Privacy Policy

This Privacy Policy explains what VANA ("we", "us") collects, how we use it, and the choices you have. It covers our website and the AI Receptionist (voice agent) product.

The short version

• The AI Receptionist places and answers calls using AI. We store call metadata and an AI-generated summary of each call — not the raw audio or a full transcript. Voice processing itself happens through our voice and language providers, covered below.
• We don't sell your data, and we don't use your content to train models.
• We don't run analytics or advertising trackers — see Cookies below.
• Sensitive credentials (connected-account tokens) are encrypted at rest.

Information we collect

• Account & authentication. Your email, and either a password or a Google sign-in. If you enable two-factor authentication, we store a TOTP factor via our authentication provider (Supabase) — we never see your authenticator app's codes.
• Billing. Our payment processor (Stripe) collects your payment details. We receive your subscription status, plan, and a customer identifier — never your full card number.
• Business & agent information. When you set up your voice agent, we collect the information you give us about your business (or scrape from a website URL you provide) to generate your agent's call scripts, and we store the phone number(s) associated with your account, including a transfer/escalation number if you set one.
• Call data. For each call your agent handles, we store the direction (inbound/outbound), duration, outcome, and an AI-generated summary of what was discussed. We do not store call recordings or full transcripts — see Calls & AI processing below.
• Lead data. If you connect a CRM or ad account (currently HubSpot or Facebook Lead Ads) so your agent can call your leads, we receive and store the contact information for those leads (name, phone, email, and the raw data those services send us) for the purpose of placing those calls.

Calls & AI processing

Calls handled by your voice agent are carried over the phone network by our telephony provider (Twilio) and processed in real time by our voice AI provider (ElevenLabs), which converts speech to text and back, and by our language model provider (OpenAI), which generates the agent's responses turn by turn. That means the full content of a call is necessarily processed by those providers as part of delivering the service, even though our own systems only retain a short AI-generated summary and call metadata (direction, duration, outcome) — not the raw audio or a full transcript.

If you use the outbound-calling feature, you are solely responsible for ensuring you have the legal right to call the phone numbers you connect or upload — see the Terms of Service for what this requires. Depending on where a call takes place, recording or AI-processing a call may require the consent of everyone on the line under applicable state law; you are responsible for compliance with those laws for calls placed or received on your behalf.

How we use information

• To generate, operate, and improve your AI Receptionist's call handling.
• To place or route calls to leads you've connected, at your direction.
• To process subscriptions, usage-based billing, and provide support.
• To maintain security and improve reliability of the service.

Service providers

We share information with the following providers, only as needed to run the service:

• OpenAI — generates your AI Receptionist's call scripts, and powers the live conversation during calls.
• ElevenLabs — powers the voice (speech-to-text and text-to-speech) for every AI Receptionist call.
• Twilio — the telephony provider carrying your agent's calls; holds the phone number(s) purchased on your behalf.
• Firecrawl — scrapes a business website you provide (public content only) to help generate your agent's scripts.
• HubSpot and Facebook/Meta — if you connect these, we receive lead contact information from your own connected account so your agent can call those leads. Connection tokens are encrypted at rest.
• Stripe — payment processing, subscriptions, and usage-based billing.
• Supabase — authentication and our database.
• Resend — used internally to alert our own team about service issues; no customer or caller data is sent through this.
• Vercel — hosting of our website and APIs.

Security

Sensitive credentials — including access tokens for connected accounts like HubSpot or Facebook — are encrypted at rest. Connections to our services and to our providers use encryption in transit.

Cookies & tracking

We do not use analytics or advertising trackers, and we do not run ad pixels of any kind. We use only strictly necessary cookies: a session cookie to keep you signed in, and a short-lived cookie during the connection process for HubSpot or Facebook to prevent cross-site request forgery.

Data retention

Call audio and full transcripts are not stored by us. Call metadata, summaries, business/ agent configuration, and billing records are retained for as long as your account is active and as needed for legal and accounting purposes. You can request deletion of your account data at any time by contacting us — this is currently a manual process handled by our team, not an automated self-serve tool.

Your choices

• Disconnect HubSpot or Facebook at any time to stop new lead data from being received.
• Cancel your subscription, which stops future billing.
• Request access to or deletion of your personal data by contacting us.

Third-party leads

If you use the AI Receptionist to call leads sourced from your own CRM or ad account, those individuals are not VANA accountholders and haven't agreed to this policy — your organization is responsible for any notice or consent owed to them under applicable law.

Children

VANA is not intended for anyone under 18.

Changes

We'll update this policy as the product evolves and revise the date above. Material changes will be communicated to subscribers.

Contact

Questions? Email privacy@vana.ai.