Draft — not yet reviewed by a lawyer. This is a starting-point privacy policy covering standard SaaS + telephony data practices. Because Vendira operates from Quebec and may serve US customers, have this reviewed against PIPEDA/Law 25 (Quebec) and applicable US state privacy laws before relying on it commercially.

Privacy Policy

Last updated: July 2, 2026

This Privacy Policy explains what personal information Vendira.ai ("Vendira," "we") collects, why, and how we handle it — both for businesses who use our Service ("Customers") and for the people Customers communicate with through Vendira ("End Users" — e.g. a Customer's callers or SMS recipients).

1. Information we collect

From Customers (account holders)

Account info: name, email, business name, password (hashed)
Billing info: processed by Stripe; we store subscription status, not raw card numbers
Configuration data: AI agent prompts, voice selection, business branding

From End Users (via a Customer's use of the Service)

Phone numbers, and any name/details provided during a call or text
Call metadata: duration, timestamp, status
Call transcripts (generated by our AI voice provider, ElevenLabs)
SMS message content sent and received
Appointment, invoice, and CRM data a Customer enters about their own customers

2. How we use information

To operate the Service (routing calls, sending texts, running the AI agent)
To bill Customers for usage via Stripe
To provide Customers with call logs, transcripts, and analytics about their own business
To detect abuse, fraud, and violations of our Terms
To improve the Service (aggregated/anonymized usage patterns only — we do not sell personal data)

We do not sell personal information. We do not use End User call/SMS content to train third-party AI models beyond what is necessary to provide the Service itself (i.e., our voice AI provider processing a call to generate a response during that call).

3. Third parties we share data with

Data is shared only as necessary to operate the Service:

Twilio, Inc. — telephony and SMS delivery
ElevenLabs — AI voice processing and transcript generation
Stripe, Inc. — payment processing
Supabase — database hosting
Vercel — application hosting

Each of these providers has its own privacy practices and may process data outside Canada (including the United States). By using the Service you consent to this cross-border processing as necessary to deliver the Service.

4. SMS-specific disclosures

If you (as an End User) receive a text message from a business using Vendira, that message was sent because the business believes it has your consent to contact you (e.g. you called them, you are an existing customer, or you opted in). To stop messages, reply STOP to any message — this immediately suppresses all future messages to your number through our platform. Reply START to opt back in, or HELP for support contact info. Standard message and data rates may apply from your carrier.

5. Data retention

We retain call logs, transcripts, and SMS history for as long as a Customer's account is active, plus a reasonable period afterward for legal and billing purposes, after which it is deleted. Customers may request deletion of specific End User records through their dashboard or by contacting us.

6. Your rights

Depending on your jurisdiction (including Quebec's Law 25, PIPEDA, or applicable US state privacy laws), you may have the right to access, correct, or request deletion of personal information we hold about you. Contact us at the address below to exercise these rights. For End Users, requests are typically fulfilled through the Customer business you interacted with, as they control that data; we will assist Customers in fulfilling verified requests.

7. Security

We use industry-standard safeguards, including encrypted connections (TLS), row-level tenant isolation in our database, and access controls limiting who can view Customer data. No system is perfectly secure; we do not warrant the Service is immune to unauthorized access.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect their information.

9. Changes to this policy

We may update this policy; material changes will be posted here with an updated date.

10. Contact

Privacy questions or requests: support@vendira.ai [confirm real contact].