Privacy Policy

Introduction

This Privacy Policy describes how Vexa, Inc. ("Vexa", "we", "our" or "us") collects, uses and shares personal data when you visit vexavoice.tech, create an account, or use the Vexa voice-agent testing platform. It also describes your rights regarding your personal data and how to exercise them.

Vexa is incorporated in Delaware and headquartered in San Francisco, California. We serve customers worldwide. We act as a data controller for the personal data of our users and, where applicable, as a data processor for agent configuration and test-result data we process on your behalf.

Vexa tests voice agents using simulated callers, not real customers. Our platform does not process live call audio from your customers or collect personal data from your end-users. The callers in a Vexa test suite are synthetic voices controlled by our simulation engine. This is a core design choice, not a preference, so that your customers are never exposed to a test environment and their data is never in scope.

By using our service you acknowledge that you have read and understood this policy. If you do not agree with our practices, please do not use the service.

Information we collect

Account information

When you register for Vexa we collect the information you provide directly: your name, work email address, company or organisation name, job title and, if you subscribe to a paid plan, your billing address and business tax identification number. Payment card details are handled exclusively by our payment processor and are never stored on Vexa systems.

Agent configuration and connection details

When you set up a test suite, you provide the details Vexa needs to connect to your voice agent: endpoint URLs, authentication credentials, telephony provider configuration, and the scenario library you want to run. This configuration is yours, it is confidential, and it is used only to run test suites on your behalf. Credentials are encrypted at rest and are not logged in plaintext.

Test transcripts and scores

Every simulated call Vexa runs produces a transcript of the exchange between the synthetic caller and your agent, together with scored signals: task success, tone, response latency, barge-in events, and estimated word error rate. These results are associated with your workspace and are not shared with other customers. Because simulated callers are synthetic, these transcripts contain no personal data from real individuals.

Usage data

We collect information about how you interact with the platform: pages and features visited, test suites launched, reports opened, API request counts and timestamps, and session duration. We also collect standard server logs, including your IP address, browser type, device type, and referring URL. Usage data is processed to operate, secure, and improve the service.

Communications

If you contact us by email, via a form, or through in-app messaging, we retain the content of that communication to respond to you and to keep a record of our interaction.

How we use it

• To create and manage your account and to provide the voice-agent testing service described in our Terms of Service.
• To run simulated test calls against the voice agents you configure, score each call on task success, tone, latency, interruption, and transcription accuracy, and deliver results and regression alerts to your workspace.
• To process payments and issue invoices.
• To send transactional communications: account notices, password resets, receipts, regression alerts, and service updates.
• To send product updates and marketing communications if you have opted in. You may opt out at any time by clicking the unsubscribe link in any email or by writing to hello@vexavoice.tech.
• To monitor the security of the platform, investigate suspicious activity, and prevent abuse.
• To improve the platform based on aggregated, de-identified usage patterns. We do not use your agent configuration, test transcripts, or scores to train shared models.
• To comply with applicable law and to respond to lawful requests from public authorities.

Speech providers, language models, and subprocessors

Vexa is model-agnostic. Running a simulated test suite involves synthesising caller voices (speech synthesis), transcribing call audio (speech-to-text), and scoring call quality (language model inference). For each of these functions, we route tasks to third-party providers. We send only the content required for that specific function: audio content for transcription, transcript content for scoring, text content for voice synthesis. We do not send your full workspace configuration or test history to any inference provider.

Some customers bring their own speech or language model providers as part of their agent stack. In those cases, data processed by those providers is subject to the contracts between you and those providers. Vexa's subprocessor commitments cover the providers we operate on your behalf.

We do not train, fine-tune, or otherwise update any model on your agent configuration, your test transcripts, or your scores. Our provider contracts include data-processing terms that prohibit training on customer inputs.

Beyond inference providers, we engage a small number of third-party subprocessors to provide the service. Current categories include cloud infrastructure and storage, payment processing, transactional email, and error monitoring. We maintain a subprocessor list and will notify customers of material changes at least 14 days in advance. You may request the current list by writing to privacy@vexavoice.tech.

Data sharing

We do not sell your personal data. We do not share your personal data with third parties for advertising or behavioural tracking. We do not rent or trade your data. The only circumstances in which we share personal data are:

• Subprocessors. We share the minimum data necessary with the subprocessors listed above, under appropriate contractual protections, to operate the service.
• Legal obligation. If we are required by law, court order, or valid governmental request to disclose personal data, we will comply and, where legally permitted, will notify you promptly.
• Business transfers. In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
• Protection of rights. We may disclose data where we believe it is necessary to protect the rights, property, or safety of Vexa, our users, or the public.

Security

We implement industry-standard technical and organisational measures to protect your data. These include TLS encryption for all data in transit and AES-256 encryption for data at rest. Access to production systems is restricted by role, audited, and reviewed regularly. Credentials stored in your agent configuration are encrypted at rest with keys that are not accessible to application-layer logs.

No security measure is absolute. If you discover or suspect a security vulnerability, please report it to security@vexavoice.tech. We will acknowledge your report within 48 hours and work to resolve confirmed issues promptly.

Cookies

We use cookies to operate the service and to understand how it is used. We set only the cookies necessary for the service to function: a session token to keep you signed in and a CSRF token to protect form submissions. We do not set advertising, tracking, or third-party analytics cookies.

For a full description of the cookies we set, their purpose, and how to manage them, see our Cookie Policy.

Data retention and deletion

We keep your account data for as long as your account is active and for a reasonable period after closure in case of disputes or to comply with legal obligations. We keep financial and billing records for seven years to satisfy US tax and accounting requirements. Server logs are retained for 90 days and then deleted.

Test transcripts, scores, and agent configuration associated with your workspace are retained for the duration of your active subscription and for 30 days after cancellation or account closure, after which they are deleted from our systems. If you wish to delete workspace data before that window closes, write to privacy@vexavoice.tech and we will action the request within 14 days.

You may export your test results and configuration at any time from your account settings before closing your account.

Children

The Vexa platform is a business service intended for use by professionals at least 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at privacy@vexavoice.tech and we will delete it promptly.

Your rights

Depending on where you are located, you may have the following rights with respect to your personal data. To exercise any of them, write to privacy@vexavoice.tech. We will respond within 45 days (or within one calendar month where EU or UK GDPR applies).

All users may at any time:

• Update or correct your account information via the platform settings.
• Opt out of marketing communications using the unsubscribe link in any email.
• Export your test results, transcripts, and agent configuration from account settings.
• Request deletion of your account and associated data.

California residents (CCPA/CPRA) additionally have the right to:

• Know. Request disclosure of the categories and specific pieces of personal information we hold about you, the sources from which it was collected, the business purposes for collection, and the categories of third parties with whom we share it.
• Delete. Request deletion of personal information we hold about you, subject to certain exceptions permitted by law.
• Correct. Request correction of inaccurate personal information we hold about you.
• Opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising. If this changes, we will provide a clear opt-out mechanism before the change takes effect.
• Non-discrimination. We will not deny, charge different prices, or provide a different level of service because you exercised any of your CCPA/CPRA rights.

EU and UK residents (GDPR/UK GDPR) additionally have the right to:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete personal data.
• Erasure. Ask us to delete your personal data where there is no legitimate reason for us to continue processing it.
• Portability. Where processing is based on consent or contract and carried out by automated means, receive your data in a structured, commonly used, and machine-readable format.
• Restriction. Ask us to restrict processing in certain circumstances, for example while a rectification request is under consideration.
• Objection. Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdrawal of consent. Where processing is based on consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Lodge a complaint. If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with your national supervisory authority. UK residents may contact the Information Commissioner's Office at ico.org.uk.

International transfers

Vexa is operated from the United States. If you access the service from outside the United States, your personal data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

We serve customers worldwide and take the protection of personal data seriously regardless of where our customers are located. Where personal data originating in the European Economic Area or the United Kingdom is transferred to the United States, we rely on the EU-US Data Privacy Framework, the UK Extension thereto, or Standard Contractual Clauses approved by the European Commission to provide an equivalent level of protection. Details of the transfer mechanisms we rely on are available on request.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the service, or applicable law. Where a change is material, we will notify you by email and by a prominent notice in the platform at least 14 days before the change takes effect. The last-updated date at the top of this page reflects when the current version took effect.

Contact

If you have questions about this policy, want to exercise your privacy rights, or have a concern about how we handle your data, please contact our privacy team:

• Privacy enquiries: privacy@vexavoice.tech
• Security disclosures: security@vexavoice.tech
• Post: Privacy, Vexa, Inc., 340 Bryant Street, Suite 300, San Francisco, CA 94107