Privacy policy.

This Privacy Policy describes how Voxaris AI, Inc. (“Voxaris,” “we,” “our”) collects, uses, and discloses information through the Talking Postcard product and the websites at talkingpostcard.io and voxaris.io(collectively, the “Service”).

1. Who this policy covers

The Service has two distinct audiences:

• Dealership decision-makers who visit our marketing site, configure a sample postcard, request a demo, or sign in to the Voxaris Command dashboard.
• End-customers who scan a physical Talking Postcard mailer sent by a participating dealership and then engage with a live AI video agent.

For end-customers, the dealership that sent the mailer is the data controller. Voxaris acts as a service provider / data processor on that dealership’s behalf, subject to a written service agreement.

2. Information we collect

From dealership users:

• Identifying details you submit (name, email, dealership, phone, city).
• Variables you enter into the on-site configurator.
• Account credentials and session information when signed into the dashboard (authentication via Clerk).
• Server logs, request metadata (IP address, user agent, referrer), and Vercel-issued telemetry.

From end-customers who scan a postcard:

• Scan event metadata (QR identifier, approximate region, timestamp).
• Audio, video, and transcript content captured during the live AI video conversation, processed by our subprocessor Tavus.
• Information you volunteer to the AI agent (e.g., name confirmation, vehicle mileage, condition, preferred appointment window).

3. How we use information

• To operate the Service and provide it to participating dealerships.
• To produce structured lead records (ADF/XML) and deliver them to the dealership’s CRM via TLS email.
• To improve the AI agent’s performance, accuracy, and safety.
• To respond to inquiries and fulfill contract obligations.
• To comply with legal obligations and protect against fraud or abuse.

We do not sell personal information. We do not use end-customer data to train general-purpose AI models outside of specific dealership-engagement features.

4. Subprocessors

We rely on the following service providers, each bound by their own data protection terms:

• Tavus — AI video agent infrastructure (audio/video/transcripts).
• Daily.co — WebRTC video transport (transient).
• Cartesia — text-to-speech voice synthesis.
• Supabase — application database and authentication storage.
• Clerk — dashboard authentication and session management.
• Resend — transactional email delivery.
• Slack — internal lead notifications (Voxaris team only).
• Vercel — hosting and edge compute.
• Google Analytics — anonymized site analytics (marketing site only).

5. Call recording & transcripts

Live demos launched at /callare recorded and transcribed via our Tavus subprocessor. By proceeding into a call you consent to recording and transcription for the purpose of improving the agent’s performance and producing the illustrative lead record. We do not share demo recordings with third parties or use them for marketing.

Production end-customer calls run by dealerships include an in-conversation disclosure of recording and AI involvement at the start of every call. The dealership operating the campaign is responsible for complying with applicable consent laws (including two-party consent jurisdictions).

6. Data retention

• Demo recordings: retained for up to 30 days, then deleted.
• Production call records and lead data: retained for the duration of the dealership’s service contract plus 90 days, then deleted or returned at the dealership’s direction.
• Server logs: 30 days rolling window.
• Dashboard account data: retained for the lifetime of the account, deleted within 30 days of account closure.

7. Your rights

Depending on where you reside, you may have the right to access, correct, delete, or port your personal information, and to opt out of certain processing. Submit a request to privacy@voxaris.io; we respond within 30 days. End-customers should also contact the dealership whose mailer they received, as that dealership is the primary data controller.

8. Security

We use industry-standard encryption in transit (TLS 1.2+) and at rest (AES-256 via Supabase), least-privilege access controls, and audit logging on production systems. No system is perfectly secure; in the event of a breach we will notify affected parties as required by applicable law.

9. International users

The Service is operated from the United States. By using the Service from outside the U.S. you consent to your information being transferred to and processed in the U.S. We do not currently market the Service to residents of the EU/EEA and have not implemented GDPR-specific data subject mechanisms beyond those described above.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted with a revised “Last updated” date at the top of this page.

11. Contact

Voxaris AI, Inc.
Orlando, FL
privacy@voxaris.io