Privacy Policy

Last updated: June 26, 2026

Your privacy is very important to Vokalis. We have prepared this privacy policy to provide you with information about the personal data Vokalis collects through our interactions with you, how we use that data, and for what purposes. When we refer to "personal data", we mean any information relating to an identified or identifiable natural person, not to a company.

Who is responsible for processing your data?

The data controller is Vokalis. Identity: Vokalis AI SL. Email: info@vokalis.ai.

What personal data does Vokalis collect?

We collect the data necessary to provide the AI virtual agent services for which you, or the entity or organization you work or collaborate with, have contracted us or shown interest.

The categories of data we collect include:

1. Identification data, such as email address and username.
2. Authentication data, such as passwords stored securely using hashing.
3. Platform usage data, such as interaction logs, calls, messages, and credit usage.
4. Optional integration data, such as access tokens for Gmail, Google Calendar, Google Sheets, Calendly, and other integrations the user explicitly connects from the platform.

If you use the contact form on our website, the data we collect is limited to the identification and contact data requested there, such as your email address.

If you send us your CV, the data we collect may include academic and professional information, such as education, qualifications, student history, professional experience, and membership in professional bodies or associations, where relevant to recruitment processes.

For what purposes do we process your data?

At Vokalis, we process the data you provide for the following purposes:

1. Purposes related to the contractual relationship between you and Vokalis: to provide AI virtual agent services, including phone call automation, chat, appointment management, CRM integrations, and integrations with other tools. This processing is necessary to maintain those relationships. If you object to the processing of your data, we may be unable to maintain the applicable commercial, contractual, or collaboration relationship.
2. Purposes based on Vokalis's legitimate interest: to comply with applicable legal and tax obligations, such as applicable regulations on anti-money laundering and counter-terrorist financing.
3. Purposes based on your express consent: to contact you to offer our services; to periodically send electronic communications about services, events, and news related to our professional activity, unless you tell us otherwise; and, if you send us your CV, to assess and manage your job application and, where appropriate, carry out the steps necessary for staff selection and hiring for positions matching your profile.

Use of Google services

If you connect Google integrations, such as Gmail, Google Calendar, or Google Sheets, Vokalis will request OAuth permissions only to enable the features you activate in your account. Depending on the integration, we may access and process Google user data such as your Google account email address, OAuth access tokens, email messages and metadata, calendar events, and spreadsheet contents that you explicitly authorize.

We use this Google user data solely to provide and improve the application features you enable, including sending and/or processing emails, synchronizing events, and accessing selected spreadsheets. We do not use Google user data for advertising, data sales, commercial profiling, building unrelated databases, or training AI models. We do not sell Google user data to third parties, data brokers, or information resellers.

We do not share, transfer, or disclose Google user data to third parties, except when we are legally required to do so by competent public or judicial authorities.

You may revoke these permissions at any time from your Google account. When you disconnect an integration or close your account, we delete or anonymize the associated Google access tokens and stop processing the related Google user data, unless retention is required by law. You may also request deletion of the integration and associated data by writing to info@vokalis.ai.

Google API Services — Limited Use compliance

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Vokalis limits its use of Google Workspace API data to providing or improving user-facing features that you explicitly enable in the Vokalis platform. We do not use Google Workspace user data to create, train, or improve generalized artificial intelligence or machine learning models. This restriction applies to raw data obtained from Google scopes and to data aggregated, anonymized, or derived from that data.

More information is available in the Google API Services User Data Policy.

Data security

We implement technical and organizational security procedures to protect the confidentiality, integrity, and availability of your personal data, including sensitive data and Google user data.

Our data protection measures include:

1. Encryption in transit: all data transmitted between your browser, our services, and third-party APIs is protected using TLS/HTTPS.
2. Encryption at rest: sensitive data, including Google OAuth access tokens and integration credentials, is stored using industry-standard encryption.
3. Secure authentication: passwords are never stored in plain text and are protected using one-way hashing.
4. Access controls: access to personal data is restricted to authorized personnel who need it to operate, maintain, or support the service, based on the principle of least privilege.
5. Vendor safeguards: service providers that process data on our behalf are required to apply appropriate security measures through contractual agreements.
6. Monitoring and review: we regularly review our security practices and infrastructure to help prevent unauthorized access, disclosure, or misuse of data.

Despite these measures, no method of transmission or electronic storage is completely secure. If you believe your account or data has been compromised, please contact us immediately at info@vokalis.ai.

Who will receive your data?

Your data will be disclosed only to competent public and judicial authorities, and only when Vokalis is legally required to do so. Certain national and international Vokalis service providers may also access and process your data on behalf of Vokalis as part of their services, such as IT service providers, security companies, and call center providers. These providers may only process your data under our instructions and for the purposes described in this privacy policy, including providing or improving the Vokalis platform. Google user data is not shared with these or any other third parties, except as required by law.

What are your rights when you provide us with your data?

You may exercise your rights of access, portability, rectification, erasure, restriction, objection, and the right not to be subject to a decision based solely on automated processing. You may also withdraw your consent at any time.

The right of access allows you to know and obtain information free of charge about your personal data being processed. The right to portability allows you to request delivery of your data in a structured, commonly used, machine-readable, and interoperable format or, where technically possible, to have us transmit your data directly to another controller. The right to rectification allows you to correct errors, modify inaccurate or incomplete data, and ensure that the information being processed is accurate. The right to erasure allows you to request deletion of processed data, without prejudice to any applicable blocking obligation.

The right to restriction allows you, in certain cases provided by law, to request that your data be blocked and access limited only for the establishment, exercise, or defense of claims, the protection of the rights of another natural or legal person, or reasons of public interest. The right to object allows you to request that your personal data no longer be processed. The right not to be subject to a decision based solely on automated means applies where the decision produces legal effects concerning you or similarly significantly affects you.

To exercise these rights, you may write to Vokalis at info@vokalis.ai and include a copy of your national identity document, passport, or other valid identification document. You also have the right to file a complaint with the Spanish Data Protection Agency. More information is available at www.agpd.es.

How did we obtain your data?

Your data has been provided directly by you.

How long will we keep your data?

We retain personal data only for as long as necessary to fulfill the purposes described in this privacy policy, or for the period required to comply with applicable legal obligations.

Google integration data, including OAuth tokens and content accessed through connected Google services, is retained while the integration remains active and you maintain your Vokalis account. When you disconnect a Google integration, revoke access, or request deletion, we remove the associated tokens and stop processing related Google user data within a reasonable period, unless a longer retention period is required or permitted by law.

When the retention period for a given type of data expires, we delete or anonymize it. You may request deletion of your personal data at any time by writing to info@vokalis.ai.

Is this privacy policy subject to updates?

Yes. We may modify our privacy policy as we add new services and as technology and legislation change. We are committed to ensuring that the latest version of our privacy policy is always available on our website.

If you have any questions about how we process your personal data, please contact us through the channels indicated above.

Contact

If you have questions about this privacy policy or how we process your data, you can write to info@vokalis.ai.