Privacy Policy

Vixly AI builds and operates custom AI voice agents for service businesses. Because of that, personal information reaches us in two very different ways, and the difference decides which rights apply and who you should contact. This policy keeps them separate throughout.

Visitors and prospective clients

People who browse this website, use the ROI calculator, or submit the demo request form. For this information we are the controller — we decide why and how it is processed, and this policy governs it in full.

Clients

Businesses that engage us to build and run an agent. Information about a client's own staff and account is likewise covered by this policy, alongside the client's service agreement.

A client's customers

People who call, text, or message a business whose agent we operate. Here we are a processor acting on that business's instructions: the business decides what is collected and why, its own privacy notice governs, and requests about that information should go to the business first. Section 11 explains how we help when a request reaches us instead.

We collect only what we need, and we would rather list it exactly than describe it in categories. Everything below is the complete set.

Information you give us

When you submit the demo request form we receive and store your name, email address, phone number, business name, website, business type, and company size. If you used the ROI calculator before submitting, the figures you entered and the estimate produced are attached to the request. Nothing on this site requires an account, and we operate no login.

Information you send us directly

If you email or call us, we keep that correspondence and anything you choose to include in it.

Information held only in your browser

Your ROI calculator inputs are saved in your browser's sessionStorage so the figures can carry across to the demo form if you continue. This never leaves your device unless you submit the form, and your browser discards it when you close the tab.

Security and abuse-prevention logs

To stop automated abuse of the demo form, we record submission attempts against a shortened fragment of the network address they came from — deliberately truncated so it cannot identify an individual device — together with the browser's user-agent string, the endpoint, and how long a limit applies. We do not store full IP addresses in these logs.

Call and conversation data

Where we operate an agent for a client, calls and messages handled by that agent are recorded, transcribed, and processed to deliver the service. Section 5 covers this in detail.

We do not buy personal information from data brokers, and we do not enrich or append what you give us from third-party sources.

We use the information described above for the following purposes, and no others:

Responding to you

To reply to a demo request, arrange and prepare for a call, and answer questions you raise. Knowing your business type and size before a call is what lets us make it useful rather than generic.

Providing the service

To build, operate, monitor, and improve the agent we run for a client, including connecting it to the tools that client asks us to connect.

Service communications

To send information relevant to a demo you requested or a service you receive. If we ever send broader marketing updates, every message carries a one-click unsubscribe and honouring it is immediate.

Security and integrity

To detect, prevent, and investigate abuse of this website, and to keep the demo form usable for real visitors.

Legal and record-keeping

To comply with our legal obligations and to keep the business records any company is required to keep.

We do not use your information to train general-purpose AI models, and we do not permit our vendors to use client call data to train their own models for their own purposes.

If you are in the United Kingdom or the European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

Legitimate interests

To respond to a business enquiry you initiated, to secure this website against abuse, and to keep ordinary business records. We have considered your interests and rights in each case and use the minimum information that achieves the purpose.

Performance of a contract

To deliver services to a client, and to take steps at your request before entering into a contract.

Consent

For any marketing communication that requires it. You may withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it.

Legal obligation

Where we must retain or disclose information to comply with the law.

Where we operate an agent for a client, calls and messages that agent handles are recorded and transcribed so the agent can understand the caller, complete the task, update the client's systems, and follow up. This is processed through infrastructure built for handling call data, encrypted in transit and at rest.

Responsibility for notifying callers that a call is recorded, and for obtaining consent where the law requires it, sits with the client operating the agent — they control the greeting and the disclosure. Recording laws vary by state and country, and several US states require all parties to consent. We configure disclosures at a client's direction and will advise on them, but the client remains the controller of that decision.

Our infrastructure is SOC 2-certified and HIPAA-eligible, and we sign a Business Associate Agreement with any client handling protected health information. Call and customer data is handled through systems built for that purpose — not stored casually and not shared elsewhere. When a client's specific setup is finalised, we walk them through exactly what is stored, where, and for how long.

We share personal information only where it is necessary to run the business or the service, and only with parties bound to protect it. We use the following categories of provider:

Website hosting and delivery

Our hosting provider serves this website and processes the connection data any web server necessarily handles in order to deliver a page.

Database hosting

Demo requests and the security logs described in section 2 are stored in a managed database service on our behalf.

Voice agent infrastructure

We build on Retell AI, which provides the voice infrastructure that handles call audio, speech recognition, and transcription for agents we operate.

Email and business tools

Correspondence with you is handled through standard business email and productivity software.

Integrations you ask us to connect

For clients, we connect agents to the tools the client nominates — CRMs, calendars, booking and payment systems such as HubSpot, Google Calendar, Gmail, Google Sheets, Square, or Jobber. Data flows to these at the client's direction, and once it arrives, that provider's own terms and privacy policy govern it.

We may also disclose information where we are legally required to, where it is necessary to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets — in which case we would give notice before your information became subject to a different privacy policy.

We do not sell personal information, and we never have. We also do not share it for cross-context behavioural advertising, and we do not disclose it to advertising networks, data brokers, or list vendors. This is not a policy we intend to revisit; if it ever changed, we would say so here prominently and in advance, and we would offer a means to opt out before the change took effect.

We operate from, and our providers are principally located in, the United States. If you contact us from outside the United States, your information will be transferred to and processed there, where data protection law may differ from your own.

Where we transfer personal information out of the United Kingdom or European Economic Area, we rely on appropriate safeguards for that transfer — in most cases the Standard Contractual Clauses approved by the European Commission, or the UK International Data Transfer Addendum. You can ask us for details of the safeguard applying to a particular transfer.

We keep personal information for as long as it serves the purpose it was collected for, and no longer:

Demo requests

Kept while we are in contact with you and for as long as there is a realistic prospect of working together, then retained only as an ordinary business record. You can ask us to delete a demo request at any point, including immediately after a call.

Correspondence

Kept for as long as needed to maintain a coherent record of our dealings with you.

Client and call data

Retained for the term of the engagement and any period set out in the client's service agreement, which takes precedence over this section. On termination we delete or return it in line with that agreement.

Security logs

Kept only as long as they are useful for detecting and blocking abuse, and they contain no full network address to begin with.

Calculator inputs

Never retained by us at all unless you submit the form. Your browser discards them when you close the tab.

Information is encrypted in transit and at rest. Access to systems holding personal information is limited to the people who need it to do their work, protected by multi-factor authentication, and reviewed as our team changes. Our voice infrastructure is SOC 2-certified and HIPAA-eligible. The demo form is rate-limited and validated on the server to resist automated abuse.

No method of transmission or storage is completely secure, and we will not claim otherwise. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as the law requires and without undue delay.

You have rights over the personal information we hold about you. Some of these apply only in certain places, but the three below we extend to everyone who asks, wherever they live, because we think that is the right way to run this.

Access

You can ask us to confirm whether we hold personal information about you and, if we do, to give you a copy of it together with an explanation of where it came from, what we use it for, and who we have shared it with.

Correction

You can ask us to correct information that is inaccurate, and to complete information that is incomplete. If we have shared the inaccurate information with anyone, we will tell them about the correction where it is possible to do so.

Deletion

You can ask us to delete the personal information we hold about you. We will do so unless we are required to keep it by law, or need it to establish or defend a legal claim — and if either applies, we will tell you which, rather than simply declining.

To exercise any of these, email hey@vixlyai.com and tell us what you would like us to do. Sending the request from the address you originally gave us is the quickest route; if you cannot, we may need to ask for enough information to satisfy ourselves that the request is genuinely yours, and we will ask for the minimum that achieves that. We will not use anything you provide for verification for any other purpose.

We will acknowledge your request within three business days and respond substantively within thirty days. If a request is genuinely complex and we need longer, we will tell you why before that deadline passes and keep you informed. Exercising these rights is free, and we will never treat you differently — in service, price, or otherwise — for having done so.

If your request concerns a call you had with a business whose agent we operate, that business is the controller of that recording. Send your request to them if you can. If you send it to us instead, we will not ignore it: we will pass it to them promptly, tell you that we have, and act on their instruction.

California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to opt out of sale or sharing for cross-context behavioural advertising; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of them. We do not sell or share personal information, and we do not use or disclose sensitive personal information for any purpose beyond providing the service, so there is nothing to opt out of — but the request routes in section 11 are open to you regardless. You may use an authorised agent, and we will ask for proof of their authority.

United Kingdom and European Economic Area

In addition to access, correction, and deletion, you have the right to object to processing based on legitimate interests; to request that we restrict processing while a dispute is resolved; to receive information you gave us in a portable, machine-readable format; and to withdraw consent at any time. You also have the right to lodge a complaint with your data protection authority — in the UK, the Information Commissioner's Office — though we would appreciate the chance to put things right first.

Other US states

Several states now grant residents rights comparable to California's. Rather than track each one, we apply the access, correction, and deletion rights in section 11 to every resident of every state who asks.

This website sets no advertising cookies and no analytics cookies. We do not run Google Analytics or any comparable product, we do not embed advertising pixels or social media trackers, and we do not build profiles of visitors. There is no consent banner on this site because there is nothing to consent to.

The only thing we store on your device is your ROI calculator input, held in sessionStorage so the figures can carry over to the demo form. It is not a cookie, it is never transmitted to us on its own, and your browser deletes it when you close the tab. Clearing your browser's site data removes it immediately.

Our hosting provider processes the connection data any web server must handle to deliver a page. If we ever introduce analytics, we will update this section in the same change that introduces it.

This website and our services are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

This site links to third-party websites and tools we do not control. Following such a link takes you outside this policy, and we are not responsible for the privacy practices or content of those destinations. We would encourage you to read their policies.

We may update this policy as our services or the law change. The date at the top of this page always reflects the current version. Where a change materially affects how we handle information we already hold, we will give notice — by email where we have your address and it is appropriate to use it — before the change takes effect, rather than relying on you to re-read this page.

Questions about this policy, or about how we handle your information, should go to Vixly AI at the address below. A person reads these — it is not a ticketing queue.

Email hey@vixlyai.com. We aim to acknowledge every message within three business days. If you need a postal address for a formal notice, ask and we will provide one.