germany.
Website: https://voxicat.com/
Support and privacy contact: support@voxicat.com.
We act as the controller for information we use to operate our website, manage Voxicat accounts and subscriptions, answer our own support requests, protect the service, and meet our legal obligations.
When a plumbing or other service business uses Voxicat to manage its customers, employees, appointments, calls, or messages, that business generally determines why those records are used. Voxicat processes those records on the business's behalf and under its instructions. The business's own privacy notice explains its purposes and legal basis. This Policy does not replace that notice or give the business permission to contact you.
If your request concerns a service appointment, a call, or a text from a particular service business, contact that business first. You may also contact us, identify the business concerned, and we will help route your request. Each organisation remains responsible for the processing for which it acts as controller.
2. Information we collect and its sources
- Website and waitlist information: the name and email you provide, signup time, consent record, offer associated with your signup, and correspondence. If you allow analytics, we also collect visit events, a random browser-session identifier, referring domain, campaign labels, and country information supplied by our hosting provider.
- Account and business information: names, work email addresses, business contact details, account identifiers, roles, settings, service areas, business hours, and services offered. We receive this information from you or the business administrator who creates or manages your access.
- Service and team records: customer names, phone numbers, email addresses where provided, service addresses, job descriptions, appointment dates, staff assignments, availability, work notes, and related communications. These may be supplied by a customer, caller, account user, or an authorised integration.
- Calls and AI interactions: caller and destination numbers, call time and duration, consent decisions, conversation content needed to respond, written call summaries, AI chat messages, relevant context from business records, generated responses, and records of actions requested or performed.
- SMS information: sending and receiving numbers, message content, timestamps, delivery results, replies, opt-in evidence, opt-out requests, and messaging usage. Messaging providers and carriers supply delivery and routing information.
- Billing and verification information: subscription status, transaction and invoice references, billing details, and business identity or registration details submitted for phone or messaging verification. Payment information is collected through the payment provider. We do not ask you to send complete card details or passwords by SMS or email.
- Technical and security information: network information such as IP addresses received by infrastructure providers, browser/device information, session and authentication records, error records, security events, and service usage. Our website's application-level abuse prevention uses keyed network identifiers rather than recording raw IP addresses in its analytics records.
- Support and privacy requests: contact details, the substance of a request, verification needed to handle it, and records of our response.
We obtain information directly from you, from the business with which you interact, from that business's authorised team, and from providers operating the relevant service. Where a business enables an integration, the information received depends on the permissions it grants. We do not require sensitive medical information, government identity documents, payment credentials, or unrelated personal information in ordinary service requests or AI conversations.
3. Why we use information and our legal bases
Where the GDPR applies and Voxicat acts as controller, we use the following bases. Contract necessity applies when you are personally a party to the contract; where you represent a business customer, relevant account administration is generally based on legitimate interests.
| Purpose | Legal basis and interest |
|---|---|
| Provide and administer accounts, subscriptions, and requested support | Performance of a contract or requested pre-contractual steps (Article 6(1)(b)); legitimate interests in serving business customers and their authorised users (Article 6(1)(f)). |
| Maintain reliable services, control access, investigate errors, and prevent misuse | Legitimate interests in service security, reliability, and protection of users (Article 6(1)(f)). |
| Manage invoices, required business records, and legally required disclosures | Compliance with applicable legal obligations (Article 6(1)(c)). |
| Send requested waitlist, launch, and Early Bird emails | Your consent (Article 6(1)(a)). You can withdraw without affecting earlier lawful processing. |
| Measure optional website visits and attribution | Your consent (Article 6(1)(a)); consent for non-essential device storage/access where required. |
| Run Voxicat's own opt-in SMS programmes and retain consent/opt-out evidence | Consent for optional messages (Article 6(1)(a)); legitimate interests in demonstrating choices and preventing unwanted contact (Article 6(1)(f)); legal obligations where applicable. Channel-specific consent rules still apply. |
| Handle privacy requests, disputes, and legal claims | Legal obligations (Article 6(1)(c)) and legitimate interests in resolving disputes and protecting legal rights (Article 6(1)(f)). |
For customer and team records processed on behalf of a service business, that business determines the appropriate legal basis and gives us processing instructions. We do not use legitimate interests as a substitute for SMS consent where consent is required.
Information needed for an account or service request must be supplied for us or the service business to provide the requested function. Optional analytics and messaging choices are voluntary. Declining them does not prevent browsing the website or requesting service through another available channel.
4. Calls, written summaries, and AI assistance
Voxicat uses automated assistants to help answer calls, understand service requests, prepare written summaries, retrieve relevant business records, and assist authorised users with scheduling and administration. Audio must be processed in real time to provide a voice conversation. Our current phone-assistant workflow creates a written summary rather than a routine audio recording for playback.
At the start of the relevant call, the caller receives a notice about the automated assistant and written summary and is asked whether to continue. The telephony provider may process the short response to determine that choice before connecting the main AI conversation. A refusal does not count as consent to continue with the AI assistant. A callback request is handled separately when offered and accepted.
Written summaries are generated by AI and may contain errors or omit details. They are not verbatim evidence of what was said or proof that a person authorised an action. Authorised users can review the information and request corrections. Important service arrangements should be checked with the business.
Earlier versions of the service may have created full call transcripts or audio recordings. Existing historical records are not automatically converted into summaries. Access and deletion requests for those records can be directed to the responsible service business or to our privacy contact.
Relevant conversation and business context is sent to the AI provider serving that feature. The phone workflow uses Grok/xAI and the internal assistant uses OpenAI in our implementation. These are business/API integrations. We do not describe all provider processing as zero-retention: retention, safety processing, and any model-improvement use depend on the applicable service and configuration. Provider processing is governed by the business/API terms applicable to each feature, including any security and abuse-review requirements. Contact us for information about the providers and processing applicable to your interaction. Do not assume that an AI conversation is confidential from the providers needed to deliver it.
Voxicat is not designed to make solely automated decisions about credit, employment eligibility, insurance, or other matters producing legal or similarly significant effects. Operational automation, such as checking an available appointment time, may be used within the business's settings. You can contact the business to ask about an appointment decision or request human assistance.
5. SMS choices and protection of mobile information
SMS programmes may include appointment confirmations, service updates, replies to your questions, and optional requests for an honest review after completed service. The opt-in notice identifies the sender and the purposes you are agreeing to. Consent to one business or purpose does not subscribe you to another business or unrelated marketing.
No mobile information will be sold or shared with third parties or affiliates for promotional or marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services that need the information to operate and deliver those services.
This restriction applies to mobile information and SMS opt-in data even where other sections of this Policy describe disclosures of other categories of information. Messaging vendors may use the relevant information to deliver messages, handle opt-outs, and support compliance. It is not provided to them for their independent marketing.
You can reply STOP to stop messages from the sending number, or contact the sender's support address. Reply HELP for assistance. The carrier or messaging network may send an opt-out confirmation. We retain the minimum suppression information needed to respect your choice. Stopping texts does not by itself delete an appointment, close an account, or erase records that must be retained for another purpose.
Our SMS Terms explain the programmes in more detail. Messages sent by a service business are also subject to that business's sender-specific SMS terms and privacy notice. Voxicat does not obtain permission to market to the business's customers merely because it delivers their messages.
6. Who receives information
Access within a business workspace depends on the user's role and the feature. Business owners and authorised team members receive the records needed for their work. Platform personnel access information where necessary for an authorised support, operational, security, or legal purpose.
We use infrastructure and specialist providers to operate the service. The following list describes providers used for the relevant features; a row applies only when that feature is used.
| Provider or category | Purpose and relevant information |
|---|---|
| Vercel | Website and application hosting, request handling, website storage, and operational/security information. |
| Supabase | Application authentication, database and associated storage, including business records and account information. |
| Telnyx and telecommunications carriers | Phone numbers, voice transport, speech processing for the consent step, SMS delivery, message content, routing/delivery information, and verification information. |
| Grok/xAI | Voice conversations and written call summaries, with the relevant business context. |
| OpenAI | Internal AI assistance using submitted prompts and relevant business information. |
| Stripe | Subscription payments, invoices, and payment-related information. Stripe may also act as a separate controller for its own regulatory and fraud-prevention purposes. |
| one.com | Configured email services, including account-related email delivery and associated email addresses/content. |
| Geoapify and map-data providers, including OpenStreetMap | Address search, map display, and location-related functions. Relevant address queries or map coordinates are used for these features; routing through our server does not make location data anonymous. |
| Authorised integrations and notification delivery providers | Only the information needed for an enabled integration or an opted-in notification. The recipient depends on the integration or notification service you enable; information about the applicable recipient is available from the business administrator or our privacy contact. |
We may also disclose information when required by law, to respond to a lawful request, or where necessary to establish, exercise, or defend legal claims. Such disclosures are assessed for necessity and scope. We do not sell personal information or disclose it for cross-context behavioural advertising.
7. Storage locations and international transfers
The website's waitlist and optional analytics records are stored in private Vercel storage in Frankfurt, Germany. We use Supabase for the application database. Application and provider processing may occur in the United States. Other processing, including telecommunications, AI, support, and infrastructure operations, may take place outside Germany or the European Economic Area, including in the United States.
Where the GDPR applies to a transfer, the applicable transfer mechanism and safeguards must cover that transfer. For website processing, Vercel's Data Processing Addendum includes EU Standard Contractual Clauses for applicable transfers. Supabase's Data Processing Addendum also provides contractual transfer safeguards. Telecommunications and AI processing are subject to the relevant provider agreements and the safeguards applicable to the particular transfer. Information about the recipient and safeguards for your data, and copies of applicable safeguards, can be requested from our privacy contact.
Contact support@voxicat.com for information about these safeguards and how to obtain a copy, subject to protection of confidential information. Choosing a German hosting region does not mean all providers process all information only in Germany.
8. How long information is kept
We keep information for the purpose for which it was collected, taking account of instructions from the responsible business, legal requirements, security needs, and disputes. The following schedule describes the relevant categories.
| Category | Retention |
|---|---|
| Website waitlist details | Up to 12 months after signup, unless withdrawn or deleted earlier. A later customer relationship has its own account-record retention. |
| Optional website visit analytics | Up to 90 days. |
| Website privacy-request submissions | Removed when resolved, and no later than 12 months after receipt. Any separately required compliance record follows the applicable legal purpose. |
| Call summaries and retained call transcripts | Scheduled for deletion from active application storage after 30 days, unless deleted earlier. Separate service requests, customer records, or job notes created from a call have their own retention. |
| Business accounts, customers, appointments, job notes, and team records | While needed for the active service and the business's instructions; following account closure: we assess records for deletion or return in accordance with the business's instructions, any outstanding service obligations, and specific legal recordkeeping or claims requirements. Records retained solely for a legal purpose are restricted to that purpose. |
| SMS content and delivery history | For the period needed to deliver and resolve the relevant service interaction and maintain the business's service history under its instructions, unless deleted earlier or needed for a specific documented dispute or legal requirement. |
| SMS and voice consent evidence | While the relevant consent is relied on and subsequently for the period needed to demonstrate compliance or resolve a specific dispute, taking account of applicable limitation periods and the responsible business's instructions; SMS evidence and voice evidence may require different schedules. |
| Opt-out and suppression records | As long as needed to prevent contact without renewed consent, with review when the programme or account ends, when valid new consent is received, or when we are notified that the number has changed ownership. Only the information necessary to honour the opt-out is retained. |
| AI chat history, application support records, and security logs | Chat history is retained to support the ongoing business conversation and its related service records, subject to the business's instructions. Support correspondence is kept while needed to resolve the request and related claims. Security records are retained while needed to investigate and prevent misuse or address a documented incident. Temporary authentication and abuse-prevention records expire according to their operational purpose. |
| Invoices and legally required financial records | For the applicable statutory period, depending on the type of record and jurisdiction; retained records are restricted to those legal purposes. |
| Backups and provider-held copies | Removed or overwritten according to the relevant backup rotation and provider retention schedules. The applicable period depends on the service and whether a legal or security retention obligation applies; contact us for details relating to your records. Deletion from the application is not a promise of immediate erasure from every backup or provider system. |
Where information is retained for a legal hold or an unresolved claim, we restrict its use to that purpose and delete it when the reason ends. Providers may separately retain data where required by law or their applicable processing terms. We coordinate deletion requests within the relevant controller/processor relationship.
9. Cookies, browser storage, and notifications
Essential cookies and similar storage support sign-in, security, and remembering your choices. Optional website analytics runs only after you allow it. You can withdraw or change that choice through Cookie settings on our website. Declining analytics does not prevent joining the waitlist.
The website stores its consent choice for 180 days and uses an optional random session identifier until the tab session ends or consent is withdrawn. The website does not use advertising pixels or third-party marketing cookies in our implementation. Our Cookie Policy describes website storage. The application also uses essential authentication and session storage to keep authorised users signed in and protect access to business records. These records last for the relevant session or token validity period and are cleared or expire when access ends. Browser notification subscriptions remain until revoked, invalidated, or removed with the associated account.
If you enable browser or device notifications, the service processes a notification subscription or device endpoint to deliver them. You can turn these off in your browser or device settings. Declining push notifications does not itself revoke SMS consent, and an SMS opt-out does not change browser permissions.
10. Your privacy rights
Depending on the law that applies and the nature of the processing, you may request access, correction, deletion, restriction, or a portable copy of your personal information. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time.
Send your request to support@voxicat.com. Please identify the relevant account or service business and the information or choice concerned. We may ask for proportionate verification before disclosing or changing records. Do not email passwords, complete payment details, or identity documents unless specifically requested through an appropriate secure process.
For GDPR requests we respond without undue delay and normally within one month. If a permitted extension is necessary, we explain it within that period. Requests are normally free of charge. When we act as processor for a service business, we assist that business with the request instead of independently deciding how to use its records.
You may complain to a competent data protection supervisory authority, including the authority where you live, work, or believe an infringement occurred. Our local supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), responsible for private-sector organisations in Bavaria. If applicable US state privacy law gives you additional access, deletion, correction, portability, appeal, or opt-out rights, you may exercise them through the same contact. We will explain any refusal and available appeal process under the applicable law.
11. Security, children, and external services
We use access controls, company-scoped permissions, protected authentication, and other technical and organisational measures designed to protect information. Security measures reduce risk but cannot guarantee that every transmission or system is completely secure.
Voxicat is a business application and is not directed to children. If you believe a child has supplied personal information through our service inappropriately, contact us so that we and, where appropriate, the responsible business can assess and address it.
Links to Google reviews, payment pages, or other external services take you to services governed by their own privacy notices. Opening a Google review link does not automatically tell Voxicat whether you posted a review. A service business remains responsible for its own review practices.
12. Changes and contact
We update this Policy when our processing changes and show the effective date above. Where a change requires a new notice or consent, we provide it through an appropriate channel before applying the change. Continued use does not replace consent where consent is required.
Privacy questions: support@voxicat.com.
Operator: Kostyantyn Savchenko, operating Voxicat under his registered business designation VoxiGO.
Postal address: Am Europakanal 36, 91056 Erlangen, Germany.
Contact us or withdraw consent
You can also use this form for privacy requests. Please do not include passwords, payment details, or sensitive documents.