Privacy Policy

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process appointments, send confirmations, and deliver WhatsApp/SMS follow-ups on your behalf
• Manage your account and authenticate your identity
• Process billing and prevent fraudulent transactions
• Respond to your support requests and inquiries
• Improve, personalise, and expand our Service through usage analytics of platform interaction data (such as call volumes, durations, and outcomes). Google Calendar data is not used for any analytics purpose.
• Send administrative notices such as updates, security alerts, and policy changes
• Comply with applicable legal obligations

We process your personal data on the following legal bases under applicable Indian law (Information Technology Act, 2000 and associated rules) and, where applicable, international privacy frameworks:

• Contractual necessity — to provide the Service you have subscribed to
• Legitimate interests — to improve our Service and prevent fraud
• Consent — where you have expressly consented to specific processing activities
• Legal obligation — to comply with applicable laws and regulations

We do not sell your personal information. We may share your data with:

• Service Providers — third parties who assist us in operating the Service (e.g., cloud hosting, payment processors, telephony providers). They are contractually bound to protect your data.
• Legal Requirements — we may disclose your information if required by law, court order, or governmental authority.
• With Your Consent — we may share data for other purposes with your explicit consent. Google Calendar data is only shared with third-party services (such as CRM platforms) with the consent of the business client who owns the calendar.

We retain your personal information for as long as your account is active or as necessary to provide the Service. You may request deletion of your account and associated data by contacting us at support@prismavoices.com. We may retain certain data for longer periods to comply with legal obligations or resolve disputes.

We implement industry-standard technical and organisational security measures including multi-tenant data isolation, encrypted OAuth token storage, webhook signature verification, and row-level security (RLS). However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of your personal data
• Withdraw consent where processing is based on consent
• Object to or restrict certain types of processing

To exercise any of these rights, please contact us at support@prismavoices.com. We will respond within a reasonable timeframe.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

Our Service is operated from India. If you access the Service from outside India, your information may be transferred to and processed in India. By using the Service, you consent to such transfer.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the effective date. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

Prisma Voices integrates with Google Calendar through Google's OAuth platform when a business owner connects their calendar from our dashboard. We request the following OAuth scopes, each used only for the user-facing feature it powers:

• calendar.freebusy — Checks the owner's free/busy times via Google's freeBusy.query endpoint so the AI receptionist can offer time slots that are actually free during a live call. No event titles, descriptions, or attendees are read.
• calendar.events — Creates a single calendar event when a caller confirms a booking, via the events.insert endpoint only. We do not list, read, modify, or delete events the owner did not create through Prisma Voices.
• userinfo.email — Read once at connection time to display the linked Google account email in the dashboard, so the business owner can verify which account is connected and disconnect it.

Limited Use: Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used solely to provide the user-facing features described above; we do not transfer, sell, or share it with third parties for advertising or any other purpose, and we do not use it to develop, improve, or train generalised or large language machine-learning models. OAuth refresh tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256). You may revoke access at any time from your Prisma Voices dashboard or from your Google Account settings at https://myaccount.google.com/permissions; revocation causes us to delete the stored credentials.

When someone calls a business that uses Prisma Voices, the assistant tells them at the start of the call that if they book, a confirmation text will be sent to the number they are calling from. We then text that number on the business's behalf with the appointment confirmation, a reminder about 24 hours before, and any reschedule follow-up — typically 1–3 messages per appointment. Message and data rates may apply. Reply STOP to any message to opt out, which we honour immediately, or HELP for help.

• We do not share or sell mobile numbers or SMS opt-in data with third parties for marketing.
• Mobile numbers are used only to send the appointment messages described in our SMS Terms.

Read our SMS Terms

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: support@prismavoices.com
• Website: https://prismavoices.com
• Registered entity: PrismaVoices Global LLP, India