Two different answers,
and which one is yours.

our demo agents

Demo calls are recorded. Here is exactly what happens.

The demos in our gallery connect your microphone to a live voice agent so you can hear the product work rather than read about it. That is a real call on real infrastructure, so it leaves real traces. We tell you before it starts, and we tell you here.

1. Your microphone opens only after you click join. The browser asks first, and nothing is captured before you accept the notice on the page.
2. Your audio streams to our servers in India and is transcribed by speech models we run ourselves, on our own machines. No third-party speech vendor is involved.
3. The transcribed text goes to Google's Gemini API to generate the agent's reply. This is the one point where the content of what you said leaves our infrastructure. It is text by then, not audio.
4. Both sides of the call are recorded — your audio and the agent's — and stored encrypted, along with a diagnostic log of the session.
5. Everything from the call is deleted after 30 days, automatically, by a storage lifecycle rule rather than by someone remembering.

The demos are demonstrations, provided as-is and for that purpose only. Please don't tell one anything personal, confidential, or sensitive — not because we would misuse it, but because a demo is the wrong place to put it, and 30 days is longer than a demo needs to exist.

the rest of the site

What the website itself collects.

Less than you might expect, because we haven't built the machinery to.

developer accounts

If you build on Voqalize.

Creating an account gives us your name and email address (through Google sign-in), the agents and keys you create, and a record of what your agents ran and for how long. We use it to run the service, bill it when billing exists, keep it secure, and talk to you about it. We record sign-ins, key creation and revocation, and administrative actions — that audit trail is a security control, and it is one of the few things we keep for longer than the data itself.

Your customers' call data is a different matter entirely — see the split above. You choose whether recording is on, and we will honour a deletion request for any session you name.

how long we keep things

Every number here is enforced by a rule, not a promise.

Retention on your own agents' call data is yours to set, not ours — that's what "you decide" means. Ask and we will delete any of it on request.

where it goes

Every third party a call touches.

Data is processed in India. Our servers, our database and our storage are all in the asia-south1 region or in Indian data centres; nothing is stored outside the country. Three parties are involved in a demo call and these are all of them.

When this list changes, this page changes with it. Customers running production agents are told before a new sub-processor is added, under their DPA.

your rights

What you can ask us for.

Whether you're covered by the GDPR, India's Digital Personal Data Protection Act, or neither, we'll do all of the following on request. One email is enough — no form, no account.

If you used a customer's product rather than ours, send the request to them — they hold the decision, and we are obliged to help them act on it.

security

How the data is protected.

Audio is encrypted in transit (DTLS-SRTP on the call itself, TLS everywhere else) and at rest in storage. Every tenant's data is separated at the data layer, and every request is authorised against the tenant it names before it reads anything. Access to production systems is limited to named people, reviewed periodically, and logged. Voqalize is built inside an organisation that holds ISO/IEC 27001 and SOC 2 certification, and it is being brought under that same management system as the product matures.