Privacy Policy

Effective Date: April 18, 2026
Version: 1.1
Company: 2845341 Ontario Inc. (VocaIQ)

This Privacy Policy explains how 2845341 Ontario Inc., operating under the trade name VocaIQ ("we", "us", or "our"), collects, uses, stores, discloses, and protects personal information when you visit https://vocaiq.ai, use the VocaIQ platform at https://app.vocaiq.ai, or interact with our AI voice agent services (collectively, the "Services"). We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, the General Data Protection Regulation (GDPR) and U.S. state privacy laws including the California Consumer Privacy Act (CCPA).

1. Identity and Contact Details of the Controller

The data controller responsible for your personal information is:

2845341 Ontario Inc. (trading as VocaIQ)
215 Daffodil Court
Ontario, Canada
Email: legal@vocaiq.ai
Website: https://vocaiq.ai

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Business name, contact name, email address, phone number, and industry vertical when you register.
• Billing information: Payment details processed securely through Stripe. We do not store full card numbers or CVV codes.
• Contact submissions: Name, email, phone, company, and message contents submitted through contact forms.
• Configuration data: AI agent instructions, voice settings, call routing rules, and integration credentials you supply when configuring the Services.

2.2 Information Generated Through the Services

• Call data: Audio recordings, AI-generated transcripts, call metadata (duration, timestamp, caller ID), and SMS messages processed through our voice agent platform.
• CRM sync data: Contact records, lead information, and activity logs synchronised with HubSpot at your direction.
• Calendar data: Appointment scheduling information accessed through Google Calendar with your authorisation.

2.3 Information Collected Automatically

• Usage data: Log files, pages visited, feature interactions, browser type, IP address, and session identifiers.
• Device data: Operating system, device type, and time zone.
• Cookies and tracking: As described in our Cookie Policy.

3. How We Use Your Information

We process personal information for the following purposes and legal bases:

• Service delivery (contract performance / legitimate interest): Providing, operating, and maintaining the VocaIQ platform; processing AI voice calls; scheduling calendar appointments; syncing CRM data.
• Billing and account management (contract performance): Processing subscription payments, managing plan changes, sending billing communications.
• Customer support (legitimate interest): Responding to inquiries, troubleshooting issues, and providing technical assistance.
• Service improvement (legitimate interest): Analysing aggregated and de-identified usage patterns to improve platform performance and develop new features. We do not use identifiable call recordings or transcripts to train generalised AI models without your express written consent.
• Security and fraud prevention (legitimate interest / legal obligation): Detecting and preventing abuse, spam, fraud, and unauthorised access.
• Legal compliance (legal obligation): Complying with applicable laws, responding to lawful government requests, and enforcing our agreements.
• Marketing (consent where required): Sending product updates, newsletters, and promotional communications. You may opt out at any time.

We will not sell your personal information to third parties.

4. Google Workspace API Limited Use Disclosure

GOOGLE WORKSPACE API LIMITED USE.

VocaIQ's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

VocaIQ does not use data obtained through Google Workspace APIs to develop, improve, or train generalized artificial intelligence (AI) and/or machine learning (ML) models. All data obtained from Google APIs is used solely to provide and enhance the specific services for which it was collected.

Specifically:

• Google Calendar (calendar.events, calendar.freebusy): VocaIQ accesses these scopes solely to schedule and check availability of calendar events on behalf of the Customer. We do not download or store the contents of existing calendar events, share calendar data with third parties, or use calendar data for advertising or model training purposes.

VocaIQ does not retain any data obtained via Google Workspace APIs beyond the period necessary to fulfill the specific service request.

5. Data Sharing and Disclosure

We share personal information only in the following circumstances:

• Subprocessors: Third-party vendors who process data on our behalf to deliver the Services (see our Subprocessor List). All subprocessors are bound by data processing agreements requiring equivalent protections.
• Legal requirements: When required by applicable law, court order, regulatory authority, or to protect the rights, property, or safety of 2845341 Ontario Inc., our customers, or the public.
• Business transfers: In connection with a merger, acquisition, amalgamation, or sale of substantially all assets, with prior notice and continued protections.
• With your consent: When you have given us explicit, informed consent for a specific disclosure.
• Professional advisors: Lawyers, accountants, and insurers under confidentiality obligations.

We do not share personal information with third parties for their own marketing purposes.

6. International Data Transfers

Your data may be transferred to and processed in countries other than Ontario, Canada, including the United States and the European Economic Area, by our subprocessors. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required under GDPR, and contractual commitments consistent with PIPEDA's accountability principle. For a full list of subprocessor locations, see our Subprocessor List.

7. Call Recording and Caller Data

Call recordings, transcripts, and data from calls processed through the Services belong to the Customer, not 2845341 Ontario Inc.. Customers are solely responsible for providing callers with notice and obtaining their consent for call recordings in compliance with applicable law. VocaIQ's processing of call data is undertaken solely at Customer's direction and as Customer's data processor. Callers whose data is processed through the platform should contact the Customer (i.e., the business whose number they called) directly for data access requests.

8. Data Retention

We retain personal information for as long as necessary to provide the Services and comply with legal obligations:

• Active accounts: Account and configuration data is retained for the duration of your subscription.
• Call transcripts and recordings: Retained for 12 months by default; deletable earlier upon request through your account dashboard.
• Financial records: Billing data is retained for 7 years after account closure for tax and audit compliance.
• Post-termination export window: 30 days following termination.
• Production system deletion: Within 60 days after the export window closes.
• Backup purge: Backup copies purged within 90 days.

9. Security

We implement industry-standard technical and organisational measures to protect personal information, including:

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Role-based access controls and multi-factor authentication for system access
• Row-level security in our database layer
• Annual penetration testing and continuous vulnerability monitoring

For a detailed description, see our Security Overview. No transmission over the internet is 100% secure; please contact us immediately if you suspect unauthorised access to your account.

10. Your Privacy Rights - Canada (PIPEDA)

If you are a Canadian resident, you have the following rights with respect to your personal information:

• Right to know: The right to know why your personal information is collected, used, and disclosed.
• Right to access: The right to access your personal information held by us and receive a copy.
• Right to correction: The right to request correction of inaccurate or incomplete information.
• Right to withdraw consent: The right to withdraw consent at any time with reasonable notice, subject to legal or contractual restrictions.
• Right to responsible use: The right to expect that your personal information is handled responsibly and in accordance with PIPEDA.

To exercise these rights, contact us at legal@vocaiq.ai. We will respond within 30 days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11. Your Privacy Rights - European Union / UK (GDPR)

If you are located in the EU, UK, or EEA, you have the following rights under the GDPR:

• Right of access (Art. 15): To obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Art. 16): To correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): To request deletion of your personal data where there is no legitimate basis for continued processing.
• Right to restriction (Art. 18): To restrict processing in certain circumstances.
• Right to data portability (Art. 20): To receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): To object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7): Where processing is based on consent, to withdraw at any time without affecting prior processing.
• Right to lodge a complaint: With your national data protection supervisory authority.

To exercise these rights, contact us at legal@vocaiq.ai. We will respond within 30 days (or the period required by applicable law).

12. Your Privacy Rights - US States (CCPA and Similar Laws)

If you are a resident of California, Virginia, Colorado, Connecticut, or another U.S. state with a consumer privacy law, you may have the following rights, subject to applicable law:

• Right to know / access: What personal information we collect, use, share, or sell about you.
• Right to deletion: Request deletion of your personal information, subject to certain exceptions.
• Right to correction: Request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell or share personal information for cross-context behavioural advertising. No opt-out is required, but you may contact us to confirm.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at legal@vocaiq.ai. We will respond within 45 days (extendable by a further 45 days with notice).

13. Children's Privacy

VocaIQ is a business-to-business service not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately at legal@vocaiq.ai.

14. Cookies

Our website uses cookies and similar tracking technologies. For details on cookie categories, the cookie registry, and your choices, please see our Cookie Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on https://vocaiq.ai at least 14 days before the changes take effect. The "Effective Date" at the top of this Policy indicates when it was last revised. Your continued use of the Services after the effective date of any update constitutes acceptance of the revised Policy.

16. Contact

For privacy-related questions, requests, or complaints, please contact our Privacy Officer:

2845341 Ontario Inc. - Privacy Officer
Email: legal@vocaiq.ai
Address: 215 Daffodil Court
Website: https://vocaiq.ai

If you are a Canadian resident and are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner of Canada. If you are an EU/UK resident, you may contact your national data protection supervisory authority.