This Privacy Policy explains how Ahoya (“we”) collects, uses, and shares information when you use our AI voice receptionist service.
Information we collect#
- Account information. Your email, password (hashed), organization name, and business profile (services, hours, contact info) that you enter or that we extract from a website URL you give us.
- Call data. Inbound caller phone numbers, call timestamps, audio recordings (when enabled), and transcripts.
- Usage data. IP-address-derived hashes for rate limiting on the public demo, in-app analytics about feature usage.
How we use information#
- To operate the AI voice receptionist service on your behalf.
- To bill you for usage and manage your subscription.
- To improve product quality (anonymized, in aggregate).
- To respond to support requests.
Your callers' data#
When your AI receptionist answers a call, we process the caller's personal data (phone number, voice audio, and transcript) on your behalf: you are the data controller for your callers, and we act as your processor. Callers who want their data accessed or deleted should contact the business they called; we provide in-app tools to help you fulfill those requests.
Sub-processors#
We use the following third-party services to run the product. Each has its own privacy commitments:
| Provider | Purpose |
|---|---|
| Vapi | Voice agent orchestration (telephony, STT/LLM/TTS routing). |
| Twilio | Phone numbers and SMS delivery. |
| Anthropic | LLM inference for the voice assistant on paid plans (via Vapi). |
| Groq | Voice LLM on trial plans; internal website-scrape and booking extraction. |
| Microsoft Azure | Text-to-speech. |
| Deepgram | Speech-to-text. |
| Supabase | Authentication. |
| Neon | Postgres database hosting. |
| Vercel | Application hosting. |
| Stripe | Payments and subscription management. |
| Resend | Transactional email. |
| Upstash | Rate-limit counter store. |
| PostHog | Product analytics and error reporting. |
| Inngest | Background-job orchestration (appointment reminders, lifecycle emails). |
Cookies & analytics#
We use authentication cookies (your sign-in session), preference cookies (language and theme), and PostHog product analytics to understand feature usage and capture errors. We don't use advertising cookies or cross-site trackers.
Call recording consent#
Some US states (CA, CT, DE, FL, IL, MD, MA, MT, NH, PA, WA — among others) require all parties to consent to call recording. We enable a consent disclosure by default on every inbound call. You may turn this off in Settings if your jurisdiction allows one-party consent.
Data retention#
We retain call recordings and transcripts for the lifetime of your account. Delete your organization from Settings → Danger Zone to remove all associated calls and recordings.
International transfers#
Data is processed and stored in the United States by us and the sub-processors listed above. If you use the Service from outside the US, your data is transferred to and processed in the US.
Children#
The Service is built for businesses and isn't directed at children under 16. We don't knowingly collect personal data from children.
Your rights#
Depending on where you live (including under the GDPR in the EU/UK and the CCPA in California), you have the right to access, correct, export, delete, or object to the processing of your personal data. You can exercise most of these directly with in-app controls or by emailing hello@ahoya.ai. We process your data to perform our contract with you and for our legitimate interest in improving the Service. We do not sell personal information.
Contact#
Questions about this policy: hello@ahoya.ai.