Privacy Policy

When you sign up for Polaris Voice, we collect:

• Account Information: Name, email address, phone number, password
• Google Sign-In (if used): When you sign in with Google, we receive your name, email address, and profile picture from your Google account
• Business Information: Business name, address, website, hours of operation, and industry. This information helps your AI receptionist answer caller questions accurately—like confirming your hours, providing directions, or understanding the services you offer—so every call feels knowledgeable and professional.
• Payment Information: Credit card details, billing address (processed by Stripe)
• Integration Credentials (optional): If you choose to connect services like Google Calendar or Outlook, we securely store OAuth tokens to schedule and manage appointments on your behalf during calls. You can disconnect these integrations at any time from your dashboard.

When someone calls a phone number answered by Polaris Voice, we collect the following information so business owners can review how their AI receptionist is performing, identify areas for improvement, and ensure callers are getting the best possible experience:

• Call Metadata: Caller phone number, date/time, call duration
• Voice Recordings: Audio recording of the call, so you can listen back and fine-tune how your receptionist handles conversations
• Transcripts: Text transcription of the call, making it easy to review conversations at a glance
• Caller-Provided Information: Name, appointment details, and messages shared during the call

Your data is stored in Canada on Google Cloud Platform (Toronto). However, to deliver our Service, certain data is shared with the following US-based providers:

• ElevenLabs — The industry leader in conversational AI voice technology, responsible for the natural, human-quality voice experience your callers hear. Voice audio is processed in the United States during live calls, then securely stored in Canada after the call ends.
• Stripe — Handles all payment processing securely. Your credit card details are stored and managed entirely by Stripe and never touch our servers.
• PostHog — Helps us understand how customers use our website and dashboard so we can improve the experience. No call data or personal conversations are shared with PostHog.
• Twilio — Delivers SMS notifications and text confirmations to you and your callers, such as appointment reminders.

All providers are bound by Data Processing Agreements that require them to protect your information to standards consistent with PIPEDA.

When a Business Customer connects third-party services, we share data as directed (e.g., calendar appointments, CRM data).

Google Sign-In: If you choose to sign in with Google, we use Google's authentication service to verify your identity. We receive your basic profile information (name, email, profile picture) to create and manage your account. We do not receive your Google password. Google's use of your information is governed by the Google Privacy Policy.

Google Calendar Integration: If you connect Google Calendar, we request permission to:

• View your calendar availability (to check for scheduling conflicts)
• Create, modify, and delete calendar events (to book appointments on your behalf)

We only access calendar data necessary to provide appointment booking functionality. We do not access other Google services or data. You can disconnect Google Calendar at any time from your dashboard settings, which revokes our access.

Polaris Voice's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google Calendar data to provide and improve the appointment booking functionality of our Service
• We do not use Google Calendar data for advertising
• We do not sell Google Calendar data to third parties
• We do not use Google Calendar data for purposes unrelated to the Service

• In Transit: All data is encrypted using TLS 1.3, the latest and most secure transport protocol available
• At Rest: All stored data—including call recordings, transcripts, and account information—is encrypted at rest via Google Cloud Platform's default AES-256 encryption
• Per-Tenant Encryption Keys: Sensitive credentials such as integration tokens are additionally encrypted with per-tenant derived keys, adding an extra layer of protection for your connected services

• Data Stored in Canada: All stored data resides on Google Cloud Platform in Toronto, Canada
• Tenant Isolation: Every customer's data is logically separated at the database using row-level security policies, preventing any cross-account access
• No Shared Storage: Call recordings are stored in isolated, tenant-prefixed paths—your files are never co-mingled with another business's data

• Role-Based Access: Only authorized personnel can access customer data, scoped to the minimum necessary for their role
• Audit Logging: All access to sensitive data is logged and monitored
• Secure Authentication: We support Google Sign-In and enforce secure password requirements to protect your account

• Access: Request a copy of all personal information we hold about you and your business
• Correction: Request correction of any inaccurate or incomplete information
• Deletion: Delete your account and all associated data directly from your dashboard, or request deletion by contacting us. All data is removed within 30 days of account closure.
• Data Export: Download your call history, transcripts, and contact data from your dashboard at any time
• Withdraw Consent: Withdraw consent to data processing at any time. Note that withdrawing consent may limit our ability to provide the Service.
• Disconnect Integrations: Revoke access to any connected service (Google Calendar, Outlook, etc.) at any time from your dashboard settings

• Disclosure: At the start of every call, our virtual assistant discloses that you are speaking with an AI and that the call is being recorded
• Opt Out: You may end the call at any time if you do not wish to be recorded
• Access & Deletion: Callers may request access to or deletion of their call data by contacting us

You can manage most of these preferences directly from your Polaris Voice dashboard. For any other requests, or if you are a caller seeking access to your data, contact us at: privacy@polarisvoice.ca

We will respond to all privacy requests within 30 days, as required by PIPEDA.

• Call recordings and transcripts — stored on Google Cloud Platform in Toronto
• Account and business information — stored on Google Cloud Platform in Toronto
• Contact and call metadata — stored on Google Cloud Platform in Toronto

The following data is processed in the United States by our service providers during normal operation:

• Voice audio (ElevenLabs) — During a live call, voice audio is streamed to ElevenLabs servers in the US for real-time speech processing. After the call ends, recordings are downloaded and stored in Canada. ElevenLabs may retain call data on their servers in accordance with their own data retention policies and our Data Processing Agreement.
• Payment data (Stripe) — Credit card details and billing information are processed and stored by Stripe in the US. Card details never touch our servers.
• SMS messages (Twilio) — Text notifications and appointment confirmations are routed through Twilio's US infrastructure.
• Website analytics (PostHog) — Anonymous usage data about how you interact with our website and dashboard. No call content or personal conversations are included.

• Data Processing Agreements: Every US-based provider is bound by a formal DPA requiring them to protect your data to standards consistent with PIPEDA
• Minimum Necessary: We only share the data each provider needs to perform its specific function—nothing more
• Encryption in Transit: All cross-border data transfers are encrypted using TLS 1.3
• Accountability: Regardless of where data is processed, Polaris Voice remains fully accountable for its protection under Canadian privacy law