Your data, handled honestly.

This Privacy Policy explains what Voicemail.Work (the "Service"), provided by TONNIC AI Agency Ltd ("we", "us"), collects from you and your callers, what we do with it, and the choices you have. We've kept it as plain as we can.

1. Who this applies to

Voicemail.work is intended for one individual on one real, active phone line. Standard and Premium are for personal lines. Solopreneur supports one-person businesses, sole proprietors, freelancers, and solo professionals using their own business line.

Voicemail.work is not intended for teams, departments, shared customer service workflows, call centers, dispatch desks, or general answering-service use. If you need those workflows, please contact TONNIC AI Agency instead. This policy describes the personal information we collect from individual account holders, and from the people who call them.

2. What we collect

2.1 Information you give us

• Account info: phone number, name, email, country, carrier, plan choice, and your assistant name and voice preference. You provide these when signing up or editing your account.
• Communications: the content of messages you send to us through forms, email, or other support channels.
• Payment info: your card details are entered directly with our payment processor, Stripe. We never see or store full card numbers; we receive only a token, billing status, and the last four digits.

2.2 Information from your callers

• Call audio: when someone calls a phone number you've forwarded to the Service, our AI handles the call and records the conversation so it can transcribe and summarize it.
• Caller-provided details: anything the caller says, including their name, callback number, and the reason for their call.
• Caller phone number (caller ID), where the carrier provides it.

2.3 Information collected automatically

• Usage data: which features you use, when, and from what device. Standard web request metadata (IP address, user agent, referrer).
• Cookies: a small number of first-party cookies — all functional, none for analytics or advertising. A signed authentication cookie keeps you logged in. A second cookie, vmw_ref, is set only if you arrive via a referral link (a URL containing ?ref=CODE); it stores just the referral code (a short alphanumeric string like SARAH-7K2P), lasts 30 days, is restricted to our domain, and exists so that an existing customer who referred you can be credited if you later sign up in the same browser. You can clear it at any time through your browser; doing so simply means no referrer will be credited.

3. How we use it

3.1 To run the Service

• Routing forwarded calls to the AI agent.
• Generating transcripts, summaries, and scam-risk scores.
• Sending you the resulting email and SMS notifications. The recording is attached to the email; we do not put a link to it in the text message.
• Authenticating you when you sign in.
• Managing your subscription and billing through Stripe.

3.2 To improve the Service

• Internal analysis of system performance and reliability.
• Identifying patterns that help us reduce false positives in scam detection or improve the assistant's conversation flow.
• Periodically reviewing recent calls with our own tooling to find where the assistant misheard someone, asked a poor question, or handled a call badly. Our voice provider produces a redacted copy of each transcript and recording, with names, numbers and similar details replaced by placeholders, and that redacted copy is what this review uses. We are looking at how the assistant performed, not at the content of your messages.

We do not use your call content to train AI models, and we do not sell your data. Ever.

The voice agent runs through Retell AI, which in turn uses third-party providers for the model layer (OpenAI for language, fish.audio and ElevenLabs for voice). These providers state in their API terms that they do not use customer data routed through their APIs to train their models. We do not have direct accounts with the voice providers; data flows to them only through Retell, and we rely on Retell's contract with each provider.

4. How long we keep it

• Call recordings and transcripts: kept 14 days with the voice provider that generates them, then deleted automatically. This window is what lets us diagnose failures and improve how the assistant handles calls. Nothing is copied into our own database.
• Other call details held for the same 14 days: the caller's number, the call summary and sentiment analysis, technical call logs, and internal identifiers that include your own phone number and email.
• Call metadata in our database: kept while your account is active. This is non-content only — a scam-risk score and flags for how the call ended. It contains no caller identity and nothing that was said. After account closure it is anonymized and retained for security and accounting.
• Account info: retained while your account is active and for up to 12 months after closure for billing reconciliation.
• Operational logs: rolled over within 30 days.

When you delete your account we also delete your call recordings and transcripts. Calls placed while deletion is being processed are removed by the 14-day window above, so everything is gone within 14 days of your request.

You can ask us to delete your data sooner by contacting us through our Contact page. Some records may be retained where the law requires it.

One exception we want to be upfront about: our voice provider automatically creates a contact record holding the caller's phone number when a call ends. It contains no recording or transcript. The provider does not currently offer a way to delete these records, and we've asked them for one.

5. Who we share it with

• Service providers that operate parts of the Service on our behalf:
  • Stripe — payment processing.
  • Twilio — voice and SMS infrastructure (forwards calls and delivers texts).
  • Retell AI — real-time voice agent runtime, which in turn routes audio through OpenAI (language model), fish.audio, and ElevenLabs (text-to-speech) under their respective API terms.
  • Cal.com — calendar scheduling, on plans where appointment booking is enabled (so the agent can offer real availability and book appointments on your calendar).
  • Cloud hosting infrastructure for compute, storage, and email delivery.
• Legal compliance: we may disclose information if required by law, valid legal process, or to protect rights, safety, or property.
• Business changes: if Voicemail.Work is sold or merged, your information may transfer to the acquirer, subject to this policy or a successor with comparable protections.

We do not share your information with advertisers or data brokers.

6. How callers are informed

When the AI picks up, it identifies itself by name as your voicemail assistant. Whether the call is recorded depends on the laws of your jurisdiction and the caller's. You are responsible for complying with applicable two-party-consent laws (this includes states like California, Florida, and Pennsylvania, and many other jurisdictions). We can add an explicit recording-disclosure to your assistant's greeting on request — contact us if you need it enabled.

7. Your choices

• Access: you can view your account info on your account page.
• Correction: edit your name, email, and assistant settings directly.
• Deletion: cancel your subscription and ask us to delete your data. Contact us through the form on the Contact page.
• Marketing email: we don't currently send marketing emails. If we ever do, every message will include a one-click unsubscribe.

8. Security

We use industry-standard practices: TLS in transit, encryption at rest for sensitive fields, signed cookies for authentication, scoped access for engineering staff, and regular review of our service-provider relationships. No system is perfect — if we discover a breach that affects you, we'll notify you within the timeframes required by law.

9. Age requirement

You must be at least 18 years old to use Voicemail.work, as required by our Terms of Service. The Service is not directed at minors, and we do not knowingly collect information from anyone under 18. If you believe someone under 18 has provided us with information, contact us and we'll delete it.

10. Region-specific notes

10.1 United States

California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing." We do not sell or share your personal information for cross-context behavioral advertising. Requests can be sent through our Contact page.

10.2 Canada

This policy is intended to comply with PIPEDA. You have the right to access and challenge the accuracy of your information. Contact us to do either.

11. Changes

When this policy changes, we update the "Last updated" date at the top, so you can always tell when it last moved. For significant changes we may also tell you in the app or by email. Continued use after the change constitutes acceptance.

12. Contact

Questions, requests, or concerns: reach us through the Contact page on this site, or write to TONNIC AI Agency Ltd at https://tonnic.agency.