Privacy Policy: What You Need to Know

PRIVACY POLICY

Last update: 03.02.2026

The protection of personal data and respect for privacy are core values of our organization. This Privacy Policy (“Privacy Policy”) explains how BYVOICE (“BYVOICE,” “we,” “us,” or “our”), a company incorporated under the laws of Poland, collects, uses, and safeguards personal data in compliance with applicable data protection laws.

This Policy describes the purposes and methods of our data processing activities and outlines the measures we take to protect your information. We are committed to handling personal data responsibly and in accordance with this Privacy Policy and all relevant legal requirements.

Before providing any personal data, please read this Policy together with our Terms of Service (“Terms”).

If you have questions about this Policy or wish to exercise your data protection rights, please contact us at privacy@byvoice.io.

SCOPE OF THIS POLICY

This Privacy Policy covers the personal data we collect and process in connection with your use of our Website and Services.

a) We act as the data controller for personal data collected and processed directly through our Website, where we determine the purposes and means of processing.
b) We act as the data processor for personal data processed in connection with your use of third-party products and services integrated into our platform (“Services”), where the relevant third-party providers define the purposes and means of processing.

Where we act as a data processor, the terms of the Data Processing Addendum (DPA) apply and are incorporated by reference into this Privacy Policy: https://www.byvoice.io/data-processing-agreement.

This Privacy Policy does not apply to personal data processing carried out by those third-party providers, who act as independent controllers and bear sole responsibility for complying with their own privacy obligations. We strongly recommend reviewing the privacy policies of such providers before using their products or services through our platform.

This Privacy Policy applies to the processing of personal data by the controller in connection with the operation of the website https://www.byvoice.io/ and its related pages, including all associated domains and subdomains (collectively, the “Website”), as well as the provision of Services.

The term “Services” refers to all products, features, and functionalities offered by the controller to customers. For the purposes of the Privacy Policy, a customer is defined as both those who use our Services and those who are interested in using the Services.

Any questions regarding the processing of personal data by end users of the Services are governed by the End-User Privacy Policy, which complements this Privacy Policy.

HOW DO WE PROCESS PERSONAL DATA?

We process your personal data solely when it is necessary to fulfill the specific purpose for which it was collected and only to the extent required for that purpose. In addition, we retain your personal data for a limited period and delete all copies once the retention period has expired.

We do not make decisions using solely automated processing or profiling based on your personal data. Any decision that may have a significant impact on you is made with meaningful human involvement. We are committed to preserving human judgment in all matters affecting our customers.

We collect personal data in the following ways:

when you provide us with personal data. You provide us with your personal data in order to realize the purposes of the processing. For example, we require certain information you provide in order to deliver our services and fulfill the purposes for which the data is collected;
when personal data is collected automatically. There are tools that allow us to collect technical personal data about you when you use Website and Services. For certain purposes (e.g. to maintain the correct operation of the Website and Services), we automatically collect your personal data where there is a legal basis to do so.

PLEASE NOTE THAT WE DO NOT COLLECT AND PROCESS YOUR PAYMENT CARD DATA (NUMBER, HOLDER, EXPIRATION DATE, ETC.). PAYMENT FOR SERVICES IS MADE THROUGH A THIRD-PARTY SERVICE THAT DIRECTLY COLLECTS AND PROCESSES YOUR PAYMENT DATA.

PURPOSES OF COLLECTING YOUR DATA

We do not have access to calls and text messages that occur between the customer and his end users. Below, you will find a detailed overview of the purposes for which we process personal data of Website visitors and Service users, the categories of personal data involved, the legal basis for processing, and the applicable data retention periods.

Processing of personal data when you use our Website and Services:

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

Email marketing campaigns and promotion of brand awareness

Contact Details: Name, job title, company, business email, phone number, region or country, and IP address.

Technical Identifiers: Tracking pixels, link tracking data, and similar analytics tools.

3 years after obtaining consent

Consent

BYVOICE may send promotional emails about its products and services, including updates, integrations, surveys, event invitations (e.g., webinars), and informational materials such as guides and e-books. For digital marketing purposes, BYVOICE may utilize online platforms and internet-based technologies. All marketing communications are sent in compliance with applicable data protection laws, and recipients have the option to opt out of receiving such emails at any time.

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

Providing a personalized offer

Contact Details: Name, job title, company, business email, phone number, region or country, and IP address.

Communication Records: Audio recordings of demo or support calls and chat transcripts, collected for quality assurance, training, and service improvement purposes.

Duration of using our Services and 1 year after

Legitimate Interest – the recordings and chat transcripts are used to tailor or customize offers specifically for the individual if they are Customer’s representative

When you communicate with an AI agent for a demo, BYVOICE may record the call or save the chat transcript. This information is used to provide a personalized offer. Recording and storage are conducted in compliance with data protection laws and with your consent.

Processing of personal data when you use our Services:

Purpose of Processing / Legal basis	Categories of Personal Data	Data Retention Period
Management of customer accounts	Contact Information: Data imported from contact lists or provided directly by the customer (e.g., names, phone numbers, and email addresses).	Duration of using our Services and 3 years after
Performance of a contract (Art. 6(1)(b) GDPR)		Duration of using our Services and 3 years after

We collect and process personal data necessary for managing your customer account, ensuring a smooth and personalized user experience, and enhancing our products and Services.

Purpose of Processing / Legal basis	Categories of Personal Data	Data Retention Period
Enhancing and improving user experience and products/services	Contact Information: Data imported from contact lists or provided directly by the customer (e.g., names, phone numbers, and email addresses).	Duration of using our Services and 3 years after
Performance of a contract (Art. 6(1)(b) GDPR)		Duration of using our Services and 3 years after

In order to properly fulfill our obligations under the agreement, BYVOICE needs to ensure and enhance user experience, improve and administer products and services. That is why we may use account data, contact data, financial/payment data etc.

Purpose of Processing / Legal basis	Categories of Personal Data	Data Retention Period
Analyzing customer interactions and feedback	Contact Information: Data imported from contact lists or provided directly by the customer (e.g., names, phone numbers, and email addresses).	3 years from the date of analysing
Legitimate interest (Art. 6(1)(f) GDPR) to improve and support service quality		3 years from the date of analysing

To improve the quality of our Services it’s necessary to BYVOICE to perform analyzing user behavior within the product; manual analysis of customer usage and communication by Success Managers; analysis of customer feedback unless you opted out. These actions are carried out in accordance with our interests and yours, so we may use the personal data you provide.

Purpose of Processing / Legal basis	Categories of Personal Data	Data Retention Period
Conducting testing, analytics, and research	We do not directly collect personal data that can directly identify you, but from time to time the questionnaire may ask for information related to you. We anonymize this information and use it for analytical and statistical purposes.	Duration of using our Services and 1 year after
Consent (Art. 6(1)(a) GDPR) for analytics and research where applicable		Duration of using our Services and 1 year after

BYVOICE may use of сustomer data for testing, analytics and research (upon express consent) in order to provide the best quality of services. We will definitely request your consent before using it.

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

Conducting and accounting of payments for the provision of services

Please note that we don’t process or have access to your personal data related to making payments (bank card details, payment card expiration date, the security code, others). Your personal data related to making a payment is processed by the third-party payment providers we engage to process and make your payment.

And such processing is governed by their terms of service and privacy policies. We strongly recommend that you review the terms of service and privacy policies of these third parties to learn more about how they handle your personal data.

Duration of using our Services and some period of time due to the legal requirements

Performance of a contract (Art. 6(1)(b) GDPR) – to bill customers for services rendered

Payment for Services is an integral part of their realization, for this reason we may use your account or financial/payment data to administer billing and payment collection, handle payment-related inquiries and claim payment of outstanding invoices.

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

Processing customer requests

– Customer Contact Data: Names, phone numbers, email addresses, and other contact details provided by customer.

– Communication Data: Сall recordings and chat transcripts.

Until the matter you have requested is resolved, but usually not more than 3 months

Legitimate interest (Art. 6(1)(f) GDPR) – to provide effective customer support and service

You may have requests while using our Services. To coordinate and analyze support requests submitted via the BYVOICE website we may use the personal data you provide.

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

Providing technical notifications

– Customer Contact Data: Names, phone numbers, and email addresses.

– Service Usage Information: Data on how the customer uses and interacts with the service.

Duration of using our Services and 3 years after

Legitimate interest (Art. 6(1)(f) GDPR)

BYVOICE may use your account data and information about service usage to send you information on technical updates, billing warnings and possible security incidents, as well as updates to platform, Terms of Service, tariff plans, and Privacy Policy. It’s necessary for you to stay informed about changes in BYVOICE’s Services.

Purpose of Processing / Legal basis

Categories of Personal Data

Data Retention Period

To ensure security and compliance

– Customer Contact Data: Names, phone numbers, and email addresses.

– Usage of Billable Features: Information on the use of paid functionalities (e.g., LLM).

– User Information: Pages visited, features used, device details, IP address, and browser type.

Duration of using our Services

Legitimate interest (Art. 6(1)(f) GDPR) – to maintain security, integrity, and reliability of systems and AI models

BYVOICE may collect your contact, account data and other user information when ensuring lawful service use, preventing fraud, analyzing registration and usage metrics, detecting suspicious activity, implementing security measures and monitoring AI performance to ensure quality and compliance (unless opted out).

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We keep your personal data for as long as necessary to fulfill the purpose of the processing. Specific timeframes were specified in Section 3.

Under certain circumstances, we may be required to retain your personal data for a longer period of time in accordance with applicable law or regulatory requirements. This may include but is not limited to, situations involving legal proceedings, investigations, or government inquiries. We will only retain your personal data for as long as necessary to comply with these legal obligations, and we will take appropriate measures to ensure its security and confidentiality during this period.

SHARING YOUR DATA WITH THIRD PARTIES

Legal Requirements and Protection

We may disclose personal information when required by law, regulation, legal process, or governmental request. This includes responding to subpoenas, court orders, or other lawful demands. Additionally, we may share personal information when we believe it is necessary to protect our rights, enforce our Terms, investigate fraud or security incidents, or ensure the safety of our customers and the public.

Service Providers and Business Partners

We may share personal information with carefully selected service providers and business partners who assist us in operating the Website, delivering Services, and enhancing the customer experience. These third parties are authorized to use personal information solely as necessary to perform services on our behalf and are expected to implement appropriate safeguards.

A complete list of third parties with whom we share personal data can be found at the following link: Third parties we share personal data with.

While we carefully vet our partners, it is important to note that we cannot guarantee absolute compliance with data protection laws in all circumstances. We recommend reviewing the privacy policies of these third parties to understand how they handle your personal data.

We transfer personal data to third parties in accordance with GDPR requirements. Whenever possible, we enter into Data Processing Agreements with these parties and treat such data transfers with the utmost care. Where applicable, we may incorporate the partner’s existing data processing agreement to formalize compliance.

HOW WE PROCESS COOKIES?

To enhance your experience and improve our Services, we may use cookies. BYVOICE manages the collection of information through cookies on your device. By using the Website, you consent to our use of cookies as described in this section.

For the purposes of this Privacy Policy, “cookies” are text files containing small amounts of data that help identify your device and remember information about your visit to the Website. Cookies store or access information on your devices to enhance the functionality and performance of our Website.

For more details on the types of cookies we use and how to manage them, please see our Cookie Policy.

YOUR RIGHTS

As a data subject, you have certain rights regarding your personal information. We are committed to upholding these rights and ensuring that you can exercise them effectively.

Below, you can find the information regarding your rights as a data subject:

Your Right to Access	You have the right to obtain a copy of the Personal Data we hold about you. We also provide any additional information to ensure transparency about how your data is processed.
Your Right to Rectification	If any of your Personal Data is incomplete or inaccurate, you can request a correction to ensure our records are up to date.
Your Right to Erasure	Under certain conditions, you may ask us to delete or remove your Personal Data. We will comply where legally required or justified.
Your Right to Restrict Processing	You may request that we limit the way we process your Personal Data when you contest its accuracy, when processing is unlawful, when we no longer need the data, or if you have objected to its processing.
Your Right to Data Portability	If your data is processed based on your consent or a contract, you can receive it in a structured, commonly used, machine-readable format, and, where possible, transfer it to another controller.
Your Right to Object	Where processing is based on legitimate interests, you have the right to object to such processing for reasons specific to your situation. We will stop processing unless overriding legitimate grounds prevail.
Your Right to Withdraw Consent	If you have provided explicit consent, you may withdraw it at any time. Without another lawful basis, we will cease processing your Personal Data following withdrawal.
Your Right to Lodge a Complaint	If you consider our data processing to violate applicable laws, you may file a complaint with a supervisory authority to protect your rights.

To exercise any of these rights, you may contact us at privacy@byvoice.io.

We may ask for certain information to verify your identity and ensure that your personal data is disclosed only to the authorized individual. This verification is a security measure to protect your data. We may request additional information to process your request efficiently.

We will respond without undue delay and, in any event, within one (1) month of receipt of your request. This period may be extended by up to two (2) additional months where necessary, considering the complexity and number of requests. In such cases, we will inform you of the extension within one (1) month of receiving your request and provide an explanation for the delay.

If you are not satisfied with our response or believe your data is being processed unlawfully, you have the right to lodge a complaint with the Polish Data Protection Authority (Urząd Ochrony Danych Osobowych, UODO) or the competent supervisory authority in your jurisdiction.

Please note that your rights are subject to certain limitations and exceptions as provided by applicable law.

SECURITY MEASURES

We implement a comprehensive set of technical and organizational measures to protect your personal data. These include ensuring the ability to promptly restore availability and access to personal data in case of physical or technical incidents, as well as robust user identification and authorization controls. We safeguard data during transmission and storage through encryption and secure protocols, specifically using HTTPS with SSL certificates and other protection tools.

Physical security controls are applied to all locations where personal data is processed. System configurations, including default settings, are regularly reviewed and optimized to maintain security integrity. We enforce strict data quality standards and limit the retention period of personal data in accordance with legal and operational requirements.

Our accountability measures ensure transparency and compliance with data protection obligations. We facilitate your rights on data portability and erasure, supporting lawful data management. Additionally, caching may be performed during data processing while maintaining security. These measures collectively uphold the confidentiality, integrity, and availability of your personal data throughout its lifecycle.

INTERNATIONAL TRANSFER

We may transfer your personal data to recipients located outside the European Economic Area (EEA). Such transfers are necessary for the provision of our services and to fulfill contractual and legal obligations.

When transferring personal data internationally, we ensure appropriate safeguards are in place to protect your data and comply with the EU General Data Protection Regulation (GDPR).

These safeguards may include:

Transfers to countries recognized by the European Commission as providing an adequate level of data protection;
Standard Contractual Clauses (SCCs) or similar legally binding agreements approved by competent data protection authorities;
Binding Corporate Rules (BCRs) for intra-group transfers;
Explicit consent where provided and permitted by law;
Other appropriate measures to ensure an essentially equivalent level of protection as required by the GDPR.

We take all reasonable steps to ensure your personal data is treated securely and in accordance with this policy. You have the right to request information about the safeguards in place for any international transfer of your personal data.

CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be updated periodically to reflect changes in technology, legal requirements, or other relevant factors. Any updates will become effective on the date indicated in the revised policy. Continued use of our Website and Services after the effective date means your personal data will be processed in accordance with the latest version of the Privacy Policy.

We will post any changes to this Privacy Policy on this page and, where appropriate, notify you by email. We encourage you to check this page regularly for updates. If a significant change requires your explicit consent for further processing of your personal data, we will request your consent or renewed consent, as applicable.

THIRD PARTIES WE SHARE PERSONAL DATA WITH

Third party companies and their partners that provide us services

We need to use different services to record and manage customer service issues, provide support across different channels and keep customer information accessible for a better customer experience. Therefore, we may transfer and disclose your personal data to the next companies who provide CRM systems:

HubSpot (HubSpot is a CRM software provided by HubSpot Inc.).

Third parties that provide us payment services

When making payments on the Website, you may be required to provide payment data. When you make payments using third-party services, such processing is subject to the privacy policy of third-party payment systems. We may share and disclose your personal data to the following data processors:

Stripe (Stripe is a payment processing service provided by Stripe, Inc. (USA)).

Third parties that provide us analytic services

We try to improve our Services and enhance the user experience. Therefore, we may transfer and disclose your personal data to the next companies who provide us analytic services:

Google Analytics (Google Analytics is an analytics service provided by Google Inc.).

Google Search Console (Google Search Console is an analytics service provided by Google Inc.).

Hotjar (Hotjar is analytics service provided by Hotjar Ltd.).

Third party companies that do marketing mailings

We are committed to providing you with all the information you need about our services, BYVOICE’s news and promotions in a timely manner to rapidly grow our business and keep our customers informed. We may share and disclose your personal data to the following data processor:

Zoho (Zoho is a secure email service provided by Zoho Corporation Pvt. Ltd.).

Instantly (Instantly is an email marketing platform specifically designed for digital influencers provided by Foo Monk LLC).

Google Workspace (Google Workspace is a collaboration service provided by Google Inc.)

Microsoft 365 (Microsoft 365 is a collaboration service provided by Microsoft Corporation)

Sendgrid (Sendgrid is an email API and marketing campaigns platform provided by Twilio Inc.).

Third party companies and their partners that provide us data hosting services

We use data hosting services to provide the secure storage and high-speed connections necessary to host websites, blogs and online applications, ensuring fast load times and a positive user experience. We may share and disclose your personal data to the following companies:

Cyber_Folks S.A. (Cyber_Folks S.A. is an AI-powered website builder provided by Cyber Folks, Inc.).

Wix (Wix is a website builder provided by Wix.com Ltd.).

GoogleDrive (GoogleDrive is a data hosting service provided by Google Inc.).

Confluence (Confluence is an AI-powered online document collaboration system provided by Atlassian Pty Ltd, Atlassian US Inc.).

Google Cloud (Google Cloud is a data hosting service provided by Google Inc.).

Third party companies and their partners that provide us speech-to-text and text-to-speech conversion services

To provide our Services we need to use speech-to-text and text-to-speech conversion services. Therefore, we may transfer and disclose your personal data to the next companies:

Google Speech (Google Speech is a voice transcription service provided by Google Inc.)

Deepgram (Deepgram is the voice AI platform for business use cases provided by Deepgram Inc.).

ElevenLabs (ElevenLabs is the AI voice models and products platform provided by Eleven Labs Inc.).

Yandex (Yandex Cloud is a data hosting service provided by Yandex LLC).

Third party companies and their partners that provide us LLM-based data processing services

We try to improve our Services and better respond to customer concerns and needs. To analyze customer feedback, reviews, and social media mentions we use the following LLM-based data processing services:

ChatGPT (ChatGPT is an AI-powered chatbot service provided by OpenAI OpCo LLC).

Google Gemini (Google Gemini is an AI-powered service provided by Google Inc.)

Anthropic (Anthropic is an AI-powered service provided by Anthropic PBC).

Groq (Groq is a service for optimizing tensor processing provided by Groq Inc.).

Deepseek (Deepseek is an AI-powered chatbot service provided by Hangzhou DeepSeek Artificial Intelligence Co., Ltd.).

Yandex Cloud (Yandex Cloud is a data hosting service provided by Yandex LLC).