Vocallia answers phone calls for Shopify stores. To do that we handle two very different kinds of information: the merchant's own account details, and the personal information of people who call that merchant's store. This policy covers both, and says plainly what we keep and for how long.
Who is responsible for what
When a customer calls a store using Vocallia, the merchant decides why that call is happening and what it is for. In data-protection terms the merchant is the controller and Vocallia is a processor acting on their instructions. For the merchant's own account — their email, their store, their billing — Vocallia is the controller.
What we collect from merchants
- Store domain, display name, and the contact email you give us.
- An access token from Shopify, which lets the app read your store's data.
- Your settings: greeting, voice, shipping and returns wording, support email.
- Usage: minutes consumed, plan, and billing state.
What we handle from callers
This is the part that matters most, because callers never signed up with us. During a call the app may process:
- The caller's phone number, as passed by the telephone network.
- What they say, converted to text so the agent can respond.
- Order details looked up from the merchant's Shopify store — order number, status, shipping and delivery information, and the name and postal code used to verify the caller is entitled to it.
- An audio recording of the call, if and only if the merchant has turned recording on for their store.
Call recording
Recording is off unless a merchant switches it on. When it is on, the agent states at the start of the call that it is recorded, and that announcement cannot be disabled separately.
Some places — including several US states — require every party to consent before a call may be recorded. Merchants are responsible for deciding whether they may lawfully record where they and their customers are, and must not enable recording unless they may.
Recordings are stored encrypted, are not public, and are reachable only through an authenticated, time-limited link issued to the merchant who owns the call. We do not sell recordings, and we do not give them to anyone but the merchant, except where the law requires it.
How long we keep things
| What | Kept for |
|---|---|
| Call audio recordings | 30 days, then deleted automatically |
| Call transcripts and logged requests | While the store is connected |
| Merchant account and settings | While the store is connected |
| Everything, after the app is removed | Erased when Shopify sends the shop redaction request |
Deletion of recordings is enforced by the app itself on a schedule, not left to a manual clean-up.
Why we may use this data
To answer calls and look up orders — the service the merchant asked for. To bill for usage. To keep the service working, secure and debuggable. To improve how the agent handles calls, using the merchant's own store's data for that merchant's own agent.
We do not sell personal information, and we do not use call content for advertising.
Who else sees it
Vocallia is built on other companies' infrastructure, and a call necessarily passes through some of them:
- Shopify — the merchant's store data, and billing.
- A telephony provider — to carry the call itself.
- Speech and language model providers — to understand the caller and produce a reply.
- Cloud hosting and storage — to run the app and hold recordings.
These providers act on our instructions and are bound by their agreements with us. Some of them process data outside the country a caller is in.
Rights
Depending on where they live, a caller may have the right to ask for a copy of their information, to have it corrected, or to have it deleted. Because the merchant controls that data, requests should go to the merchant, who can action them directly in Vocallia or ask us. We support Shopify's customer data request, customer redaction and shop redaction webhooks, and respond to them.
Security
Data is encrypted in transit and at rest. Access to a store's data requires an authenticated session belonging to that store; recordings are served only through short-lived signed links. No merchant can reach another merchant's calls, recordings or requests.
Children
Vocallia is a business tool and is not directed at children.
Changes
If this policy changes materially, we will update the date at the top and tell merchants in the app before the change takes effect.
Contact
Questions about this policy, or a data request: team@vocallia.ai.