Privacy Policy
Last updated 27 August 2026
[…] need a real answer before it is relied on.Who we are
Woise is operated by […legal entity name…], […registered address…]. For anything in this policy, including a request to see or delete your data, write to privacy@woise.ai.
There are two different relationships to keep apart, because your rights differ between them:
- You are a Woise customer. We are the controller of your account data — your name, email, company details and how you use the dashboard.
- You spoke to an agent a Woise customer runs. That customer is the controller of that call. We are their processor: we handle the audio and transcript on their instructions, and we do not decide what the agent is for. Requests about a call should go to the business that called you or that you called; if you reach us instead, we will pass it on and tell you who they are where we are permitted to.
What we collect
When you use the dashboard
- Account details — your name, email address, password (stored only as a hash), your company name, business phone number and business country. The country is required at signup because it decides which regional site holds your account.
- Configuration you enter — agent designs, prompts, phone numbers, knowledge base documents you upload, and credentials for third-party tools you connect. Credentials are encrypted at rest and are never shown back to you in full.
- Usage records — calls placed and received, their duration, cost and outcome, and API requests. We need these to bill you and to enforce limits.
- Analytics — only if you agree. See the Cookie Policy.
- Error reports — when something breaks, a report goes to our error monitoring so we can fix it. These are technical: the page, the error, the browser. We rely on legitimate interest for this and it is not switched off by a cookie choice, because it sets nothing on your device.
When you speak to an agent
- The audio of the call, while it is happening, so it can be transcribed and answered.
- The transcript, and any information the agent was designed to collect — a name, an address, an appointment time, whatever the business asked for.
- Call metadata — the phone numbers involved, the time, the duration and how the call ended.
- A recording, only where the operating business has switched recording on and where the applicable disclosure has been given.
Woise agents disclose that they are AI where the law requires it, and the platform carries a configurable disclosure for that purpose. Whether it is switched on for a particular agent is the operating customer's responsibility, and our Terms of Service require them to get it right.
Why we are allowed to hold it
| What | Basis |
|---|---|
| Running your account and billing you | Performance of our contract with you |
| Security, fraud prevention, error monitoring | Legitimate interest |
| Analytics cookies | Your consent, which you can withdraw at any time |
| Marketing email | Your consent, given by ticking the box — never pre-ticked |
| Call content processed for a customer | That customer's basis, on their instructions, as their processor |
| Keeping records we are legally required to keep | Legal obligation |
Marketing email
We send marketing email only to people who asked for it. The box at signup is not pre-ticked, and we record what you chose and when. You can change your mind in Settings → Email preferences in the dashboard, or from the unsubscribe link in any marketing message. Withdrawing does not affect service email — receipts, security notices, password resets and anything else we have to send to run your account.
Who else sees it
Woise is assembled from specialist services, and which ones touch your data depends on how you configure your agents. The list below is what the platform can use; your own account may use fewer.
| Purpose | Providers |
|---|---|
| Hosting and storage | Amazon Web Services |
| Speech to text | Deepgram, and others you may select |
| Text to speech | Cartesia, ElevenLabs, Rime, and others you may select |
| Language models | OpenAI, Google, Groq, AWS Bedrock, and others you may select |
| Telephony | Twilio, Plivo, and other carriers depending on region |
| Payments | Stripe |
| Product analytics | PostHog — only with your consent |
| Error monitoring | Sentry |
The complete, current list — with what each provider does and whether it applies to every account — is at woise.ai/sub-processors, and the contract governing it is the Data Processing Addendum.
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose data to law enforcement only where we are legally compelled, and we tell the affected customer unless we are forbidden from doing so.
Where it is held
Woise runs regional sites, and your account is created on the one for the country you chose at signup. […Describe the current data-residency guarantee precisely: which components are regionally isolated today and which are not. Do not state a stronger guarantee than the deployment actually provides — this paragraph is the one a prospective customer's security review will quote back.…]
Where data is transferred out of the UK, EEA or India, we rely on […transfer mechanism: standard contractual clauses, adequacy, or the applicable DPDP transfer route…].
How long we keep it
Account data lives as long as your account does, and for […retention window…] afterwards so the account can be restored and so we can meet tax and accounting obligations. Backups roll off within […backup window…]. Error reports and analytics events are kept for […retention window…].
Call content ages out automatically: transcripts, the information an agent collected and the data a call started from are removed after […retention window…], and recordings after a shorter […retention window…]. The record of the call itself — when it happened, how long it lasted, what it cost — is kept for accounting, without its contents. Operating customers may set shorter periods. […This automatic expiry is built but not yet switched on, and it does not yet remove stored audio files from backup storage. Remove this sentence when both are true.…]
Your rights
Depending on where you live, you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict what we do with it, withdraw consent, and ask for it in a portable form. In the UK and EEA these come from the UK GDPR and the GDPR; in India from the Digital Personal Data Protection Act, 2023; in California and several other US states from state privacy law, including the right not to be discriminated against for exercising them.
If you have a Woise account: you can download a copy of your account data yourself, at any time, from Settings → Your data in the dashboard. Correction and erasure are not yet self-serve — write to us and we will do it.
If you spoke to an agent and have no account: use the form at woise.ai/data-request. You do not need an account to use it. We record the request and route it to the business responsible for the call, because they — not Woise — decide the outcome.
For anything else, write to privacy@woise.ai. We answer within one month, and we will tell you if we need longer. If you are unhappy with the answer you can complain to your data protection authority — in the UK the ICO, in India the Data Protection Board, in the EEA your national supervisory authority.
If your request concerns a call with an agent operated by one of our customers, we will forward it to that customer, because the decision is theirs to make.
Security
Passwords are hashed, third-party credentials are encrypted at rest, traffic is encrypted in transit, and access to production is limited to staff who need it. No system is perfectly secure; if a breach affects you we will tell you and the relevant authority within the time the law allows.
Children
Woise is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child's data has reached us, write to privacy@woise.ai and we will delete it.
Changes
When this policy changes materially we will tell account holders by email before the change takes effect, and the date at the top of this page will move. Continuing to use Woise after that means you accept the updated policy.