Vorelai gives businesses AI voice agents that answer their phone calls. This policy covers the personal data we decide about ourselves: visitors to our website, people who sign in to our dashboard, and the businesses that pay us.
If you called a business that uses Vorelai, that business decides what happens to your call and answers your questions about it; we process your call for it under a data processing agreement. Ask the business you called. If you write to us, we pass your request to them.
What we collect, and why
| Who | What | Why | Legal basis (GDPR) |
|---|---|---|---|
| Website visitors who try the voice demo | What you say to the demo agent, and how the call went | To run the demo, and to see whether it works | Our legitimate interest in showing and improving the product. Kept 30 days |
| Website visitors | Your IP address and browser, in our servers' and our hosting provider's logs | Security and keeping the site up | Legitimate interest |
| Dashboard users | Your name, email, password (stored hashed by our sign-in provider) or Google sign-in, the workspaces you belong to and your role | To give you your account | Our contract with you or your employer |
| Dashboard users | What you do in the dashboard that changes your workspace (for example who invited whom) | To run the service and keep it secure | Contract; legitimate interest |
| Businesses that pay | The billing contact's name and email, the plan, invoices. Card details are handled by Lemon Squeezy, our reseller and merchant of record, and never reach us | To bill and keep accounting records | Contract; legal obligation |
| Anyone who emails us | Your email and what you wrote | To answer | Legitimate interest |
We don't sell personal data, don't use it for advertising, and don't use anyone's calls to train AI models.
Google user data
A business can connect its Google Calendar so its agents book appointments during calls. With your permission, Vorelai:
- reads the list of your calendars, so you can pick the one bookings go in and the ones whose busy times count;
- reads when those calendars are busy (free/busy only, not the events' details), to offer callers free times;
- creates events in the calendar you picked, for bookings callers make, and moves or deletes one of those events when the caller who booked it asks to move or cancel it. It doesn't change or delete any other event.
We use this access only to book appointments for your business's callers. The refresh token Google gives us is stored encrypted and used only by our servers. We don't use Google user data for advertising, don't sell it, don't let people read it except where you ask us for support, the law requires it, or for security, and don't transfer it to anyone except as needed to provide this feature. You can disconnect at any time from the dashboard, which revokes our access at Google and deletes the token, or from your Google Account's permissions page.
Vorelai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with
The providers that run Vorelai for us: Supabase (database and sign-in), DigitalOcean (our servers), Google (the AI model), Resend (emails), Cloudflare (hosting our website and dashboard, and bot protection on sign-up), Grafana Labs (server monitoring, no personal data), and Lemon Squeezy for payments. Each processes data only for us, under contract. The full list, with where each processes data, is on our Subprocessors page. We share data with authorities only when the law requires it.
Some of these providers are in the United States. Transfers from the EU and UK are covered by the EU–US Data Privacy Framework for certified providers, or by the European Commission's Standard Contractual Clauses.
How long we keep it
| Demo calls | 30 days |
| Dashboard accounts | While you have an account. Delete it yourself under Your account in the dashboard (at once), or ask us and we delete it within 30 days |
| Billing records | As long as tax and accounting law requires (usually up to 10 years), mostly held by Lemon Squeezy as merchant of record |
| Server logs | A few days |
| Emails to us | Up to 2 years after the conversation ends |
Cookies and storage
The dashboard keeps you signed in with your browser's local storage, which is necessary for it to work. Cloudflare Turnstile checks that a person, not a bot, is signing up. We don't use advertising or analytics cookies.
Your rights
Where the GDPR or the UK GDPR applies, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to our processing, and to have it in a portable form, and you can withdraw a consent you gave. Write to support@vorelai.com; we answer within a month, or tell you within that month if a complex request needs up to two months more. We may ask you to confirm who you are first. You may also complain to your data protection authority. Residents of US states with privacy laws have similar rights, and we don't sell or share personal data for advertising.
Children
Vorelai is for businesses. We don't knowingly collect data from children under 16.
Changes
We'll post changes here, with a new effective date, and tell dashboard users by email before a change that matters takes effect.