Privacy Policy

RubyVox operates the Services from Dallas, Texas, USA. We serve two audiences:

• Builders — account holders who create voice agents.
• Callers — end users who talk with a builder's voice agent, whether in a browser or by phone.

When you are a builder, RubyVox is the controller of your account data. When a caller interacts with a builder's agent, the builder is the controller of the conversation content and RubyVox acts as a processor on the builder's behalf.

Account information. Name, email, phone number, password hash, plan tier, and profile settings.

Agent content. Instructions, knowledge sources, voice selection, branding, and configuration you provide.

Conversation data. Audio, transcripts, tool calls, and summaries generated when a caller talks with an agent. Callers may also provide their name, phone number, email, or booking details during a conversation.

Caller memory. If a builder enables persistent memory, we store a hashed device token or phone number so a returning caller can be recognized by that specific agent, along with a small structured memory record.

Telephony metadata. Phone numbers, call start and end times, duration, direction, and status codes for calls placed over our telephony providers.

Payment information. Handled by our payment processor. We do not store full card numbers.

Device and usage. IP address, browser, device type, pages viewed, timestamps, and error logs.

Cookies. Authentication and preference cookies necessary to run the app, plus limited first-party analytics.

Voice conversations are transported to our AI voice provider for real-time speech recognition and speech synthesis. Telephone calls and SMS messages route through Telnyx or Twilio. When a builder enables SMS follow-ups, callers must give explicit consent during the conversation before we send a text. Standard message and data rates may apply. Reply STOP to opt out of any RubyVox-originated SMS thread.

Recorded calls, transcripts, and derived summaries are stored for the builder's review. Builders can delete individual calls or disable recording per agent.

• Operate, secure, and improve the Services.
• Route voice, telephony, and messaging through our providers.
• Authenticate accounts and enforce usage caps.
• Send transactional email (receipts, security alerts, account notices).
• Provide analytics to builders about their own agents.
• Detect fraud, abuse, and violations of our Terms.
• Comply with legal obligations.

We do not sell personal information. We do not use caller conversation content to train third-party foundation models.

Where applicable, we process personal data under one or more of: performance of a contract, legitimate interests (operating and improving the Services and preventing abuse), consent (for SMS follow-ups and non-essential cookies), and legal obligation.

We share data with the vendors we need to run the Services. Current subprocessors:

We may also share information to comply with legal process, to protect rights and safety, or in connection with a merger, acquisition, or asset sale.

• Account data: for the life of the account, then deleted within 30 days of account closure.
• Conversation transcripts and recordings: retained per the builder's settings; default 180 days.
• Caller memory: rolling 180-day window unless the builder or caller requests earlier deletion.
• Telephony metadata: 24 months for billing and dispute resolution.
• Logs: 90 days.

Depending on where you live you may have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. Builders can exercise most rights directly in the dashboard. Callers should first contact the builder whose agent they spoke with, since the builder controls that conversation data. You can also email us at privacy@rubyvox.com and we will route your request appropriately.

California residents may exercise rights under the CCPA/CPRA. We do not sell or "share" personal information for cross-context behavioral advertising.

We use encryption in transit (TLS), encryption at rest for our primary database, role-based access controls, row-level security policies, and signed webhooks. No system is perfectly secure; you use the Services at your own risk. Report vulnerabilities to security@rubyvox.com.

Our servers and subprocessors are primarily located in the United States. If you access the Services from outside the U.S. you consent to the transfer and processing of your data in the U.S.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided data, email privacy@rubyvox.com and we will delete it.

We may update this Policy from time to time. Material changes will be announced in the app or by email. The "Last updated" date at the top reflects the current version.

Privacy questions: privacy@rubyvox.com
Security reports: security@rubyvox.com
General: hello@rubyvox.com
Mailing address: Ruby Vox, 6120 Swiss Ave 140333, Dallas, TX 75214