Privacy notice
Last updated 6 September 2026
1. Who is responsible
Voiceura, Zürich, Switzerland ("Voiceura", "we") operates the website voiceura.com and the Voiceura call management service. For questions about data protection, write to hello@voiceura.com.
We process personal data under the Swiss Federal Act on Data Protection (FADP). Where the GDPR applies to you, the information in this notice also satisfies Articles 13 and 14 GDPR.
2. Who this notice is for
- Visitors of this website.
- People with a Voiceura account: the staff of our customers who log in to set up call flows or take calls.
- Callers: people who call a phone number that one of our customers runs on Voiceura. In that case the customer you called decides why and how the call is handled; it is the controller, and we process the call on its behalf under a data processing agreement. Section 5 explains what happens to a call technically; for your rights, contact the company you called.
3. This website
Server logs
Our web server records the IP address, time, requested page, browser identification and referring page of every request. We use these logs to keep the site running and to defend it against abuse. They are deleted after 14 days.
Statistics
We count visits with Umami, an analytics tool that runs on our own servers in Switzerland. It records the page, the referring site, browser, operating system, device type, screen size and language, and the country derived from the IP address. It sets no cookies and does not store your IP address; visitors are counted with a hash that changes every day, so no profile is built across days or websites. Nothing is shared with anyone. Requests from automated tools are not counted.
Cookies and third parties
The website sets no cookies. Fonts, scripts and stylesheets are served from voiceura.com; the page makes no request to any third party.
Contact and demo requests
If you write to us or book a demo, we keep the correspondence for as long as needed to handle your request and for our records.
4. Voiceura accounts
When a customer creates accounts for its staff, or when you sign up yourself, we process:
- your name, work email address and role, and the customer (workspace) you belong to;
- your password, stored only as a salted hash (bcrypt);
- when you sign in with a one-time code, the code itself, held in memory for ten minutes and never stored;
- when your organisation uses single sign-on with Microsoft Entra ID, the identity details Microsoft sends us (object id, email address, display name);
- the time of your last login and, in a security log, every login attempt, failure, throttling event, sign-up and logout with your email address and IP address. The security log is kept for one year.
The application sets two strictly necessary cookies: px_session keeps you signed in for 12 hours, px_csrf protects forms against misuse. Neither contains personal data or is used for tracking.
5. Calls handled by Voiceura
For each call we process, on behalf of the customer you called:
- the calling number (unless withheld), the called number and any number the call was forwarded from;
- date, time and duration;
- how the call was handled (forwarded, voicemail, ended) and which steps of the customer's call flow it went through;
- during AI screening, what you say to the assistant, transcribed by the telephony provider's speech recognition, and the assistant's summary and decision;
- messages you leave on voicemail;
- a recording of the conversation when the customer has enabled it; callers are informed before any recording starts;
- for Swiss numbers, the name and company listed for your number in the public directory (tel.search.ch).
Where and for how long. Recordings, transcripts and call records are stored on our servers in Switzerland. Recordings are deleted after 30 days unless the customer sets a different retention period. Call records (numbers, times, outcome) are kept for as long as the customer uses the service; they form its call history and the basis of its invoice.
Processing chain. The call is carried by our telephony provider Twilio, which also converts speech to text and text to speech; numbers and recordings are pinned to Twilio's Ireland region. During AI screening we send the transcript of your answers, your number with its directory entry and the customer's screening instructions to Anthropic, or to OpenRouter if the customer has chosen it, so the AI can decide how to route the call. Only text goes to the AI providers, never audio.
6. Sub-processors
We rely on the following companies to run the service. They process data only on our instructions and under a data processing agreement.
| Provider | Purpose | Data | Location and safeguards |
|---|---|---|---|
| Infomaniak Network SA Geneva, Switzerland | Hosting of the Voiceura servers (website, application, database, recordings) | All data listed above | Switzerland |
| Twilio Inc. San Francisco, USA; for Europe Twilio Ireland Ltd, Dublin | Telephony: phone numbers, call routing and bridging, speech recognition, text-to-speech, capture of recordings | Phone numbers, call audio and metadata, transcripts | Ireland (Twilio region IE1 for numbers and recordings); US parent company; EU standard contractual clauses, Swiss-U.S. Data Privacy Framework |
| Anthropic PBC San Francisco, USA | AI call screening (Claude) | Transcribed caller statements, the caller's number and directory entry, the customer's screening instructions | USA; EU standard contractual clauses; API data is not used to train models |
| OpenRouter, Inc. USA | Alternative AI gateway, only where a customer selects it; forwards to the model provider the customer chose | As for Anthropic | USA and the chosen model provider's location; EU standard contractual clauses |
| Swisscom Directories AG (tel.search.ch) Zürich, Switzerland | Look-up of the caller's number in the public Swiss directory | Caller's phone number | Switzerland |
| Microsoft Ireland Operations Ltd Dublin, Ireland | Single sign-on with Microsoft Entra ID, only for customers who enable it | Identity details of the person signing in | EU/USA under the customer's own Microsoft agreement |
Integrations a customer connects itself, such as Google Contacts, Microsoft 365 or a webhook to its own systems, run on the customer's instruction and under the customer's own agreements with those providers. Analytics (Umami) and system logs run on our own servers in Switzerland and involve no third party. Login codes are sent by email; the email provider will be listed here before code login is switched on.
7. Data outside Switzerland
Twilio, Anthropic and OpenRouter are US companies. Phone numbers and recordings are handled in Twilio's Ireland region; telephony signalling and the AI requests can involve processing in the United States. We rely on the providers' data processing agreements with the EU standard contractual clauses (recognised by the FDPIC for Switzerland) and, where the provider is certified, on the Swiss-U.S. Data Privacy Framework. Everything we store ourselves stays in Switzerland.
8. Retention
| Data | Retention |
|---|---|
| Web server logs | 14 days |
| Website statistics | Aggregated counts without personal data, indefinitely |
| Account data | Until the account is deleted |
| Security log | 1 year |
| Recordings and voicemails | 30 days, adjustable by the customer |
| Transcripts and AI summaries | With the call record |
| Call records | For the duration of the customer relationship |
9. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a common format. Write to hello@voiceura.com. If your request concerns a call to one of our customers, that customer is your point of contact; we support it in answering you. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA, with your supervisory authority.
10. Security
All connections are encrypted with TLS. Passwords are stored only as hashes. Login attempts are rate-limited, forms are protected against misuse, and the administration infrastructure is reachable only over a private network. Access and security-relevant actions are logged.
11. Changes
We update this notice when the service or the sub-processors change. The version published here applies; the date at the top shows the latest revision.