Last updated: November 3, 2026
This Privacy Policy explains how VoxNote Softwares inc. ("VoxNote," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the VoxNote mobile application, web application, websites, telephone, transcription, summary, briefing, voicemail, support, billing, organization, and connected-app (MCP) services (collectively, the "Services").
It also applies to people who participate in a call with a VoxNote user, even if they do not have a VoxNote account.
VoxNote Softwares inc., based in Quebec, Canada, is responsible for the personal information described in this Policy unless another organization is identified as responsible. Our Privacy Officer is Tommy Villeneuve and can be reached at [email protected]. The Privacy Officer oversees compliance with Quebec’s Act respecting the protection of personal information in the private sector and VoxNote’s internal privacy policies and receives privacy questions and complaints.
The information we collect depends on which Services and features are used.
We may collect:
When a user signs in through a third-party or company identity provider, we receive the information that the user or identity provider authorizes, such as name, email address, provider account identifier, organization, and session information.
We may collect and generate:
Conversations can reveal sensitive personal information. VoxNote does not ask users to provide health, financial, government identification, or other sensitive information during calls, but such information may be included in a recording, transcript, or summary because of what call participants choose to discuss.
With device permission, the mobile app reads contact information such as names, telephone numbers, email addresses, company names, labels, and contact images. This information is used on the device to display contacts, match a telephone number to a name, and let the user create or edit native contacts.
VoxNote does not automatically upload the user's entire address book. If Contact name sharing is enabled, VoxNote sends the matched telephone number and display name for people involved in the user's calls, including earlier calls in the user's history. If a matched contact has no name, the company name or email address saved for that contact may be used as the display name. The user can turn this setting off. VoxNote's web contact features also let a user create or edit a server-side contact containing a name, telephone number, optional email address, and CRM sync preference.
For cellular calling, the mobile app may create or update a "VoxNote" contact in the device address book containing the VoxNote access numbers used to place calls.
If a user connects an AI app to VoxNote, we keep a connection record containing the app's name and client identifier; the user's identity-provider account, consent, and application identifiers; the permissions granted; and when the connection was created, last used, and disconnected. We do not store the app's access tokens.
For each request from a connected app, we record which tool was used, the outcome and any error code, the duration and response size, whether the request continued an earlier one, and the app's name. These usage records are linked to the user's VoxNote account and sent to our product-analytics provider. They do not include the user's questions, search terms, call identifiers, or call content. We also use the IP address of each request for rate limiting and security.
We may collect:
We collect plan, product, entitlement, subscription status, billing interval, trial and renewal dates, store, seat count, and transaction and customer identifiers. Payment processors and app stores collect payment-card and billing information directly. VoxNote does not store full payment-card numbers.
We and our providers may automatically collect:
We do not intentionally include call audio, transcript text, summary text, contact names, or support content in product analytics events. Text entered on web pages is masked in web analytics. An error report could nevertheless contain information present in an error message or technical context.
We may receive personal information from:
If a user provides information about another person, the user must have the authority to do so and must provide any notice or obtain any consent required by law.
We use personal information to:
Where the GDPR or UK GDPR applies, our legal bases are:
We do not use solely automated decision-making that produces legal or similarly significant effects. AI is used to transcribe, classify, and summarize communications and to suggest action items; users must review those outputs and should not treat them as professional advice or certified records.
Recording and transcription laws vary by location and context. The VoxNote user who initiates or receives a recording-enabled call is responsible for informing every participant that VoxNote will record, transcribe, and summarize the call and for obtaining any legally required consent. A user must not use VoxNote to record a person unlawfully or against an expressed refusal. Calls from callers who hide their number are handled under the same recording rules as other calls.
A user can stop recording or opt out of recording during a call. When they do, VoxNote requests deletion of that call's recording and transcript from our providers.
For ordinary calls, a telephony provider temporarily holds the audio while VoxNote transmits it to a transcription provider. After VoxNote saves the transcript, the workflow requests deletion of the temporary recording and the provider's transcript copy. Deletion normally occurs shortly after processing, but retries, provider outages, security incidents, or legal obligations can delay it.
For some calls, VoxNote transcribes audio live instead of recording it. The audio is streamed to the transcription provider during the call and is not saved as a recording. Interim transcript text is stored encrypted and cleared once the final transcript is saved.
For voicemails, the recording held by our telephony provider is retained for up to 30 days so the user can play it back. The transcription provider's copy is deleted after VoxNote saves the transcript. The voicemail recording is then deleted through a scheduled process.
Transcript text is transmitted to an AI processing provider and the language model needed to create the requested summary or other AI output. Briefings are generated from the summaries and tasks of the calls in the briefing period. VoxNote may use different vetted model providers depending on language, availability, quality, and the requested feature. VoxNote does not use call content to build voiceprints, identify a speaker by biometric identity, or serve personalized advertisements.
We have configured our transcription and AI processing providers so that call audio, transcripts, prompts, and generated outputs are not used to train or improve their models. This applies to the providers VoxNote uses to deliver the Services. It does not apply to a third-party AI app a user connects through the VoxNote MCP server, whose provider's own terms and settings determine whether information it receives is used for training.
VoxNote does not have employees routinely listen to recordings or read call content as part of transcription. Access is restricted, but a limited number of authorized personnel may access personal information when reasonably necessary to provide support requested by a user, investigate a security or service incident, comply with law, or maintain the Services.
VoxNote offers a Model Context Protocol (MCP) server that lets a user connect VoxNote to a third-party AI app that supports MCP, such as ChatGPT or Claude. This feature is available on eligible paid plans and is off until the user sets it up.
Setting up a connection. The user adds the VoxNote MCP server in the AI app and signs in to VoxNote. Our authentication provider then asks the user to authorize that app. VoxNote records the connection as described in Section 2.
What a connected app can read. When the user asks the AI app a question, the app can request the following from the user's own VoxNote account:
A connected app can read only the calls the user took part in and the voicemails left for the user. Belonging to an organization does not give a connected app access to other members' calls. It cannot read calls for which the user opted out of recording, or content that is not available under the user's plan. It cannot access call audio, action items or tasks, other users' internal identifiers, or provider diagnostics. Access is read-only: a connected app cannot create, change, or delete anything in VoxNote, and reading a voicemail through a connected app does not mark it as read.
Responsibility after information is sent. The user chooses the AI app, and that app's provider is not a VoxNote service provider. When the app retrieves information, VoxNote sends it to the app's provider at the user's direction. From then on, the provider's own terms and privacy policy govern how the information is stored, used, and retained, including whether it is kept in chat history or used to train models. Users should review those terms and their settings with the AI provider before connecting.
Other call participants. Transcripts and summaries include what other participants said. A user who connects an AI app is responsible for making sure that sharing call content with that app is consistent with the notice they gave participants and with applicable law.
Disconnecting. In Settings > Connected apps in the VoxNote web app, a user can see their connected apps and when each was last used, and can disconnect any of them. Disconnecting blocks new requests from that app right away, although a request already in progress may finish. It also withdraws the app's authorization with our authentication provider. Disconnecting does not delete information the app has already received, such as content saved in its chats; the user must delete that through the AI app's provider. If an authorization is withdrawn outside VoxNote, the change can take a few minutes to take effect. Connected apps also lose access when the account is deactivated or deleted, and they cannot read content while the user does not have an eligible plan.
We disclose personal information only as described in this Policy.
We use providers that process information for the following purposes:
These providers may maintain their own records as required for security, billing, fraud prevention, legal compliance, or according to their published retention practices.
Specific providers may change as the Services evolve. VoxNote maintains current internal records of its providers and will provide additional information where required by law or a contractual commitment.
We may disclose information if reasonably necessary to comply with law or valid legal process; investigate fraud, abuse, security incidents, or violations of our terms; protect rights, safety, or property; obtain professional advice; or complete a financing, merger, acquisition, reorganization, or sale of assets. A successor must handle personal information consistently with this Policy and applicable law.
The production mobile app uses product-analytics, diagnostics, crash-reporting, mobile-attribution, and affiliate providers. Our web app and websites use product analytics, which records pages, clicks, and performance data and associates them with the signed-in user's identifier and email address. These providers collect the device, usage, diagnostic, and attribution information described above. An attribution identifier may be associated with subscription events to measure purchase attribution.
We measure our advertising with advertising platforms and with app-store and mobile-attribution providers. We and these partners use pixels, cookies, software development kits, and server-to-server connections to record conversion events, such as sign-up, trial start, and purchase, which may include purchase value and currency. These events can include the IP address, browser or device information, ad-click identifiers, and hashed versions of the user's email address, name, telephone number, and user identifier. Hashing converts these values into codes, which the platform compares with its own records to attribute the conversion.
We do not use call audio, transcript text, summary text, contact names, or support content for advertising, and we do not intentionally send them to advertising platforms. We do not sell personal information for money. However, these advertising disclosures may be considered a "sale," "sharing," or targeted-advertising disclosure under some U.S. state laws, even when no money is paid for the information.
Users can limit advertising tracking through iOS Settings > Privacy & Security > Tracking or the applicable Android advertising-privacy settings, block or delete advertising cookies in their browser, and manage their ad settings with the advertising platforms they use. Users may also request an opt-out by contacting [email protected]. Limiting advertising identifiers does not disable essential product analytics, security logs, or crash reporting.
Our web Services use local storage, authentication cookies, and similar technology to keep users signed in, remember settings and sign-up progress, operate billing, and provide customer support. They also use analytics and advertising cookies as described above. Browser controls can block or delete these technologies, but blocking essential cookies may prevent parts of the Services from working. We do not currently respond to legacy browser "Do Not Track" signals. Mobile attribution choices must be exercised through the device settings or by contacting us as described above.
In accordance with Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, we configure the privacy settings of technology products and services offered to the public to provide the highest level of confidentiality by default where that requirement applies, without action by the user. This does not mean that all processing is optional: information reasonably necessary to create an account, place and process calls, secure the Services, administer subscriptions, and provide requested features is handled as described in this Policy.
We design our collection to be limited to personal information reasonably necessary for the purposes identified in this Policy. Ordinary call audio is used to create the requested transcript and AI output and is then deleted through the automated process described in Sections 5 and 9.
Optional features that result in additional disclosure—such as contact name sharing, sending a summary, transcript, briefing, or reminder to a selected email recipient, connecting an AI app through the VoxNote MCP server, and CRM or webhook synchronization—require the user or the relevant organization to enable, configure, or initiate them. Available settings can be changed or disabled, although information already delivered to a recipient remains under that recipient’s control. Device permissions and advertising-attribution choices are also subject to the controls provided by the operating system.
We use administrative, technical, and physical safeguards designed for the sensitivity of the information, including:
No security measure can guarantee absolute protection. Users should protect their devices and credentials and contact us promptly if they suspect unauthorized access.
We keep personal information only for as long as reasonably necessary for the purposes described above, subject to legal, security, billing, dispute, backup, and shared-record requirements.
When a user requests account deletion, we first deactivate the account, invalidate sessions, and unassign its VoxNote telephone number. We generally hard-delete the account and associated account data after a one-month recovery and safety period. Our customer-support provider is instructed to archive the user, and user-owned files are removed from object storage.
Some information may remain after account deletion:
VoxNote is based in Canada. Our providers and their subprocessors operate in Canada, the United States, the European Economic Area, the United Kingdom, and other countries. Personal information may therefore be processed outside the user's province, state, or country, where courts, law-enforcement authorities, or regulators may lawfully access it.
Before communicating personal information outside Quebec, or entrusting a provider outside Quebec to collect, use, disclose, or retain it on our behalf, VoxNote conducts and maintains a privacy impact assessment as required by section 17 of Quebec’s Act respecting the protection of personal information in the private sector. The assessment considers the sensitivity and purpose of the information, the destination’s legal framework, and the technical, administrative, and contractual safeguards that will apply. It covers the relevant providers and subprocessors within the assessed transfer.
We proceed with a transfer only where the assessment supports an adequate level of protection. The transfer is governed by a written agreement that takes the assessment into account and requires appropriate privacy and security commitments. Other safeguards may include data-processing agreements, Standard Contractual Clauses, the UK Addendum, reliance on an adequacy decision, or a recognized transfer framework.
Information about an applicable assessment and its safeguards may be requested from our Privacy Officer. We may provide a summary or redact information where necessary to protect security, confidential commercial information, or the privacy of another person.
Depending on where a person lives and subject to legal exceptions, they may have the right to:
Users can update certain profile information and preferences, manage device permissions, unsubscribe using an email link, manage call-email and briefing settings, disable contact name sharing, manage CRM sync settings, disconnect connected AI apps, stop or opt out of recording a call, delete voicemails, and request account deletion in the app or web settings. Other requests can be sent to [email protected].
We may ask for information needed to verify identity and authority. An authorized agent may make a request where permitted by law, but we may require proof of authorization. We will respond within the period required by applicable law. If we deny a request, we will explain the reason and any available appeal or complaint process.
Canadian residents may request access and correction, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. Quebec residents may also have rights to data portability and, in applicable circumstances, to request cessation of dissemination or de-indexation.
Questions or complaints may be directed first to our Privacy Officer. A person may also contact the Office of the Privacy Commissioner of Canada or, for Quebec matters, the Commission d'accès à l'information du Québec.
People in the EEA or United Kingdom may have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. They may complain to the supervisory authority where they live or work, or where an alleged infringement occurred. UK residents may contact the Information Commissioner's Office.
Residents of California and other states with comprehensive privacy laws may have the rights listed above where those laws apply to VoxNote. During the preceding 12 months, we collected and disclosed for business purposes the following categories of personal information:
We have not sold personal information for money. We may have "shared" device, advertising, cookie, campaign, usage, and purchase-conversion information, and hashed email addresses, names, telephone numbers, and user identifiers, with mobile-attribution providers and advertising platforms for cross-context behavioural advertising as that term is defined by California law. Information a user directs VoxNote to send to a connected AI app is a disclosure at the user's direction, not a sale or sharing by VoxNote. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics beyond what is necessary to provide the requested communication and AI features.
California residents may request to know, access, correct, or delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information where applicable; and receive equal service and pricing when exercising their rights. Requests may be submitted at [email protected].
The Services are intended for business and professional users and are not directed to minors. We do not knowingly create accounts for or collect personal information directly from a child under 14 without legally valid parental or guardian consent. In Quebec, this is subject to the limited statutory exception for a collection that is clearly for the minor’s benefit. We do not knowingly sell or share personal information of anyone under 16. If a parent or guardian believes a child has provided personal information, they should contact us so we can investigate and delete it as appropriate.
The Services may link to or integrate with third-party sites, app stores, identity providers, CRMs, AI apps connected through the VoxNote MCP server, and other services that VoxNote does not control. Their privacy policies apply to their independent handling of personal information. Users should review those policies before enabling an integration or sending information to a third party.
We may update this Policy to reflect changes to the Services, our practices, or applicable law. We will post the revised Policy and update the date above. Where required, we will provide additional notice or obtain consent before a material new use of personal information.
Privacy Officer: Tommy Villeneuve
VoxNote Softwares inc.
Quebec, Canada
Please write Privacy Request in the subject line and describe the request and the VoxNote account or call involved. Call participants who do not have an account may provide the telephone number involved and an approximate call date; please do not send a recording or other sensitive content unless we ask for it securely.