Privacy Policy

Syntax Voice LLC operates an omnichannel customer support platform from Allen, Texas.

• Where we are the controller. We control the data regarding our direct relationship with you: account holders, billing data, website visitors, and operational records.
• Where we are the processor. We process communications data (call audio, transcripts, SMS, chat, and end-user details) strictly on behalf of the Business using our platform. The Business controls this data. If you contacted a Business, you must direct your data requests to them; we cannot delete or modify their data without their instruction.
• Scope. This policy covers data processing activities related to our platform and does not include third-party services or a Business’s own privacy policies.

• Data you provide. Account identity (hashed passwords, Google and GitHub profiles), workspace configurations, billing details (stored securely with our processor), uploaded knowledge bases, and support correspondence.
• Data processed on a Business’s instructions. Call metadata, live audio, transcripts, AI summaries, text and chat messages, and any details an end user provides to the AI assistant. Workspaces handling protected health information encrypt this data at rest. The Business solely controls recording and AI disclosures.
• Automatically collected data. Access logs, essential session cookies, audit records, error monitoring (scrubbed of medical terminology), and marketing attribution.
• Data from other sources. Identity providers, telecom infrastructure, integrated third-party CRMs and calendars, payment processors, and messaging registries.

We use this data to provide and administer the platform, bill you, secure our infrastructure, communicate service alerts, and meet legal and telecom obligations.

We do not sell personal data or share it for cross-context behavioral advertising. We only disclose data to:

• Sub-processors. Cloud hosts, AI models, and telecom providers, who act strictly as processors under our instructions. The full list is published at Sub-processors.
• Telecom carriers and registries. We must pass routing information and business registration details to carriers to connect calls and register SMS campaigns.
• Mobile opt-in data. We never share, sell, or provide mobile opt-in data or SMS consent to third parties or affiliates for marketing purposes.
• Legal and safety. We will disclose data to comply with lawful subpoenas, enforce our agreements, or protect the safety of the public.

Our platform is hosted and processed entirely in the United States. If you are subject to EU, UK, or Swiss data laws, our Data Processing Addendum provides the necessary transfer clauses.

• Security. We protect data using TLS in transit, storage-layer encryption, AES-GCM at rest for HIPAA data, tenant isolation, and strict access controls.
• Retention. Call data is typically retained for 90 days unless customized. Workspace data is retained for the life of the account. Upon workspace closure, data is permanently deleted following a 30-day grace period, excepting legally required billing or opt-out records.

This section describes the information we receive from Google APIs when you sign in with Google or connect a Google Calendar to a workspace, and how we handle it. It applies in addition to the rest of this policy.

• Sign in with Google. Google shares your name, email address, profile picture, and Google account ID with us. We use them only to create, identify, and run your dashboard account. Signing in does not give us access to your calendar or to any other Google data, and we do not use any sign-in token Google returns to call Google services.
• What we access on a connected calendar. An owner or manager can connect a Google Calendar to a workspace. We then see only the busy time ranges on the connected account’s primary calendar, not what the busy entries are, and we create, reschedule, and cancel the appointment events our assistant books there. We read or change events only on calendars you own, and only the events our assistant created; we read an existing event only to reschedule it. We also receive the connected Google account’s name and email address, which we show in your dashboard so you can see which account is connected.
• How we use calendar data. Only to provide the scheduling features you turn on: offering open appointment times to the people who contact your business, and booking, rescheduling, or cancelling their appointments on your calendar during a call, text message, or web chat. We do not use Google user data for advertising, and we do not sell it.
• How we store it. The access and refresh tokens for a connected calendar are encrypted with AES-256-GCM before they are written to our database. We do not keep a copy of your calendar. The open times offered in a conversation and the details of any appointment booked in it are saved with that conversation’s records. The appointment record we keep so a customer can later reschedule or cancel, which includes the calendar event’s identifier, is kept until the workspace is deleted.
• Who receives it. During a conversation, the open times and appointment details are sent to the language-model provider handling it (OpenAI, Anthropic, or Google) so the assistant can offer and confirm them, and they reach the customer through the providers that carry the assistant’s replies: our text-to-speech providers on calls (Cartesia, with Deepgram as a fallback), and Twilio for calls, text messages (including the appointment confirmation text), and web chat. Our hosting providers store them as described above. The details a customer gives when booking (name, phone number, the service requested, any notes, and an email address if they give one) are written into the event on your calendar, and when an email address is included, Google sends that person invitations and updates when the appointment is booked, moved, or cancelled. Emails we send to your account’s address go through our email provider (Resend). All of these providers are listed on Sub-processors. We do not otherwise share Google user data, except with the sub-processors listed there, or where the law requires it.
• Disconnecting and deletion. You can disconnect Google Calendar from your dashboard at any time. When you do, we send Google a request to revoke our access, and we delete the stored tokens and the connected account’s name and email address. You can also remove our access from your Google Account. If your business account is deleted, the calendar connection and its tokens are deleted with it. To ask us to delete other Google user data we hold, contact us as described in Section 8.

If we process your data on behalf of a Business, submit your request directly to them. If we are the controller, you may request to access, correct, delete, or port your data by emailing hello@syntaxvoice.com. We respect your rights and are committed to transparency in data management.

Our service is for businesses. We do not knowingly collect data from children under 13, or 16 where applicable. Businesses are responsible for COPPA compliance regarding their end users.

We will notify you of material changes to this policy via email or dashboard. Direct inquiries to hello@syntaxvoice.com.