1.
Information We Collect
1.1 Information You Provide
When you register for an account or use the Service, we may collect:
- Full name and business name
- Email address and phone number
- Billing and payment information (processed securely by our payment processor)
- Business configuration data — greetings, services offered, working hours
- Calendar integration credentials (OAuth tokens, stored in encrypted form)
- Communications you send us via email or contact forms
1.2 Information Collected Automatically
When you use the Service, we automatically collect:
- Log data: IP address, browser type, pages visited, time spent, and referring URLs
- Device information: operating system, screen resolution, and device identifiers
- Call metadata: call duration, timestamps, outcomes, and booking records
- Usage analytics: feature interactions, error events, and performance metrics
1.3 Third-Party Integrations
If you connect third-party services (e.g., Twilio for telephony, Vapi, WhatsApp Business, or calendar providers), those services may share certain data with us as described in their respective privacy policies.
2.
How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Process appointments, send confirmations, and deliver WhatsApp/SMS follow-ups on your behalf
- Manage your account and authenticate your identity
- Process billing and prevent fraudulent transactions
- Respond to your support requests and inquiries
- Improve, personalise, and expand our Service through usage analytics of platform interaction data (such as call volumes, durations, and outcomes). Google Calendar data is not used for any analytics purpose.
- Send administrative notices such as updates, security alerts, and policy changes
- Comply with applicable legal obligations
3.
Legal Basis for Processing
We process your personal data on the following legal bases under applicable Indian law (Information Technology Act, 2000 and associated rules) and, where applicable, international privacy frameworks:
- Contractual necessity — to provide the Service you have subscribed to
- Legitimate interests — to improve our Service and prevent fraud
- Consent — where you have expressly consented to specific processing activities
- Legal obligation — to comply with applicable laws and regulations
4.
Cookies & Tracking Technologies
4.1 What We Use
We use cookies and similar technologies (web beacons, pixels, local storage) to operate and improve our Service. Cookies are small text files stored on your device.
4.2 Types of Cookies
- Essential Cookies — required for login sessions and core platform functionality. Cannot be disabled.
- Analytics Cookies — help us understand how users interact with the Service (e.g., page views, feature usage). We may use tools such as Google Analytics.
- Preference Cookies — remember your settings and customisations.
- Marketing Cookies — used to deliver relevant information about our Service. These are only set with your consent where required.
4.3 Managing Cookies
You may control or disable cookies through your browser settings. Please note that disabling essential cookies will impair your ability to use the Service. For opt-out options for analytics tracking, you may use browser extensions such as the Google Analytics Opt-out Add-on.
5.
Sharing of Your Information
We do not sell your personal information. We may share your data with:
- Service Providers — third parties who assist us in operating the Service (e.g., cloud hosting, payment processors, telephony providers). They are contractually bound to protect your data.
- Legal Requirements — we may disclose your information if required by law, court order, or governmental authority.
- With Your Consent — we may share data for other purposes with your explicit consent. Google Calendar data is only shared with third-party services (such as CRM platforms) with the consent of the business client who owns the calendar.
6.
Data Retention
We retain your personal information for as long as your account is active or as necessary to provide the Service. You may request deletion of your account and associated data by contacting us at support@prismavoices.com. We may retain certain data for longer periods to comply with legal obligations or resolve disputes.
7.
Data Security
We implement industry-standard technical and organisational security measures including multi-tenant data isolation, encrypted OAuth token storage, webhook signature verification, and row-level security (RLS). However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
8.
Your Rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete personal data
- Request deletion of your personal data
- Withdraw consent where processing is based on consent
- Object to or restrict certain types of processing
To exercise any of these rights, please contact us at support@prismavoices.com. We will respond within a reasonable timeframe.
9.
Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.
10.
International Data Transfers
Our Service is operated from India. If you access the Service from outside India, your information may be transferred to and processed in India. By using the Service, you consent to such transfer.
11.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the effective date. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.
12.
Google API Services User Data
Prisma Voices integrates with Google Calendar through Google's OAuth platform when a business owner connects their calendar from our dashboard. We request the following OAuth scopes, each used only for the user-facing feature it powers:
- calendar.freebusy — Checks the owner's free/busy times via Google's freeBusy.query endpoint so the AI receptionist can offer time slots that are actually free during a live call. No event titles, descriptions, or attendees are read.
- calendar.events — Creates a single calendar event when a caller confirms a booking, via the events.insert endpoint only. We do not list, read, modify, or delete events the owner did not create through Prisma Voices.
- userinfo.email — Read once at connection time to display the linked Google account email in the dashboard, so the business owner can verify which account is connected and disconnect it.
Limited Use: Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used solely to provide the user-facing features described above; we do not transfer, sell, or share it with third parties for advertising or any other purpose, and we do not use it to develop, improve, or train generalised or large language machine-learning models. OAuth refresh tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256). You may revoke access at any time from your Prisma Voices dashboard or from your Google Account settings at https://myaccount.google.com/permissions; revocation causes us to delete the stored credentials.
We do not:
- Use Google Calendar data for advertising, marketing, or user profiling
- Use Google Calendar data for analytics or to improve, develop, or train Prisma Voices' AI models or any generalised or large language machine-learning models
- Transfer, sell, or share Google Calendar data with any third party, except with the consent of the business client who owns the calendar (e.g., a CRM integration enabled by the client)
- Allow any human to read Google user data unless required by law or explicitly authorized by the user
- Store Google Calendar data beyond what is necessary to complete the booking transaction
13.
Contact Us
If you have questions or concerns about this Privacy Policy, please contact us:
- Email: support@prismavoices.com
- Website: https://prismavoices.com
- Registered entity: PrismaVoices Global LLP, India