Privacy Policy

VocaLoop is a product of DronaHQ (“VocaLoop”, “we”, “us”). It lets voice agents hand callers a secure form over WhatsApp, SMS or email during a live call and returns the answers to the agent in real time. This policy explains what we collect, why, and the choices you have. It should be read together with our Terms & Conditions.

Two roles matter here: for data about our own customers (account holders) we act as the data controller; for data your callers submit through your forms we process it on your behalf, and your own privacy notice governs that collection.

• Account information — your name, email address and password (stored hashed), or your Google account identity if you sign in with Google.
• Project content — the projects, forms, templates, branding and integration settings you configure, including any provider credentials you choose to supply.
• Caller submissions — the answers and file uploads callers submit through form links, processed on your behalf and stored so your agents and dashboard can use them.
• Usage and activity data — message counts per channel, AI token usage, activity logs and similar operational records used for billing, quotas and troubleshooting.
• Technical data — log and device information such as IP address and browser type, collected when you use the dashboard or APIs.

• to provide the service: deliver form links, receive submissions and return them to your voice agent mid-call;
• to operate your account, authenticate you and secure the service;
• to meter usage (messages sent, AI tokens consumed) for billing and reporting;
• to support you, investigate issues and prevent abuse;
• to comply with legal obligations.

We do not sell personal data, and we do not use caller submissions to train AI models.

We share data only with service providers needed to run VocaLoop:

• cloud hosting and storage providers that run our infrastructure and store uploads;
• messaging providers that deliver WhatsApp, SMS and email messages;
• AI model providers that process the prompts needed for AI features;
• the voice-agent platform you connect (for example Vapi), which receives the submitted answers for your calls;
• authorities, where the law requires it.

If you configure your own channel credentials, messages on that channel flow through your provider account rather than ours.

Caller submissions and project content are kept while your account and projects exist. Deleting a project deletes its content; deleting your account deletes your data. Two kinds of records survive those deletions: aggregated per-day usage numbers (frozen for billing accuracy) and activity logs, which are kept without their link to the deleted project. Form links expire after the window you configure.

Data is encrypted in transit, passwords are stored hashed, API keys are shown once and can be rotated, and form links are unguessable and time-limited. Access to production systems is restricted. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as required by law.

Depending on where you live, you may have rights to access, correct, export, delete or restrict the processing of your personal data. You can edit your profile and delete projects or your whole account from Settings, or contact us to exercise any other right. If a caller contacts us about data submitted through your forms, we will refer them to you as the controller of that data.

Our infrastructure and service providers may process data in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.

VocaLoop is a business tool and is not directed at children under 16. We do not knowingly collect their personal data as a controller.

We may update this policy from time to time. For material changes we will notify you before they take effect, and the date above always reflects the latest revision.

Privacy questions or requests: inquiries@vocaloop.ai.