Privacy Policy
Last updated: 21 February 2026
1. Introduction
Ringvox ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered communication platform, our website at ringvox.co, and related services.
Ringvox is the data controller for the personal data described in this policy. We are based in Limerick, Ireland.
2. Information We Collect
We collect personal data in the following ways:
Information you provide
- Account signup: Name, email address, phone number, business name, trade type, services offered, and service area
- Contact form: Name, email address, company name, and your message
- Demo builder: Business name and business description (used to generate a demo agent, not stored)
Information collected automatically
- Analytics: Page views, referral source, and approximate location (IP addresses are anonymised). Only collected after you consent via our cookie banner.
- Call data: When using the AI voice agent service, we process call recordings and conversation transcripts to deliver the service
3. Lawful Basis for Processing
Under GDPR Article 6, we process your data based on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Providing the AI voice agent service | Contract performance (Art. 6(1)(b)) |
| Responding to contact form enquiries | Consent (Art. 6(1)(a)) |
| Processing payments | Contract performance (Art. 6(1)(b)) |
| Website analytics (Google Analytics) | Consent (Art. 6(1)(a)) |
| Sending service-related communications | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Cookies and Analytics
We use a cookie consent banner on our website. No analytics cookies are set until you choose to accept them. You can change your preference at any time by clearing your browser's localStorage.
Cookies we use
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| ringvox_cookie_consent | Stores your cookie preference | Persistent | Strictly necessary |
| _ga, _ga_* | Google Analytics (page views, traffic source) | 2 years | Analytics (consent required) |
| _gcl_* | Google Tag Manager | 90 days | Analytics (consent required) |
IP addresses are anonymised in Google Analytics. We do not use analytics data to identify individual visitors.
5. Data Storage and Security
Your account data is stored in EU-based data centres (Supabase, Frankfurt) in compliance with GDPR requirements. Voice call processing uses ElevenLabs, a US-based provider certified under the EU-US Data Privacy Framework with Standard Contractual Clauses in place. Call audio is not stored on third-party systems; conversation data is retained for 30 days then automatically deleted. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
6. Data Sharing and Sub-Processors
We do not sell your personal information. We share data with the following trusted service providers, all bound by data processing agreements:
- Supabase (EU, Frankfurt): Database and authentication
- ElevenLabs (US, EU-US Data Privacy Framework certified): AI voice agent processing. Audio recording disabled; 30-day data retention.
- Twilio (US/EU, Standard Contractual Clauses): Telephony and SMS
- Stripe (US/EU, EU-US Data Privacy Framework certified): Payment processing
- Railway (US): Application hosting, DPA in place
- Cloudflare (US/EU, EU-US Data Privacy Framework certified): Security and CAPTCHA protection
- Google Analytics (US/EU, EU-US Data Privacy Framework certified): Website analytics (only after consent)
7. Your Rights
Under GDPR, you have the following rights:
- Access: Request a copy of the personal data we hold about you
- Rectification: Ask us to correct inaccurate data
- Erasure: Ask us to delete your data
- Restrict processing: Ask us to limit how we use your data
- Data portability: Receive your data in a machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw consent: Where processing is based on consent, you can withdraw it at any time
To exercise any of these rights, contact us at hello@ringvox.co. We will respond within 30 days.
8. Data Retention
We retain your data for the following periods:
- Account data: For the duration of your account, plus 30 days after deletion request
- Contact form submissions: 12 months
- Call conversation data: 30 days, then automatically deleted
- Analytics data: 14 months (Google Analytics retention setting)
- Payment records: 7 years (Irish tax law requirement)
9. International Data Transfers
Some of our sub-processors are based in the United States. These transfers are protected by the EU-US Data Privacy Framework (where the provider is certified) and/or EU Standard Contractual Clauses. The European Commission has determined that the Data Privacy Framework provides an adequate level of protection for personal data transferred from the EU to certified US organisations.
10. AI-Powered Services
Our platform uses AI voice agents to handle phone calls. In compliance with the EU AI Act (Article 50), all AI-powered calls begin with a disclosure that the caller is speaking with an AI assistant. If asked directly, the AI will confirm it is an artificial intelligence system. Call conversations are processed to provide call summaries and are not used to train AI models.
11. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100 / 1800 437 737
12. Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us: