Privacy Policy

This Privacy Policy describes how Torqueshift Inc., a Delaware corporation located at 2810 N Church St, STE 88224, Wilmington, DE 19802, USA ("we", "us"), collects, uses, shares, and protects personal data in connection with the two products it operates: Voisnap (including voisnap.ai, docs.voisnap.ai, and console.voisnap.ai) and Torqueshift (including torqueshift.ai) — together with their consoles, APIs, and AI voice and chat agent services (collectively, the "Service"). One policy applies to both products; where a practice is product-specific, we say so.

This policy covers three groups of people:

• Visitors of our websites;
• Customers — the businesses, government bodies, and their staff who create accounts and operate agents on the platform; and
• End users — the people who talk or write to an AI agent operated by one of our customers (for example by calling a customer's phone number or using a chat widget on a customer's website).

1. Our role: controller vs. processor

For visitor and customer account data, we are the data controller (the "database owner" under Israel's Protection of Privacy Law). For end-user interaction data — audio, recordings, transcripts, messages, and any personal data an end user shares with a customer's agent — we act as a data processor (a "holder" under Israeli law) on behalf of the customer whose agent the end user interacted with. That customer is the controller: it decides why and how that data is processed, including retention and recording settings.

If you interacted with an AI agent operated by one of our customers and wish to exercise privacy rights over that conversation, please contact that business directly. We support our customers in responding to such requests and will forward requests we receive to the relevant customer where we can identify it.

2. Data we collect

Account and billing data (we are controller)

• Name, business email address, company name, role, and login credentials;
• Billing details, plan, currency, and payment status. Card details are collected and processed by our payment provider (Stripe); we do not store full card numbers;
• Support requests, contact-form submissions, and correspondence with us.

Usage and technical data (we are controller)

• Log data such as IP address, browser and device information, timestamps, and pages or API endpoints accessed;
• Service telemetry such as feature usage, agent and conversation counts, durations, and error diagnostics;
• An approximate-location country cookie used to route you to the right region.

Workspace content (we are processor)

• Agent configurations, prompts, knowledge-base documents (including documents our customers link from storage services such as Google Drive or OneDrive), tool and integration settings, and credentials customers store for their own third-party systems (stored encrypted);

End-user interaction data (we are processor)

• Call audio, call recordings (where the customer has enabled recording), transcripts, chat and messaging content, and channel metadata such as the caller's phone number or messaging identifier;
• Information the end user provides during a conversation (for example a name, phone number, or email given to book an appointment), and structured summaries or analyses of the conversation generated for the customer;
• Where a customer operates in a regulated sector under the applicable agreements (see Section 9), interaction data may include health, financial, or other sensitive information that the end user shares with the agent.

3. How we use data

• To provide and operate the Service: run conversations in real time, execute the tools and integrations our customers configure, store recordings and transcripts according to customer settings, and deliver analytics to the customer;
• To create and administer accounts, process payments, and send service notices;
• To secure the Service: authentication, abuse and fraud prevention, and incident investigation;
• To provide support and respond to inquiries;
• To comply with legal obligations and enforce our agreements;
• To improve the Service using aggregated or de-identified usage information that does not identify any person.

Where the GDPR, Israel's Protection of Privacy Law, or similar laws apply, we rely on: performance of a contract (providing the Service), legitimate interests (security, service improvement, business communications), consent where required (for example certain cookies or marketing), and compliance with legal obligations. For end-user interaction data we process on customers' instructions, the customer is responsible for establishing the lawful basis and giving the notices required by the law that applies to it.

4. AI processing and model training

Conversations are processed by third-party AI services (large language models, speech-to-text, and text-to-speech) that we orchestrate as sub-processors. We do not use customer content or end-user interaction data to train our own or any third party's general-purpose AI models, and we access AI providers through service APIs configured so that the providers do not use this data for model training. We do not use the Service to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals; customers are contractually required to apply meaningful human review for any such decisions.

5. Data residency and international transfers

The Service runs on Google Cloud infrastructure in regional deployments, currently: United States (us-east4, Northern Virginia), Israel (me-west1, Tel Aviv), and the European Union (europe-southwest1, Madrid, Spain). A customer workspace is served from its selected region, and its databases, recordings, and transcripts are stored in that region. EU customers can keep workspace data in the EU, and Israeli customers — including enterprises subject to Israeli data-localization expectations — can keep workspace data in Israel.

Some processing can involve other locations: AI model inference depends on the model providers configured for a workspace and may be performed in other regions (EU and Israeli workspaces can be configured with regionally-hosted model endpoints where offered); account, billing, and website data is managed centrally in the United States; and our staff may access data across regions to provide support. Where personal data is transferred internationally, we use appropriate safeguards: for GDPR data, the European Commission's Standard Contractual Clauses (noting also that Israel benefits from an EU adequacy decision); for data from Israeli databases, the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001; and equivalent mechanisms elsewhere.

6. Sharing and sub-processors

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We share personal data only with:

• Sub-processors that help us run the Service, under contracts that restrict their use of the data. Categories and current examples include: cloud hosting and storage (Google Cloud Platform); AI model and speech providers (Google / Vertex AI, OpenAI, Anthropic, ElevenLabs, Amazon Web Services); telephony carriers (Twilio, Telnyx, Vonage); messaging platforms used for the channels a customer enables (Meta Platforms for WhatsApp, Messenger, and Instagram); payments (Stripe); and transactional email (Twilio SendGrid). A current sub-processor list is available on request at privacy@voisnap.ai;
• Our customers — end-user interaction data is made available to the customer whose agent the end user interacted with, and to third-party systems that customer connects (for example its CRM);
• Authorities and other parties where required by law, to protect rights, safety, or the integrity of the Service, or in connection with a merger, acquisition, or sale of assets (with notice where required).

7. Retention

• Account and billing data: for the life of the account and thereafter as required for legal, tax, and accounting purposes;
• Workspace content and end-user interaction data (recordings, transcripts, conversations): for as long as the controlling customer's configuration and plan retain them; customers can delete this data through the console or by request, and can set retention consistent with their own regulatory record-keeping duties;
• After account termination, customer content is deleted following the export window described in our Terms of Service, except where law requires longer retention;
• Residual copies may persist in encrypted backups for a limited period before being overwritten on the regular backup cycle.

8. Security

We maintain an information-security program designed to meet the requirements that apply to us and to our customers in regulated sectors, including the GDPR's security obligations and Israel's Protection of Privacy Regulations (Data Security), 5777-2017. Measures include: encryption in transit (TLS 1.2 or higher, TLS 1.3 preferred) and at rest, with application-layer AES-256-GCM encryption for stored credentials, access tokens, and recordings; per-tenant isolation and role-based access control; selective PII redaction of recordings and transcripts; regional data isolation; least-privilege, logged, and audited access for our personnel; tamper-evident audit trails; security-incident tracking and breach-notification procedures; and periodic penetration testing. A SOC 2 Type II examination program is underway. No method of transmission or storage is completely secure; we encourage customers to use strong credentials and the security features available on their plan.

9. Regulated sectors: healthcare, financial services, government

• Healthcare (HIPAA). Where a customer is a covered entity or business associate under HIPAA and has executed a Business Associate Agreement (BAA) with us, we process protected health information as that customer's business associate, in accordance with the BAA, with features such as PII redaction, consent management, and access audit logs available for such workspaces.
• Financial services. For customers that are financial institutions, we act as a service provider and handle nonpublic personal information in accordance with our Data Processing Agreement and applicable financial-privacy rules (such as the GLBA Safeguards framework in the US and equivalent EU and Israeli requirements).
• Government and public sector. Public-sector workspaces are supported with single-region residency (US, EU, or Israel), tenant isolation, and audit logging; additional jurisdiction-specific requirements apply where agreed in the applicable contract.

Our Data Processing Agreement (with region-specific appendices for the EEA/UK/Switzerland, the United States, and Israel, incorporating the EU Standard Contractual Clauses where applicable) applies automatically to workspaces that process personal data; our Business Associate Agreement is available for execution by healthcare customers — contact legal@voisnap.ai.

10. Your rights

EU/EEA, UK, and Switzerland (GDPR). You may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent, and you may lodge a complaint with your supervisory authority.

Israel (Protection of Privacy Law, 5741-1981, as amended including Amendment 13). You have the right to inspect data held about you and to request correction or deletion of data that is inaccurate, incomplete, or outdated, and you may complain to the Israeli Privacy Protection Authority. Direct-marketing approaches based on personal data may be refused as provided by the Law.

United States. California residents have the rights provided by the CCPA/CPRA, including to know, delete, correct, and to not be discriminated against for exercising rights; we do not sell or share personal information as those terms are defined in the CCPA. Residents of other US states with comprehensive privacy laws have the equivalent rights those laws provide.

To exercise rights over data for which we are the controller, contact privacy@voisnap.ai. We may need to verify your identity before acting on a request, and we will respond within the time required by the applicable law. For conversations you had with a customer's agent, please contact that business (see Section 1).

11. Data deletion requests

You can request deletion of your personal data at any time by emailing privacy@voisnap.ai with the subject "Data deletion request", describing the data concerned (for example, the phone number or messaging account you used, such as a WhatsApp, Messenger, or Instagram identifier, and the approximate date of the interaction). Where we are the processor, we will route the request to the controlling business and delete data at its instruction; where we are the controller, we will delete the data unless we are legally required to retain it, and will confirm completion to you.

12. Cookies

Our websites use only cookies necessary to operate the site, including session and authentication cookies in the console and a country cookie used for regional routing. We do not use third-party advertising cookies on voisnap.ai or torqueshift.ai. If this changes, we will update this policy and request consent where required.

13. Children

The Service is a business product and is not directed to children. We do not knowingly collect personal data from children under 16 as controller. If you believe a child has provided us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date and, for material changes, notify customers by email or in the console before the changes take effect.

15. Contact

Torqueshift Inc. (operating the Voisnap and Torqueshift platforms) · 2810 N Church St, STE 88224, Wilmington, DE 19802, USA · privacy@voisnap.ai