Privacy Policy

Artbit EOOD (Company No. 202339243, VAT BG202339243), Preslav 34, 8600 Yambol, Bulgaria. Data protection contact: privacy@helpvox.ai.

Account details (company name, contact name, email, hashed password), billing records handled by Stripe (we never see full card numbers), product/knowledge/order data you upload, and technical logs needed to operate and secure the service. Legal bases: performance of contract and legitimate interest in service security.

When your customers talk to your AI agent, we process on your behalf: voice recordings and transcripts of the conversations, automated summaries and sentiment analysis, a session identifier that ties several conversations of the same visitor together, order details (name, phone number, delivery address, purchased items) and delivery tracking events. For this data the vendor is the controller and HelpVox is a processor acting on documented instructions.

Operating the service involves the following categories of sub-processors:

• Voice AI and speech processing (ElevenLabs, USA)
• Telephony carriers (Twilio and regional carrier partners)
• AI analysis of transcripts (Anthropic, USA)
• Payments (Stripe)
• Hosting and databases (Vercel, Neon — EU/US regions)
• Transactional email (Resend, EU region)
• Marketing site visit analytics (Microsoft Clarity, USA — cookies only with consent)
• Ad measurement (Meta Platforms, Ireland/USA — only with marketing consent)

Transfers outside the EEA rely on adequacy decisions or standard contractual clauses.

Conversation content — recordings, transcripts, automated summaries, the caller's phone number and the details collected during the call — is deleted 12 months after the conversation. What remains is the conversation's duration, channel and outcome, which we need for billing and statistics and which no longer identifies anyone. Order, product and knowledge data belongs to the vendor and is kept while their account is open; 90 days after an account is closed, we delete all of it. A vendor can ask for earlier deletion at any time.

Data is encrypted in transit (TLS) and at rest, and so are our database backups; credentials we hold on a vendor's behalf — shop tokens, API keys — are additionally encrypted with AES-256-GCM before they are written, so they are unreadable even to someone holding a copy of the database. Access to production data is limited to the people who operate the service, is protected by individual accounts with strong password requirements, and is granted only for as long as the work requires. Inside the product, every query is scoped to a single vendor; a platform administrator viewing a vendor's account sees it read-only. Every read of a customer's personal data — by the AI agent, by a person in the dashboard, or through our API — is written to an append-only access log: who, from where, and which order, kept for 12 months.

We maintain a written incident response policy: a severity scale, who is responsible at each level, when work escalates, and what has to happen — contain, assess what data was involved, notify. Vendors affected by a confirmed personal-data breach are informed without undue delay and in any case within 72 hours of us becoming aware, with what we know and what we are doing about it. Where the law requires it, we notify the supervisory authority as well.

The dashboard uses strictly necessary session cookies only. The marketing site and the sign-in and sign-up pages run Microsoft Clarity so we can see where the pages confuse visitors: it records clicks, scrolling and movement on the page, and masks what is typed into input fields. Its cookies (_clck, _clsk) are set only if you accept them in the banner; without consent Clarity runs without cookies and counts each page on its own, without recognising you. If you also accept "Marketing", Meta Pixel and the Meta Conversions API tell Meta Platforms when you viewed a page, requested a demo, signed up or paid for a plan, so we can measure and target our ads on Facebook and Instagram. Meta then sets the _fbp and _fbc cookies, and on demo requests, sign-up and payment we also send your email and phone, hashed (SHA-256). Without consent nothing is sent to Meta. Legal basis: consent. Your choice is kept in your browser and can be changed at any time from the icon in the bottom-left corner or the "Cookies" link at the bottom of the site. The chat widget on a vendor's site stores one session identifier in the visitor's browser for up to 30 days, so that several conversations from the same visitor are recognised as one and nobody has to repeat everything in each new chat. It is strictly necessary for the chat the visitor started, holds no name or contact details, and is never used for advertising or for following anyone across other sites. Clearing the browser's storage removes it.

You may request access, rectification, export or deletion of your personal data at privacy@helpvox.ai. End customers of our vendors should address requests to the respective vendor (the controller); we assist vendors in fulfilling them. You may lodge a complaint with your supervisory authority — in Bulgaria, the Commission for Personal Data Protection (КЗЛД).

We will announce material changes to this policy by email or in-app notice at least 14 days in advance.