1. Introduction

Vendra AI ("we," "our," or "us"), operated by FlowUp S.r.l., is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered voice agent service that connects with email, WhatsApp, phone (voice calls), SMS, web chatbot, and other communication channels.

By using our service, you agree to the collection and use of information in accordance with this policy. This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and other applicable data protection laws.

3. Information We Collect

3.1 Information You Provide Directly:

• Account registration data (name, email address, phone number, company name)
• Billing information (payment card details processed by Stripe, billing address)
• Communication content (voice call recordings, transcripts, messages, emails)
• Business documents (scripts, FAQs, pricing information, company knowledge base)
• Calendar and scheduling preferences
• CRM data synced through authorized integrations
• Support requests and correspondence

3.2 Information Collected Automatically:

• Device information (browser type, operating system, device identifiers)
• IP address and approximate geolocation
• Usage data (pages visited, features used, interaction patterns)
• Call metadata (duration, timestamps, call outcomes, caller ID)
• Cookies and similar tracking technologies
• Log files and error reports

3.3 Information from Third Parties:

• CRM platforms (Salesforce, HubSpot, Pipedrive, Zoho) - contact and lead data
• Calendar services (Google Calendar, Microsoft Outlook, Calendly) - scheduling data
• Telephony providers (Twilio, Telnyx, Vonage) - call data and recordings
• Messaging platforms (WhatsApp via Meta Business API, Telegram) - message content
• Payment processors (Stripe) - transaction data
• OAuth providers (Google, Microsoft) - authentication data

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our AI voice agent services as agreed in our Terms of Service
• Legitimate Interests: Business operations, fraud prevention, security, and service improvement
• Consent: Marketing communications, optional data collection, and certain cookie usage
• Legal Obligation: Compliance with applicable laws, tax requirements, and regulatory requests

5. How We Use Your Information

We use collected information for the following purposes:

• Providing AI voice agent services (call handling, transcription, scheduling)
• Processing and routing communications across all channels
• Training and improving our AI models (using anonymized/aggregated data only)
• Processing payments and managing subscriptions
• Sending transactional emails (receipts, service updates, security alerts)
• Providing customer support and responding to inquiries
• Analyzing usage patterns to improve our services
• Detecting and preventing fraud, abuse, and security threats
• Complying with legal obligations and regulatory requirements
• Marketing communications (with explicit consent, opt-out available)

6. Third-Party Service Providers & Integrations

We integrate with and share data with the following categories of third-party services:

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including:

• European Union (primary data center location)
• United States (cloud service providers, AI processing)
• Other countries where our service providers operate

For transfers outside the EEA, we ensure appropriate safeguards through:

• EU-US Data Privacy Framework certification (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules for intra-group transfers
• Adequacy decisions by the European Commission

8. Data Retention

We retain your data for the following periods:

• Account data: Duration of account plus 3 years for legal compliance
• Call recordings: 90 days default (configurable up to 2 years)
• Transcripts: 1 year default (configurable)
• Billing records: 7 years (legal requirement)
• Support tickets: 3 years from resolution
• Analytics data: 26 months (anonymized)
• Marketing consent records: Duration of consent plus 3 years

You may request earlier deletion of your data, subject to legal retention requirements.

11. Other Applicable Privacy Laws

13. Cookies and Tracking Technologies

We use the following types of cookies:

You can manage cookie preferences through our Cookie Consent Banner or your browser settings.

14. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@vendracall.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or prominent notice on our website at least 30 days before changes take effect. Continued use of our services after changes constitutes acceptance of the updated policy.

17. Supervisory Authority

If you are in the EU/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority. For Italy, this is: