Privacy at Open Voice Shield

Who is responsible for what

There are two different relationships, and they have different answers.

For call content, the operator who sends us the traffic decides whose calls are carried and why. They are the controller. We act on their instructions and hold the content for them, which makes us a processor. If you were on a call that Open Voice Shield carried and you want it removed, the operator whose trunk carried it is the party who can decide that, and we act on their instruction.

For account data, the name, email address, sign-in history and IP addresses of the people who use the portal, we decide what is collected and why, so we are the controller.

What is recorded

For every call that passes through the platform:

• The audio of both parties, as a two-channel recording, held on storage we control with server-side encryption on and public access blocked.
• The raw media, briefly, only long enough to produce that recording and to diagnose a failure.
• The transcript and the analysis: the full text of what was said and everything derived from it, including the verdict, its category and its red flags.
• The signalling: the calling and dialled numbers, source address, destination, timings and billing. No audio.

For the people who use the portal, we hold the account name and email address, a password hash where a password is used, sign-in timestamps, the IP address a signup and each sign-in came from, and the audit log of actions taken in the account.

To understand how accounts get started, we also keep a short product log per account: which onboarding steps it reached and when, which pages of the portal it opened (the path only, never what was typed or searched) and which features it used. If you arrived on this site from a campaign link or another site, the campaign fields and the referring site's name are remembered in your browser and attached to the account you create, so we know which channels bring customers. None of this leaves our systems or goes to a third party, and there is no advertising tracker on this site or in the portal.

For this website we read our own web server's log: the page requested, the site that linked to it, the browser family and language, and whether the request came from a person or a crawler. Your address is not stored. A hash of it that changes every day lets us count visitors without identifying anyone. Nothing runs in your browser for this.

Why

Call content is recorded because the product analyzes the conversation. The product cannot reach a verdict without hearing the call, because signalling and call records do not tell you what was said. The signup and sign-in IP addresses are held to investigate fraud and abuse of the service itself.

Account data is used to run the account: to sign you in, bill you, keep the service secure, answer support requests and send the e-mail described below.

Call content is used to provide the service to the operator it belongs to. We also use it internally, under the same controls, to check and improve the quality of the analysis. We do not sell any of it, we do not use it to advertise, we do not let anyone use it for their own purposes or to train models offered by others, and one customer's content never appears in what another customer receives.

Where it lives, and who else sees it

Recordings sit on our own disk or in an object store we control. Nothing is stored in a bucket we do not control. Transcripts, analyses, signalling and call records are in our database. For the hosted service, that storage is in Canada by default. An operator may choose the United States instead for the recordings and media captures of its own account, under Account > Data location. The choice applies to calls from the moment it is saved, and recordings already stored stay where they are. Europe, or any other region our cloud runs in, can be enabled on request for both the media relay and storage. Whatever the choice, transcripts, analyses, signalling and call records remain in our database in Canada. How the choice works.

Where a call's content is sent to a cloud speech-to-text or analysis provider, the portal marks that stage as local or cloud on the call record, so the operator can tell from the call itself whether its content left our hardware. Speech-to-text can also run on our own hardware, in which case the audio never leaves it. These are the subprocessors that may receive personal data, and what each one receives:

• Speech-to-text: OpenAI or Groq (cloud), or our own hardware. They receive the call's audio, per channel, to return a transcript.
• Analysis: Anthropic, OpenAI or OpenRouter (the last for open-weight models), depending on the analysis tier the operator picks. They receive the transcript and the call's metadata: the dialled and calling numbers, source and media addresses, destination, duration and start time.
• Voice agents: OpenAI or xAI, only for calls an operator routes to its own AI voice agent there. The agent receives the live audio of those calls under the operator's own account with that provider. We relay the call and, for OpenAI, accept it on the operator's behalf with the operator's own key. Synthesized speech exists only inside those calls and inside test calls. The platform offers no standalone voice generation.
• Hosting and storage: Amazon Web Services, in Canada by default and in the United States for recordings where an operator chooses it. Everything above is stored here.
• Caller-ID verification numbers: Twilio answers calls to the platform's own verification numbers and reports the caller ID that arrived. It hears the short verification announcement, never customer traffic.
• Payments: Stripe receives the account's email address, plan and amounts. No call content.
• E-mail delivery: Mailgun carries the platform's e-mail, including alert e-mails, which can contain a call's transcript when the operator's alert rule asks for it, and monthly invoices.
• Slack, only when an operator connects a channel: the verdict, the red flags, the numbers on the call, the category and impersonated entity, the call's quality and a link to it. No transcript.

The speech and analysis providers receive content through their business APIs, under terms that do not let them train their models on it. Requests to OpenRouter are limited to model hosts that do not keep or train on what they receive.

Beyond those providers, call content is disclosed to nobody except the account it belongs to, and to us where we need it to run, repair or check the quality of the service. A shared call link is the one way an account can publish a single call outside itself. It is password-protected and marked never to be indexed.

Processing outside Canada

Several of the providers above are in the United States, and an operator can choose to keep its recordings there. Personal information that is processed or stored in another country is subject to that country's laws, and its courts, law enforcement and national security authorities may be able to reach it. Each provider is bound by contract to protect the information, and we remain responsible for it. Operators are responsible for telling the people on their calls where the law requires it.

How long it is kept

Recordings, media captures and signalling logs each expire on their own retention window, set platform-wide. Expiry is a real deletion of the object rather than a flag: the call keeps its metadata and the missing artefact is reported as an omission. Media captures go first, as soon as they have been converted, and any left over within a day. Recordings are kept for 30 days by default, including test calls.

Call records, transcripts, analyses, ledger entries and the audit log are kept until they are erased on request. There is no automatic deletion of these today. Database backups contain everything the database does. Ledger entries and invoices are kept for at least six years after the year they relate to, as Canadian tax law requires, even after an account closes. Account data is kept while the account is open and is erased on request after it closes, except what the law requires us to keep.

The current windows are shown in the portal and described in the security documentation. If a call needs to outlive its window, export it: the evidence bundle is one self-contained file that opens offline with no account.

Test calls and verification calls

An account holder can ask the platform to place a test call: to check a route, to confirm a scam recording is scored as a scam, or to let their own voice agent talk to a phone. Every such call opens with a recorded announcement that it is an automated test call from Open Voice Shield, placed on behalf of one of its account holders, and that it is recorded. It is then recorded, transcribed and analyzed like any other call, and kept on the same windows, so the person who answers is a party to a recorded call. Having the right to call that number, and meeting any consent or announcement rule where it is answered, is the account holder's responsibility.

A test call presents the platform's own number as its caller ID, or a number the account holder has proved they answer. The scam recording and voice agents are only ever played to such a number. A number is proved by a verification call: it says it is an automated call from Open Voice Shield placed on behalf of an account holder, speaks a six-digit code twice, and asks for it to be typed into the portal. That call is relayed only: it is not recorded, transcribed or analyzed, and the code is never stored readable.

AI assistant connectors

An account holder can connect an AI assistant, such as Claude, to their account. The assistant signs in through our own sign-in page. No password or key passes through the conversation, and credentials for voice-agent providers and webhook secrets are entered in the portal only. Whatever the assistant reads through the connector, including a call's full transcript, becomes part of that conversation and is then also held under the assistant provider's own terms and retention. An assistant can ask for a test call but cannot place one: the account holder confirms each call in the portal first.

Sensitive information on calls

People say sensitive things on calls: card numbers, health details, passwords. The platform records and transcribes what is said and does not redact it today. Operators decide which calls they route to us, and the Terms of Service ask them not to route calls whose legal obligations they cannot meet.

Automated processing

Verdicts are produced by automated systems: speech-to-text and AI models score each call. We do not use them to make decisions about the people on a call. The operator decides what happens next, for example whether a number is blocked, and is responsible for telling people about a decision based on automated processing where the law requires it, including Quebec's privacy law. Questions about such a decision go to the operator that carried the call.

Security incidents

If a breach of our security safeguards involves personal information, we assess the risk it creates. Where there is a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada, and to the Commission d'accès à l'information du Québec where its law applies, and we notify the people affected, as the law requires. For call content we tell the operator it belongs to without undue delay, so that it can meet its own obligations. We keep a record of every breach for at least 24 months.

The e-mail we send

We send account holders e-mail about their account: sign-in and security messages, receipts and invoices, the alerts they set up, a few notes in their first days to help them get started, and occasional product news. Onboarding notes and product news say who they are from, give our mailing address and let you unsubscribe, and we act on an unsubscribe within 10 business days. Messages about your account's security, billing and alerts keep coming while the account is open.

Cookies and browser storage

The portal sets a cookie to keep you signed in. This site keeps the first-touch campaign fields in your browser's local storage, as described above, and remembers a theme you choose. None of it is used for advertising, and there are no third-party trackers.

Children

The service is for businesses. It is not directed to children, and we do not knowingly collect account data from anyone under 18.

What is changing

More flexible controls. Today the retention windows are set for the whole platform, processing runs the same way for every account, and erasure is a request to us. We are working on giving each operator its own say over those: retention per account, a choice of which stages run where, and self-service erasure. As each control lands it will be described in the documentation and in what's new, and this page will be updated to match.

An on-premises deployment. Some operators cannot let call content leave their own network at all. A deployment that runs on the operator's own infrastructure is planned. In that arrangement the recordings, transcripts and analyses stay on hardware the operator runs, the sections above on where content lives apply to the operator's own storage rather than ours, and our role in the content is limited to the software. We will say when it is available, not before.

Erasure, access and complaints

Erasing an account, or a specific call, is something we do on request. Write to support@telecomsxchange.com. If you are an operator, ask us for the turnaround time and put it in your contract. If you were a party to a call rather than our customer, tell us which operator carried it and we will route the request to them, because it is their instruction to give.

Under Canadian privacy law you may ask what we hold about you, ask for it to be corrected, and withdraw your consent, subject to legal and contractual limits. Withdrawing consent to what the service needs in order to run can mean closing the account. In Quebec you may also ask for your information in a structured, commonly used technological format. We answer within 30 days. You may complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to the privacy commissioner of British Columbia or Alberta where their laws apply. Where the GDPR applies you have the equivalent rights of access, rectification, erasure, restriction, portability and objection, exercised through the operator for call content and directly with us for account data.

A word to operators about consent

Recording a call is regulated, and the rules differ by jurisdiction: some require all parties to consent, some require one, some require an announcement. Open Voice Shield records every call you route through it. Deciding whether you may do that, and announcing it where you must, is yours. Settle it before you point a production trunk at us. Section 5 of the Terms of Service sets out everything an operator is responsible for.

Contact, privacy officer and governing law

The service is operated by TelecomsXChange Canada Inc., 4145 North Service Road, 2nd Floor, Burlington, Ontario L7L 6A3, Canada.

Our privacy officer is accountable for this policy and for how we handle personal information. Write to the privacy officer at support@telecomsxchange.com with "Privacy" in the subject, or by mail at the address above.

When this policy changes we post the new version here with its date, and we tell account holders about material changes by e-mail or in the portal. This policy is governed by the laws of Ontario and the federal laws of Canada that apply there.