Last updated: August 13, 2026
This Privacy Policy explains how VoxNote Softwares inc. ("VoxNote," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the VoxNote mobile application, web application, websites, telephone, transcription, summary, voicemail, support, billing, and organization services (collectively, the "Services").
It also applies to people who participate in a call with a VoxNote user, even if they do not have a VoxNote account.
VoxNote Softwares inc., based in Quebec, Canada, is responsible for the personal information described in this Policy unless another organization is identified as responsible. Our Privacy Officer is Tommy Villeneuve and can be reached at [email protected]. The Privacy Officer oversees compliance with Quebec’s Act respecting the protection of personal information in the private sector and VoxNote’s internal privacy policies and receives privacy questions and complaints.
The information we collect depends on which Services and features are used.
We may collect:
When a user signs in through a third-party or company identity provider, we receive the information that the user or identity provider authorizes, such as name, email address, provider account identifier, organization, and session information.
We may collect and generate:
Conversations can reveal sensitive personal information. VoxNote does not ask users to provide health, financial, government identification, or other sensitive information during calls, but such information may be included in a recording, transcript, or summary because of what call participants choose to discuss.
With device permission, the mobile app reads contact information such as names, telephone numbers, email addresses, company names, labels, and contact images. This information is used on the device to display contacts, match a telephone number to a name, and let the user create or edit native contacts.
VoxNote does not automatically upload the user's entire address book. If Contact name sharing is enabled, VoxNote sends the matched telephone number and display name for a person involved in a recent call. The user can turn this setting off. VoxNote's web contact features also let a user create or edit a server-side contact containing a name, telephone number, optional email address, and CRM sync preference.
We may collect:
We collect plan, product, entitlement, subscription status, billing interval, trial and renewal dates, store, seat count, and transaction and customer identifiers. Payment processors and app stores collect payment-card and billing information directly. VoxNote does not store full payment-card numbers.
We and our providers may automatically collect:
We do not intentionally include call audio, transcript text, summary text, contact names, or support content in product analytics events. An error report could nevertheless contain information present in an error message or technical context.
We may receive personal information from:
If a user provides information about another person, the user must have the authority to do so and must provide any notice or obtain any consent required by law.
We use personal information to:
Where the GDPR or UK GDPR applies, our legal bases are:
We do not use solely automated decision-making that produces legal or similarly significant effects. AI is used to transcribe, classify, and summarize communications and to suggest action items; users must review those outputs and should not treat them as professional advice or certified records.
Recording and transcription laws vary by location and context. The VoxNote user who initiates or receives a recording-enabled call is responsible for informing every participant that VoxNote will record, transcribe, and summarize the call and for obtaining any legally required consent. A user must not use VoxNote to record a person unlawfully or against an expressed refusal.
For ordinary calls, a telephony provider temporarily holds the audio while VoxNote transmits it to a transcription provider. After VoxNote saves the transcript, the workflow requests deletion of the temporary recording and the provider's transcript copy. Deletion normally occurs shortly after processing, but retries, provider outages, security incidents, or legal obligations can delay it.
For voicemails, the recording held by our telephony provider is retained for up to 30 days so the user can play it back. The transcription provider's copy is deleted after VoxNote saves the transcript. The voicemail recording is then deleted through a scheduled process.
Transcript text is transmitted to an AI processing provider and the language model needed to create the requested summary or other AI output. VoxNote may use different vetted model providers depending on language, availability, quality, and the requested feature. VoxNote does not use call content to build voiceprints, identify a speaker by biometric identity, or serve personalized advertisements.
VoxNote does not have employees routinely listen to recordings or read call content as part of transcription. Access is restricted, but a limited number of authorized personnel may access personal information when reasonably necessary to provide support requested by a user, investigate a security or service incident, comply with law, or maintain the Services.
We disclose personal information only as described in this Policy.
We use providers that process information for the following purposes:
These providers may maintain their own records as required for security, billing, fraud prevention, legal compliance, or according to their published retention practices.
Specific providers may change as the Services evolve. VoxNote maintains current internal records of its providers and will provide additional information where required by law or a contractual commitment.
We may disclose information if reasonably necessary to comply with law or valid legal process; investigate fraud, abuse, security incidents, or violations of our terms; protect rights, safety, or property; obtain professional advice; or complete a financing, merger, acquisition, reorganization, or sale of assets. A successor must handle personal information consistently with this Policy and applicable law.
The production mobile app uses product-analytics, diagnostics, crash-reporting, and mobile-attribution providers. These providers collect the device, usage, diagnostic, and attribution information described above. An attribution identifier may be associated with subscription events to measure purchase attribution.
We do not use call audio, transcript text, summary text, or support content for personalized advertising. We do not sell personal information for money. However, disclosing device, advertising, campaign, and usage information to a mobile-attribution provider or advertising partners for cross-context advertising measurement may be considered a "sale," "sharing," or targeted-advertising disclosure under some U.S. state laws, even when no money is paid for the information.
Users can limit advertising tracking through iOS Settings > Privacy & Security > Tracking or the applicable Android advertising-privacy settings. Users may also request an opt-out by contacting [email protected]. Limiting advertising identifiers does not disable essential product analytics, security logs, or crash reporting.
Our web Services use local storage, authentication cookies, and similar technology to keep users signed in, remember settings, operate billing, and provide customer support. Browser controls can block or delete these technologies, but doing so may prevent parts of the Services from working. We do not currently respond to legacy browser "Do Not Track" signals. Mobile attribution choices must be exercised through the device settings or by contacting us as described above.
In accordance with Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, we configure the privacy settings of technology products and services offered to the public to provide the highest level of confidentiality by default where that requirement applies, without action by the user. This does not mean that all processing is optional: information reasonably necessary to create an account, place and process calls, secure the Services, administer subscriptions, and provide requested features is handled as described in this Policy.
We design our collection to be limited to personal information reasonably necessary for the purposes identified in this Policy. Ordinary call audio is used to create the requested transcript and AI output and is then deleted through the automated process described in Sections 5 and 9.
Optional features that result in additional disclosure—such as contact name sharing, sending a summary or reminder to a selected email recipient, and CRM or webhook synchronization—require the user or the relevant organization to enable, configure, or initiate them. Available settings can be changed or disabled, although information already delivered to a recipient remains under that recipient’s control. Device permissions and advertising-attribution choices are also subject to the controls provided by the operating system.
We use administrative, technical, and physical safeguards designed for the sensitivity of the information, including:
No security measure can guarantee absolute protection. Users should protect their devices and credentials and contact us promptly if they suspect unauthorized access.
We keep personal information only for as long as reasonably necessary for the purposes described above, subject to legal, security, billing, dispute, backup, and shared-record requirements.
When a user requests account deletion, we first deactivate the account, invalidate sessions, and unassign its VoxNote telephone number. We generally hard-delete the account and associated account data after a one-month recovery and safety period. Our customer-support provider is instructed to archive the user, and user-owned files are removed from object storage.
Some information may remain after account deletion:
VoxNote is based in Canada. Our providers and their subprocessors operate in Canada, the United States, the European Economic Area, the United Kingdom, and other countries. Personal information may therefore be processed outside the user's province, state, or country, where courts, law-enforcement authorities, or regulators may lawfully access it.
Before communicating personal information outside Quebec, or entrusting a provider outside Quebec to collect, use, disclose, or retain it on our behalf, VoxNote conducts and maintains a privacy impact assessment as required by section 17 of Quebec’s Act respecting the protection of personal information in the private sector. The assessment considers the sensitivity and purpose of the information, the destination’s legal framework, and the technical, administrative, and contractual safeguards that will apply. It covers the relevant providers and subprocessors within the assessed transfer.
We proceed with a transfer only where the assessment supports an adequate level of protection. The transfer is governed by a written agreement that takes the assessment into account and requires appropriate privacy and security commitments. Other safeguards may include data-processing agreements, Standard Contractual Clauses, the UK Addendum, reliance on an adequacy decision, or a recognized transfer framework.
Information about an applicable assessment and its safeguards may be requested from our Privacy Officer. We may provide a summary or redact information where necessary to protect security, confidential commercial information, or the privacy of another person.
Depending on where a person lives and subject to legal exceptions, they may have the right to:
Users can update certain profile information and preferences, manage device permissions, unsubscribe using an email link, disable contact name sharing, manage CRM sync settings, and request account deletion in the app or web settings. Other requests can be sent to [email protected].
We may ask for information needed to verify identity and authority. An authorized agent may make a request where permitted by law, but we may require proof of authorization. We will respond within the period required by applicable law. If we deny a request, we will explain the reason and any available appeal or complaint process.
Canadian residents may request access and correction, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. Quebec residents may also have rights to data portability and, in applicable circumstances, to request cessation of dissemination or de-indexation.
Questions or complaints may be directed first to our Privacy Officer. A person may also contact the Office of the Privacy Commissioner of Canada or, for Quebec matters, the Commission d'accès à l'information du Québec.
People in the EEA or United Kingdom may have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. They may complain to the supervisory authority where they live or work, or where an alleged infringement occurred. UK residents may contact the Information Commissioner's Office.
Residents of California and other states with comprehensive privacy laws may have the rights listed above where those laws apply to VoxNote. During the preceding 12 months, we collected and disclosed for business purposes the following categories of personal information:
We have not sold personal information for money. We may have "shared" device, advertising, campaign, and usage information through a mobile-attribution provider for cross-context advertising attribution as that term is defined by California law. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics beyond what is necessary to provide the requested communication and AI features.
California residents may request to know, access, correct, or delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information where applicable; and receive equal service and pricing when exercising their rights. Requests may be submitted at [email protected].
The Services are intended for business and professional users and are not directed to minors. We do not knowingly create accounts for or collect personal information directly from a child under 14 without legally valid parental or guardian consent. In Quebec, this is subject to the limited statutory exception for a collection that is clearly for the minor’s benefit. We do not knowingly sell or share personal information of anyone under 16. If a parent or guardian believes a child has provided personal information, they should contact us so we can investigate and delete it as appropriate.
The Services may link to or integrate with third-party sites, app stores, identity providers, CRMs, and other services that VoxNote does not control. Their privacy policies apply to their independent handling of personal information. Users should review those policies before enabling an integration or sending information to a third party.
We may update this Policy to reflect changes to the Services, our practices, or applicable law. We will post the revised Policy and update the date above. Where required, we will provide additional notice or obtain consent before a material new use of personal information.
Privacy Officer: Tommy Villeneuve
VoxNote Softwares inc.
Quebec, Canada
Please write Privacy Request in the subject line and describe the request and the VoxNote account or call involved. Call participants who do not have an account may provide the telephone number involved and an approximate call date; please do not send a recording or other sensitive content unless we ask for it securely.