NeuraVoice

Legal · Privacy

Privacy policy.

Last updated: July 2026

This privacy policy describes how NeuraVoice Inc. ("we," "us," "our"), a corporation incorporated in the Province of Quebec, Canada, collects, uses, shares, and protects information when you visit neuravoice.ai or use the NeuraVoice product (collectively, the "Service"). It applies to visitors and customers worldwide and is calibrated to meet:

  • Quebec Law 25: Act respecting the protection of personal information in the private sector (RLRQ c. P-39.1, as amended). Applies because NeuraVoice Inc. is incorporated in Quebec, regardless of where you reside;
  • PIPEDA: Canada's federal Personal Information Protection and Electronic Documents Act. Applies to residents of Canadian provinces other than Quebec;
  • GDPR / UK GDPR: for EEA and UK residents;
  • CCPA / CPRA: for California residents;
  • State-level US privacy laws: Colorado CPA, Virginia CDPA, Connecticut CTDPA, and substantively-similar laws as they take effect in additional states;
  • COPPA: children's privacy in the United States.

For service-provider/data-processor terms when you use NeuraVoice to handle your callers' data, see our Data Processing Addendum, available on request from [email protected].

Privacy Officer

In accordance with Article 3.1 of Quebec Law 25, NeuraVoice Inc. has designated a Privacy Officer who is responsible for the protection of personal information and who serves as your primary point of contact for any privacy-related question or request.

  • Email: [email protected]
  • Postal address: NeuraVoice Inc., Quebec, Canada (registered office address available on request)

Complaints and rights requests relating to personal information (access, rectification, deletion, portability, opt-outs) should be addressed to the email above.

What we collect

  • Account info you provide on signup or demo request: name, work email, phone, firm or company name, and the vertical and use case you indicate.
  • Call audio and transcripts handled by your NeuraVoice agents, plus structured outcomes (qualification results, booking metadata, conflict flags).
  • Demo-call recordings. When you submit the demo form and tick the consent checkbox, we place a one-time outbound call to the number you provide and record the audio and transcript for quality review and product improvement. Demo recordings are retained for up to 30 days. You can request earlier deletion by emailing [email protected].
  • Usage and aggregate metrics that drive your dashboard: call volume, qualification rates, response latency, outcome distribution.
  • Site activity: pages viewed, CTAs clicked, forms submitted, scroll and time-on-page milestones. Gated behind your analytics-cookie consent.
  • Inferred attribution: UTM parameters, referrer, first-touch landing path, click identifiers (gclid, fbclid) from URLs you arrive on. Stored locally so we can attribute a future demo booking back to the marketing source.
  • Technical data: IP address (for security and rate limiting; anonymized in product analytics), user agent, approximate region.

Who within NeuraVoice can access this: Call audio and transcripts are accessible to the engineer assigned to a documented support ticket, security incident responders, and the Privacy Officer. All employee access is logged. Account and billing data are accessible to billing administrators and the Privacy Officer. Sub-processors (see below) receive only what they need to perform their function.

How we use it

  • Run the AI agents on your inbound calls, generate transcripts, surface outcomes to your stack.
  • Provide your dashboard, billing (via Stripe), customer support, and product communications.
  • Improve product features: latency monitoring, failure-mode taxonomies, error tracking, and feature prioritization.We do not use your call audio, transcripts, agent prompts, or outcome data to train third-party large language models. This commitment is unconditional across all tiers.
  • Detect and prevent fraud, abuse, and security incidents.
  • Meet legal obligations and respond to lawful requests.

We will not use your personal information for any new purpose without your consent, except where permitted by Quebec Law 25 Article 12 or other applicable law.

Google user data

When you connect a Google Calendar to NeuraVoice, we request the read-only (calendar.readonly) and event (calendar.events) scopes so our AI agent can schedule appointments on your behalf during calls:

  • Read-only free/busy access (calendar.readonly): we check your availability so the agent only offers open time slots and never double-books.
  • Event access (calendar.events): we create, update, or cancel the appointment events a caller books during a call, including an optional Google Meet link.

We store only the encrypted OAuth tokens required to perform these actions; we do not copy or retain the contents of your calendar beyond what is needed to complete a booking. NeuraVoice's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train generalized AI/ML models, and we do not transfer it except as needed to provide the appointment-booking feature or as required by law.

Legal bases for Quebec residents (Law 25)

For personal information of Quebec residents, we rely on:

  • Consent (Law 25 Articles 12, 14): primary basis for most processing. Consent must be manifest, free, and enlightened, and given for specific purposes. You may withdraw consent at any time.
  • Necessary for the performance of a contract (Article 18(3)): to provide the Service to you under our subscription agreement.
  • Compliance with a legal obligation (Article 18(1)).
  • Protection of vital interests (Article 18(2)).

Note that Law 25 does not recognize "legitimate interests" as a stand-alone basis in the way the GDPR does; processing not falling within one of the enumerated bases or statutory exceptions requires consent.

Legal bases for GDPR / EEA / UK

Where the GDPR or UK GDPR applies, we rely on these legal bases under Article 6:

  • Contract: to provide the Service to you under our subscription agreement.
  • Legitimate interests: to secure the Service, prevent abuse, and improve product quality (balanced against your rights and freedoms).
  • Consent: for non-essential cookies and marketing communications. You can withdraw consent any time via the cookie-preferences link in the footer.
  • Legal obligation: when required by applicable law.

Cookies and similar technologies

We categorize cookies and local storage into four buckets, configurable via the cookie-preferences link in the footer:

  • Strictly necessary: required for the Service to function (session, security, the cookie-consent state itself). Cannot be disabled.
  • Functional: local-only storage of UI state (first-touch UTM source, ROI calculator inputs, plan-quiz selections). Not shared with third parties.
  • Analytics: PostHog cookies for product analytics and (anonymized) session replay. Off by default; opt-in via the consent banner. PostHog's session replay involves technology that may identify, locate, or profile you; Quebec residents may opt out of this profiling technology at any time via the cookie-preferences link, consistent with Law 25 Article 8.1.
  • Marketing: reserved for future ad-attribution or retargeting tools. None active today.

How we protect it

TLS 1.3 in transit. AES-256 at rest. Google Cloud US-region infrastructure by default; EU/UK regions on request. Per-tier configurable retention. Role-based access controls and logged employee access to call audio and transcripts. SOC 2 Type II audit on roadmap; HIPAA BAA path co-built with first healthcare-adjacent customer. See /security for the full posture.

Cross-border transfer (Quebec Law 25 Article 17)

NeuraVoice Inc. processes personal information primarily in the United States (Google Cloud US regions). For personal information of Quebec residents, we have conducted a privacy impact assessment under Article 17 of Law 25 considering the sensitivity of the information, the purposes of use, the protection measures applied, and the legal framework of the destination jurisdiction. Based on that assessment, we have implemented contractual safeguards with our sub-processors (including Standard Contractual Clauses where applicable, written confidentiality and purpose-limitation commitments, audit rights, and return-or-destruction obligations) that establish a level of protection equivalent to that provided in Quebec. A summary of the PIA is available from the Privacy Officer on request.

Confidentiality incidents

If a confidentiality incident involving a risk of serious injury occurs, we will:

  • Notify the Commission d'accès à l'information du Québec promptly, consistent with Article 3.5 of Law 25;
  • Notify affected individuals where required by Law 25 or other applicable law (including U.S. state breach-notification statutes that may apply if you are a U.S. resident);
  • Maintain a register of confidentiality incidents as required by Article 3.8 of Law 25.

How long we keep it

We retain personal information only as long as necessary to provide the Service and to meet our legal obligations. The following are the maximums we apply by default:

  • Call audio and transcripts: up to 30 days on Starter, up to 90 days on Growth, configurable up to unlimited on Business. Custom shortened windows (down to 7 days) available on request for compliance-sensitive workflows.
  • Account and billing records: kept for the lifetime of the account plus 7 years for tax and audit purposes after closure, consistent with applicable tax law.
  • Analytics cookies: up to 12 months, or sooner if you withdraw consent.
  • Marketing leads: kept until you unsubscribe via the link in any marketing email or by emailing [email protected].

For personal information of Quebec residents specifically, retention is governed by Article 23 of Law 25. We destroy or anonymize the information when the purposes of collection have been achieved, except where retention is required by law (e.g., billing records). The windows above represent the maximums; you may request earlier deletion at any time under your rights below, and we honor verified deletion requests.

Your rights: Quebec / Law 25

If you are a Quebec resident, you have the right to:

  • Access the personal information we hold about you (Article 27).
  • Rectify inaccurate, incomplete, or equivocal personal information (Article 28).
  • Delete or anonymize your personal information when the purposes of collection have been achieved (Article 28.1; the "right to be forgotten").
  • Withdraw consent for processing based on consent, at any time (Article 12).
  • Receive your personal information in a structured, commonly used format (data portability, Article 27).
  • Be informed of and contest automated decision-making that produces legal or similarly significant effects on you, and to request human review (Article 12.1). NeuraVoice does not use your personal information to make solely-automated decisions producing legal effects on callers. If you are a caller whose data is processed because a NeuraVoice customer uses the Service, the customer (as controller of caller data) is responsible for compliance with Article 12.1 vis-à-vis you.
  • File a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) if you are dissatisfied with how we have handled your request or your personal information.

Email [email protected]. We respond within 30 days; complex requests may take up to 90 days. If we cannot fulfill your request, we will explain why and identify any rights of appeal.

Your rights: PIPEDA (Canada outside Quebec)

If you are a resident of a Canadian province other than Quebec, PIPEDA grants you substantively similar rights of access, correction, and withdrawal of consent. Submit requests to the same Privacy Officer contact above. Complaints may be filed with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial privacy regulator where applicable.

Your rights: GDPR / EEA / UK

If GDPR applies to you, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data (the "right to be forgotten"), subject to legal-retention exceptions.
  • Restrict or object to processing in specific circumstances.
  • Portability: receive your data in a machine-readable format.
  • Withdraw consent for processing based on consent, at any time.
  • Lodge a complaint with your local supervisory authority.

Email [email protected]. We respond within 30 days; complex requests may take up to 90 days under Article 12(3).

Your rights: California / CCPA / CPRA

If you are a California resident, you have the right to:

  • Know what personal information we collect, the sources, the purposes, and the categories shared.
  • Delete personal information we have collected about you, subject to statutory exceptions.
  • Correct inaccurate personal information.
  • Opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal information today.
  • Limit use of sensitive personal information.
  • Non-discrimination for exercising any of the above rights.

Submit requests to [email protected]. We honor verifiable consumer requests within 45 days (extendable to 90 for complex cases). We honor Global Privacy Control signals as opt-out requests.

International transfers (summary)

Personal information is processed in the United States by default. For Quebec residents, see the dedicated Cross-border transfer section above (Law 25 Article 17 PIA). For EEA/UK transfers, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. EU and UK data residency is available on request for Growth and Business customers.

Children's privacy

The Service is not directed to children.

  • In Quebec, we will not knowingly collect personal information from a child under 14 without the consent of a parent or tutor (Law 25 Article 14).
  • In the United States, we comply with COPPA (no collection from children under 13 without parental consent).
  • In the EEA / UK, the GDPR age threshold of 16 applies (lower thresholds set by individual member states are honored where applicable).

If you believe we have collected personal information from a child, contact [email protected] and we will delete it.

Sub-processors

We use the following service providers to operate the Service. Each receives only the data necessary for its function. For personal information of Quebec residents shared with sub-processors located outside Quebec, our written agreements include the safeguards required by Article 18.3 of Law 25: purpose limitation, confidentiality, return-or-destruction commitments, and audit rights. We update this list when the sub-processor roster changes and, where practicable, provide advance notice to active customers before material additions:

  • PostHog: product analytics, session replay, heatmaps, error tracking, feature flags. Visitor IPs are anonymized; payment fields and call PHI are masked from session recordings.
  • Stripe: subscription billing and payment processing.
  • Google Cloud (Cloud Run, Cloud SQL, Secret Manager, Text-to-Speech, Firestore, Vertex AI): AI voice agent runtime, application hosting, database, secrets, voice synthesis.
  • Twilio: telephony (PSTN voice + SMS).
  • Firebase Authentication: user identity and access.
  • Cal.com: demo bookings on the marketing site.
  • SendGrid: transactional and marketing email.
  • Cloudflare: CDN, DDoS protection, and Turnstile bot protection on our sign-up and demo forms. Turnstile runs in invisible mode; the data it collects to tell humans from bots is handled per the Cloudflare Turnstile Privacy Addendum.

Language

This Privacy Policy is published in English. A French version is available on request to [email protected] and we will respond within 5 business days. Quebec residents have the right to receive privacy information in French; we honor that right via this on-request mechanism while we develop a fully bilingual public-facing policy.

Changes to this policy

We update this policy as the product and applicable laws evolve. The "Last updated" date at the top reflects the most recent revision. Material changes are surfaced via the cookie banner re-prompt and (for active customers) by email.

Questions

Email [email protected] for privacy questions or to exercise your rights, or [email protected] for security incidents and disclosures. We respond within 5 business days for general inquiries; statutory deadlines apply to formal rights requests.