Privacy policy

VOIX is a product of TERBIUM B.V., Prins Hendrikkade 21E, 1012 TL Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 95714677, VAT number NL867256084B01. In this policy, "we", "us" and "our" mean TERBIUM B.V..

For any question about this policy or about your personal data, contact us at hello@voix.tech or by post at the address above.

This policy explains which personal data we process, why, on what legal basis, who we share it with, how long we keep it, and which rights you have under the General Data Protection Regulation (GDPR).

Controller: for account data, website data and support correspondence, TERBIUM B.V. decides why and how the data is processed and is the controller.

Processor: for call data, meaning recordings, transcripts and the analysis VOIX produces from them, our customer (the organisation that uses VOIX) is the controller. TERBIUM B.V. processes call data only on that customer's documented instructions, under a data processing agreement (DPA).

If you were on a call with an organisation that uses VOIX and want to exercise your rights over that call, please contact that organisation first. If you contact us, we will forward your request to them and help them answer it.

Account data: name, email address, organisation and team membership, role, and sign-in events for people who use the VOIX console.

Call data (as processor): audio recordings, transcripts, phone numbers and other call metadata, and the summaries, check results, quality scores and tasks VOIX derives from them. Call data can contain any personal data spoken during a call.

Website and technical data: IP address, browser type, request time and similar log data, collected when you visit voix.tech or use the console.

Correspondence: the content of emails and other messages you send us, for example when you book a demo or ask for support.

Billing data: company name, billing contact, address, VAT number and invoice history for customers.

Providing the service, managing accounts and answering support requests: necessary for the performance of a contract with you or your organisation (Art. 6(1)(b) GDPR).

Processing call data: on behalf of our customer and under their instructions, as set out in the DPA. The customer determines the legal basis for recording and analysing its calls.

Security, abuse prevention and keeping the service reliable, including access and error logs: our legitimate interest in protecting the platform and our customers (Art. 6(1)(f) GDPR).

Answering questions and demo requests from prospective customers: our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).

Invoicing and keeping financial records: compliance with a legal obligation, including Dutch tax law (Art. 6(1)(c) GDPR).

We do not sell personal data, and we do not use call data to train AI models.

We use the following service providers to run VOIX. Each one processes personal data only on our instructions and under a data processing agreement.

Vercel: website and application hosting. Vercel is a US company; transfers are covered by the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses (SCCs).

Neon: database, hosted in an EU region.

Upstash: cache and queues, hosted in an EU region.

Cloudflare R2: storage of call recordings, in the EU.

Transcription: our own proprietary speech models, run on EU cloud infrastructure.

Fly.io: call infrastructure, run in Amsterdam.

Sentry: error monitoring, hosted in an EU region.

Resend: transactional email, sent from an EU region.

AI models: accessed through the Vercel AI Gateway with zero data retention. Model providers do not store the data and do not use it for training.

Where a provider is established outside the European Economic Area, we rely on an adequacy decision such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses, as the basis for any transfer.

Call data is kept for the retention period our customer sets for its workspace, and is deleted when that period ends or when the customer deletes it.

Account data is kept while the account is active. When an account or workspace is closed, we delete the related data within a reasonable period, unless we have to keep it to meet a legal obligation.

Security and access logs are kept for a limited period, long enough to investigate incidents, and then deleted.

Invoices and financial records are kept for seven years, as required by Dutch tax law.

Correspondence with prospective customers is deleted when it is no longer needed to follow up on the request.

Under the GDPR you have the right to access your personal data, to have it rectified, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest.

To exercise any of these rights, contact us at hello@voix.tech. We answer within one month. We may ask you to confirm your identity before we act on a request.

For call data, we act on behalf of our customer, so we will pass your request on to them as described above.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to address your concern first.

The voix.tech website does not use analytics, advertising or other tracking cookies.

The VOIX console uses only strictly necessary cookies, for example to keep you signed in. These do not require consent and are not used to track you across other sites.

The console also uses Vercel Web Analytics to count page views in aggregate. It does not set cookies and does not identify individual visitors.

We protect personal data with technical and organisational measures appropriate to the risk. These include encryption in transit and at rest, access scoped per organisation and team, access to production systems limited to the people who need it, error monitoring, and processors that are bound by data processing agreements.

If a personal data breach occurs that affects call data, we inform the customer without undue delay so they can meet their own obligations.

We may update this policy when our service or the law changes. The date at the top of this page shows when it was last updated. If we make significant changes, we will inform customers before they take effect.