Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Telenow ("Telenow", "we", "us", or "our") collects, uses, discloses, and safeguards information in connection with our voice-AI agent platform and related websites, dashboards, APIs, and services (collectively, the "Services"). Telenow provides a business-to-business platform that lets our customers ("Customers") build and operate AI agents that place and receive phone and web-based voice calls. This policy describes our practices both as a provider of the Services and as a processor acting on behalf of our Customers.

1. Information We Collect

We collect the following categories of information:

• Account information. Name, business email address, company name, role, password credentials, and other details you provide when you register for, configure, or administer an account.
• Call recordings and transcripts. Audio recordings, machine-generated transcripts, and derived metadata from phone and web calls that flow through agents configured on the platform. This content may include the voices and statements of end users who interact with our Customers' agents.
• Usage and technical metadata. Call timestamps, durations, phone numbers, dispositions, latency and quality metrics, agent and prompt configurations, IP addresses, device and browser information, and log data generated when you use the Services.
• Payment information. Billing contact details and limited transaction data. Card and bank details are collected and processed by our third-party payment processors; we do not store full payment card numbers on our systems.
• Cookies and similar technologies. We and our analytics providers use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure the Services, and understand product usage. You can control cookies through your browser settings, though some features may not function without them.

2. How We Use Information

We use information to:

• provide, operate, maintain, and secure the Services;
• route, transcribe, and process voice calls and generate AI agent responses;
• authenticate users, prevent fraud and abuse, and enforce our terms;
• monitor performance, debug issues, and improve reliability and quality of the Services;
• calculate usage, generate invoices, and process payments;
• communicate with you about your account, security, and product updates; and
• comply with legal obligations and respond to lawful requests (see our Law Enforcement & Government Data Request Guidelines).

We do not sell personal information. We do not use Customer call content to train our own general-purpose foundation models, and we configure our AI sub-processors to operate on a no-training basis where such options are available.

3. Sub-processors and Third-Party Providers

To deliver the Services we rely on trusted sub-processors who process data on our behalf under contractual confidentiality and security commitments. These include:

• AI model providers. Large language model (LLM), speech-to-text (STT), and text-to-speech (TTS) providers that power agent reasoning, transcription, and voice synthesis. Audio and text are transmitted to these providers to generate real-time responses.
• Telephony carriers. Communications providers such as Plivo and Twilio that originate, terminate, and stream voice calls over the public telephone network.
• Infrastructure and support vendors. Cloud hosting, storage, error monitoring, analytics, email delivery, and payment processing providers.

A current list of sub-processors is available on request. We remain responsible for the processing carried out by our sub-processors.

4. Data Retention

We retain account and usage data for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Call recordings and transcripts are retained according to the configuration and retention settings chosen by the Customer that controls the relevant agent. Customers may delete recordings and transcripts, and we will delete or de-identify data following account termination, subject to backup retention cycles and legal hold requirements.

5. Security

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption of data in transit, encryption of sensitive data at rest, access controls, network segmentation, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and API keys.

6. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information, and to receive a copy of your information in a portable format (for example, under the GDPR or the CCPA/CPRA). Where we act as a processor on behalf of a Customer, we will refer requests from that Customer's end users to the relevant Customer and assist them in responding. To exercise rights with respect to data for which Telenow is the controller, contact us using the details below. You may also have the right to lodge a complaint with a supervisory authority and to withdraw consent where processing is based on consent.

If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to access a summary of your personal data and the processing we carry out, to have inaccurate data corrected or completed, to have your data erased where it is no longer needed for the purpose it was collected for, to nominate another person to exercise these rights on your behalf, and to a readily available means of grievance redressal. See Grievance Officer (India) below.

6a. Voice Cloning and Biometric Data

Our Services allow a Customer to create a synthetic voice from a voice sample. Doing so generates a voiceprint, which is a biometric identifier under laws including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington My Health My Data Act.

• Notice and release. A voiceprint is created only where the person whose voice it is has been told, before their voice was recorded, that a biometric identifier would be created, for what purpose, and for how long it would be kept — and has provided a written release. Where a Customer clones a third party's voice, the Customer confirms at capture that it holds that release and can produce it on request.
• Purpose. A voiceprint is used solely to synthesize speech for the account that created it. We do not sell, lease, trade, or otherwise profit from voiceprints.
• Retention and destruction. A voiceprint is destroyed on the schedule selected when it was created, when the Customer deletes the voice, or within three years of the last interaction with the person whose voice it is — whichever occurs first. Destruction removes both the reference recording and any copies held by the voice providers listed in our sub-processor register.
• Disclosure. A voiceprint may be processed by the third-party voice providers listed in our sub-processor register in order to create and use the synthetic voice.

7. Call-Recording Consent

Recording, monitoring, and transcribing calls are subject to laws that vary by jurisdiction, and some jurisdictions require the consent of one or all parties to a call. As between Telenow and the Customer, the Customer is solely responsible for determining the legal basis for, and obtaining any required consents and providing any required disclosures for, recording, transcribing, and processing calls conducted through its agents. Customers are responsible for configuring appropriate consent prompts and disclosures and for the lawfulness of the calls they place and receive.

8. Children's Data

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

9. International Transfers

We and our sub-processors may process and store information in countries other than the one in which you are located. Where we transfer personal information across borders, we rely on appropriate safeguards, such as Standard Contractual Clauses or other recognized transfer mechanisms, to protect that information consistent with applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised policy.

11. Contact Us

If you have questions or requests regarding this Privacy Policy or our data practices, contact us at [email protected].

12. Grievance Officer (India)

In accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, the following officer may be contacted about any grievance regarding the processing of your personal data: