Privacy Policy

This Privacy Policy explains how Mfluence Private Limited ("the Company", "we", "us") collects, uses, shares and protects personal data in connection with Vox AI, our AI-powered candidate screening platform at app.voxai.biz.

It applies to visitors to the Platform, to customers and their users, and to candidates who are screened, called or evaluated through the Platform. It should be read with our Terms & Conditions.

1. Our role — who is responsible for what

If you are a candidate and want your data corrected or deleted, please contact the organisation that is recruiting you. If you contact us directly, we will pass the request on to them and support them in responding, but we cannot act on their data without instruction.

2. Data we collect

2.1 Account and organisation data

• Name, work email address, password (stored only as a salted hash), job role.
• Organisation name, domain, workspace settings and team membership.
• Verification information submitted during onboarding review.

2.2 Candidate data uploaded or collected by our customers

• Name, email address, phone number, and any details in an uploaded resume (PDF, up to 5 MB) or profile photo (JPEG/PNG, up to 2 MB).
• Responses to application and intake questions.
• Application status, stage and recruiter notes.

2.3 Interview and call data

• Audio recordings of screening and interview calls.
• Transcripts generated by automated speech recognition.
• AI-generated evaluations: scores against the customer's rubric, summaries, strengths and concerns, and recommendation reports.
• Call metadata: timestamps, duration, connection status, outcome and retry history.

2.4 Billing data

• Wallet balance, transaction history, invoices, plan and usage records, GST details.
• Payment identifiers returned by our payment gateway. We never receive or store your full card number, CVV, UPI PIN or net-banking credentials — those go directly to the gateway.

2.5 Technical and usage data

• IP address, browser type, device and operating system.
• Pages viewed, actions taken, timestamps, and audit-log entries of security-relevant actions.
• Server, application and error logs.

2.6 Cookies

We use strictly necessary cookies only: a session cookie to keep you signed in and a CSRF token cookie to protect form submissions. We do not use advertising or cross-site tracking cookies. Blocking these cookies will prevent you from signing in.

3. Why we process data, and on what basis

Purpose	Data	Basis
Providing the Platform — accounts, workspaces, screening, calls, evaluations	Account, candidate, interview data	Performance of contract; processing on the customer's instructions
Recording and transcribing calls, generating AI evaluations	Audio, transcripts, evaluations	Instruction of the recruiting organisation, which is responsible for obtaining candidate consent
Billing, wallet management, invoicing, tax	Account, billing data	Performance of contract; legal obligation
Support, service notifications, security alerts	Account, technical data	Performance of contract; legitimate interest
Security, fraud prevention, abuse detection, audit logging	Technical, usage data	Legitimate interest; legal obligation
Improving reliability and quality using aggregated, de-identified statistics	De-identified usage data	Legitimate interest

4. We do not sell your data

We do not sell, rent or trade personal data. We do not use candidate resumes, recordings, transcripts or evaluations to train our own or any third party's general-purpose AI models.

5. Who we share data with

We share personal data only with service providers ("sub-processors") who help us run the Platform, and only to the extent needed. They are bound by contract to protect it and to use it only for the service they provide to us. Categories:

Category	What they receive
Cloud hosting and object storage	All hosted data, including recordings and documents
Telephony carriers and voice infrastructure	Phone numbers, call audio, call metadata
Speech recognition and speech synthesis providers	Call audio and generated text
Large-language-model providers	Transcripts and job context, for evaluation and summarisation
Email, SMS and WhatsApp gateways	Names, email addresses, phone numbers, message content
Payment gateway	Billing contact details and payment amounts
Applicant tracking systems, where a customer connects one	Candidate records the customer chooses to sync

We may also disclose data:

• where required by law, court order, or a lawful request from a public authority;
• to establish, exercise or defend legal claims, or to protect the rights, safety or property of the Company, our customers or the public;
• to a successor entity in a merger, acquisition, restructuring or sale of assets, subject to this Policy.

6. International transfers

Data is primarily hosted in India. Some sub-processors — particularly AI and communication providers — may process data outside India. Where that happens we rely on contractual safeguards requiring a standard of protection consistent with this Policy and with applicable Indian law.

7. Retention

Data	Retained for
Call recordings	The retention period of the customer's plan (typically 30 to 365 days), after which they are deleted
Transcripts, evaluations, candidate records	While the workspace is active, unless the customer deletes them earlier
Account and workspace data	While the account is active; deleted or anonymised within 90 days of termination, subject to the export window in the Terms
Billing, invoice and tax records	As long as required by Indian tax and companies law
Security and audit logs	Up to 12 months

Backups are retained on a rolling cycle and are overwritten in the ordinary course; data deleted from the live system may persist briefly in backups before being cycled out.

8. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) for all traffic to the Platform;
• encryption at rest for stored recordings and documents, and encryption of sensitive credential fields;
• passwords stored only as salted hashes — never in plain text or recoverably;
• strict per-organisation data isolation, so one workspace cannot read another's data;
• role-based access control, and audit logging of security-relevant actions;
• least-privilege internal access, granted only where needed for support or operations.

No system can be guaranteed completely secure. You are responsible for keeping your credentials and API keys confidential. If we become aware of a personal data breach affecting you, we will notify you and the relevant authority as required by applicable law.

9. Your rights

Subject to applicable law, you may request to:

• access the personal data we hold about you and how it is processed;
• correct data that is inaccurate, incomplete or out of date;
• erase data where we no longer have a lawful reason to keep it;
• withdraw consent where processing relies on it — this does not affect processing already carried out;
• obtain a copy of your data in a portable format;
• nominate another person to exercise these rights if you are incapacitated or deceased;
• complain to us, and thereafter to the competent data protection authority.

Write to support@voxai.biz. We will verify your identity and respond within the period required by applicable law, and in any event within 30 days. Candidates: please direct requests to the recruiting organisation, as explained in section 1.

10. Children

The Platform is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child's data has been submitted, contact us and we will delete it.

11. Grievance officer

In accordance with Indian law, complaints about the processing of personal data may be addressed to our Grievance Officer at support@voxai.biz . Please mark your message "Privacy Grievance" so it is routed correctly. We will acknowledge within 24 hours and resolve within the period prescribed by law.

12. Changes to this Policy

We may update this Policy. The revised version takes effect when published on this page with a new effective date; for material changes we will make reasonable efforts to notify you in advance by email or in-product.

Contact us

Questions about this document can be sent to support@voxai.biz.

Mfluence Private Limited
Email: support@voxai.biz