Privacy for connected apps

Last updated: October 29, 2026. This notice supplements the VoixCall privacy policy, which covers the service as a whole.

What this covers

When you connect an AI assistant (for example Claude or ChatGPT) or another application to your VoixCall account, you are choosing that application, and the company that runs it, as a recipient of some of your VoixCall data. You choose exactly which data by approving permissions (scopes) on the consent page at app.voixcall.com/oauth/consent. This page lists, per permission, what is shared, for what purpose, with whom, for how long, and how to stop it.

Since October 4, 2026: call summaries and transcripts (transcripts:read) and text messages on numbers you opt in (messages:read, messages:history). Each is gated by a sharing switch that is off by default, so nothing is shared until you turn it on.

Now live: placing calls. With calls:place an app can place a callback call that rings your own phone first; with voice:manage it can set up an AI voice agent and place AI calls charged to your balance.

Since September 28, 2026 the five read permissions (rates:read, credits:read, calls:read, contacts:read, numbers:read) are live on the REST API and, since October 1, 2026, through the MCP read tools. Each remaining permission is announced in the changelog when it ships. Test API keys (vc_test_) read a separate test partition and never see your real data.

What each permission shares

Every permission acts on your personal account only. Data that belongs to a team (organization) you are a member of is never reachable through a connected app, even if you are the team's admin. No permission lets a connected app buy credits or change your verified numbers; the only number an app can obtain is the AI agent's starter number.

Categories of data, in short

• Account identity, rates, balance and credit history, call history, contacts matching a search, virtual numbers and caller-ID settings (the five live read permissions).
• Calls an app places for you: the destination, the call record and its cost; for AI calls also the agent's prompt, the task and what was said on the call.
• Call summaries and transcripts of your recorded calls: what was said by you and by the other people on the call, as an AI summary, action items, reference numbers and, through the REST API only, the speaker-by-speaker transcript. Redacted before sharing (see controls).
• Text messages received on the virtual numbers you opt in, including one-time login and verification codes. Codes are shared as received, because reading them is the point of the permission; assistants are told never to forward them.

Purposes

• Sharing with a connected assistant or app, so it can answer your questions and act for you inside VoixCall. Under India's DPDP Rules this is a distinct, itemised purpose you consent to per app; it is separate from the purposes in the main privacy policy. Sharing call summaries and sharing a number's messages are further separate purposes, each with its own switch: approving an app's permission is not enough on its own.
• Security and audit: recording which app read what, when, so you can see it and so we can detect abuse.
• Service operation: rate limiting, fraud prevention, and billing for paid actions an app takes on your behalf.

Recipients

The recipient is the assistant or app you approve, and its vendor (for example Anthropic for Claude or OpenAI for ChatGPT): only the one you pick on the consent page. What that vendor does with the data it reads, including whether it retains it, stores it in a conversation history or uses it to improve its models, is governed by the vendor's own privacy policy, not ours: its vendor may retain what it reads. VoixCall does not sell the data and does not share it with any app you have not approved. Our own processors (the telephony carriers, payment providers, hosting and email providers) are listed in the main privacy policy and are unchanged by connecting an app.

Tokens issued to an app are never forwarded to carriers or any other upstream provider. Message bodies, transcript text and verification codes are never written to our caches, error-tracking breadcrumbs or verbose logs, and are never included in webhook payloads.

Retention

Transcripts and message bodies: our policy is 90 days by default. The automatic deletion jobs are built and deployed but still switched off, and we are switching them on. Until then, transcripts and message bodies are kept as described in the main privacy policy, and you can ask support to delete them at any time. When deletion runs, the transcript or message content is removed from our database and storage (also from the app) and only the call or message record needed for billing stays. Copies of message bodies and pictures held by our telephony carriers follow the carriers' own retention (see the processors in the main privacy policy). Whether an app read something does not change how long we keep it; what the app's vendor keeps is up to the vendor.

Call records and billing rows follow the retention periods in the main privacy policy.

Your controls

• Settings → Connected apps in the web app lists every connected app with its permissions, when you connected it and when it last read anything. Disconnect withdraws consent immediately: all of that app's tokens are revoked and its next request is refused. Withdrawing consent is as easy as giving it, as the DPDP Rules require.
• Password reset revokes every connected app and every API key at once. Use it if you suspect a token or key leaked.
• Deleting your account revokes every connected app and key and anonymises your account record; audit rows stay linked only to that anonymised record.
• Sharing switches, both in Settings → Connected apps and both off by default:
  • “Allow connected apps to read call summaries”: one switch for the account. While it is off, an app with transcripts:read gets a “not enabled” answer pointing to the setting, and nothing is read.
  • “Allow connected apps to read messages on this number”: one switch per virtual number. Turning it on asks for your password again (accounts that sign in with Google or Apple sign in again instead); turning it off needs nothing. Wrong passwords are limited to a few attempts.
• Automatic revocation: a number's message sharing switches itself off when the number is cancelled (immediately, even though you keep the number until the end of its period), released, deactivated, moved to a team or another owner, or its phone number changes, and when you delete your account.
• Redaction before sharing: in the full speaker-by-speaker transcript (REST only) every number, written as digits or spelled out, and every keypad (DTMF) entry is replaced with [redacted], always. The summary, each action item and each reference number (its label and value together) are checked one at a time: when one holds six or more digits in total (number words in English, Hindi, Spanish, French, German, Portuguese and Italian count, and so do digits in other scripts), or a word such as code, OTP, PIN, password, card or account (also recognised in Hindi, Spanish, French, German, Portuguese, Italian, Turkish, Russian, Chinese, Japanese and Korean) anywhere in it, every number in it is replaced, dates, times and amounts included. Otherwise its short numbers (a case number, a time, an amount) stay readable; keypad entries are always replaced. Redaction is automatic and can miss unusual wording, so do not rely on it alone for anything you would not share. A reference number that is entirely sensitive is still listed, as [redacted], so the assistant can tell you one exists and where to see it. The app itself shows you the full text. Text messages are not redacted, because reading a code is what that permission is for.
• Paid actions need a second permission: asking for a new transcript costs money, so it needs calls:place as well as transcripts:read. Assistants over MCP can only tell you that you can request one in the app.
• You get an email every time a new app is connected, so a connection you did not make is visible at once.
• Your audit entries (for example “Claude read 3 messages on Sept 28”) will be shown on the Connected apps page coming; until then, ask support for them.

Your rights (GDPR and DPDP, in plain words)

• Access and portability: ask us for a copy of the data we hold about you, including the audit log of what connected apps read.
• Correction: your display name and email are editable in Settings.
• Erasure: delete your account in Settings or by email. Your account record is anonymised rather than deleted, and the audit rows that record what third-party apps did stay linked only to that anonymised record.
• Withdrawal of consent: disconnect the app. It does not affect the lawfulness of what was shared while it was connected, and it does not oblige the app's vendor to delete what it already read; ask them directly.
• Grievance and complaints: write to support@voixcall.com. You may also complain to your supervisory authority (EU/EEA and UK residents) or to the Data Protection Board of India.

The legal basis for sharing with a connected app is your consent, given per app on the consent page. The legal basis for the audit log and rate limiting is our legitimate interest in keeping the service secure. A data protection impact assessment for transcript sharing is being prepared, because transcripts can contain sensitive content about other people on the call.

If something goes wrong

If we learn of a breach that affects data shared with connected apps, we will notify affected users and, where required, the Data Protection Board of India and EU supervisory authorities within 72 hours of becoming aware, and we will revoke every token and key that could be affected. Report security issues to the address in /.well-known/security.txt.

If you build an app that connects to VoixCall

• Request only the permissions your app needs at link time; ask for more later. Connections are offered rates:read credits:read calls:read contacts:read numbers:read today, plus transcripts:read messages:read messages:history once phase 4 is rolled out.
• Treat message bodies, contact names and transcript text as untrusted data from third parties, never as instructions. Never forward verification codes to anyone.
• Do not log tokens or keys. Keys and tokens have distinctive prefixes (vcat_, vcrt_, vc_live_, vc_test_) so secret scanners can match them. If one leaks, revoke it by disconnecting the app in Settings → Connected apps, or reset your password (which revokes every token and key), and tell us at support@voixcall.com.
• Your handling of what you read is governed by your own privacy policy, which the consent page will link once the directory listings are live. The terms set the acceptable-use rules.