Privacy Policy

1. Who is responsible for your data

Phynxa plays two roles.

Phynxa as controller. For the information about you as a user of Phynxa (your account, how you use the dashboard, billing and support), Phynxa decides why and how the data is used.

Phynxa as processor. Phynxa’s customers are businesses that build AI voice agents and use them to talk to their own callers and contacts. For that call data, contacts, transcripts, knowledge-base content and connected-app data, the business is the controller and Phynxa processes it on the business’s instructions. If you are a caller or contact and want to see, correct or delete your data, please contact the business that called you or that you called. We will help them respond.

2. Information we collect

Account information

Your name, email address, phone number (not verified), password (stored only as a salted hash, never in readable form), workspace name, role and team membership, and, if you sign in with Google, your Google account email, name and profile identifier.

Customer Data you put into the platform

Agent prompts and settings, contact lists and campaigns, capture forms and the answers collected, uploaded documents and web pages used as a knowledge base, tools, webhooks and integration settings.

Call data

When a call or browser test runs, we process the audio, the transcript, the call’s date, duration, direction, phone numbers, outcome, AI-generated summary, intent and sentiment, tool calls made, and the cost of the call. Whether audio is recorded depends on how the customer configured the agent.

Credentials

API keys and tokens you give us for phone, AI-model, voice and speech providers, CRM and other connected apps. These are encrypted before they are stored.

Billing information

Plan, invoices and payment status. Payments are handled by our payment processor, PayPal; we do not receive or store your full card number.

Technical information

Log data such as IP address, browser type, pages requested, timestamps and error reports, used to run and secure the service.

Messages you send us

Anything you send through the contact form, email or WhatsApp, including your name, contact details and message.

3. How we use information

We use personal data to:

• create and secure your account, and verify your email address
• provide the platform: run agents, place and answer calls, produce transcripts and summaries, run campaigns and send data to the tools and integrations you connect
• measure usage and bill for it
• provide support and respond to messages
• detect, investigate and prevent fraud, abuse and security incidents
• keep the service reliable and improve it, using aggregated or de-identified information where possible
• meet legal obligations and enforce our Terms.

We do not sell personal data, and we do not use call content or connected-account data for advertising.

4. Google user data

You can connect Gmail, Google Calendar, Google Meet and Google Sheets to Phynxa by signing in with Google. You choose which of them to connect, and each asks Google for only the permissions its own actions need.

What we ask for and why

• Gmail (gmail.send): to send an email that you or your agent asked to send, from your own address. We cannot read, search or delete your email.
• Google Calendar (calendar.events): to create, list and cancel calendar events, for example to book an appointment a caller asked for or to check what is already booked.
• Google Meet (meetings.space.created and calendar.events): to create a Meet link, and to schedule a meeting with a Meet link and invite the attendees.
• Google Sheets (spreadsheets): to add a row to a spreadsheet, find rows by a word or number your agent looks up (such as a caller’s phone number), and update a row, for example to log a call or save a caller’s details. Google offers this permission for all of your spreadsheets, because no narrower one can open a sheet you already have; your agent works only in the spreadsheet you choose on the Integrations page, and we do not read, list or delete your other files.
• Your Google account email (userinfo.email): to show which account is connected.

What we do with it

We use Google data only to provide these user-facing features at your request. Calendar details and spreadsheet rows your agent reads may be shown to the AI model and spoken to the caller during the call, and may appear in that call’s transcript, which you control. Email you send, the event or meeting details you create, and the values added to your spreadsheet, are passed to Google to carry out the action and are not otherwise kept by us beyond the call record.

We store your Google access and refresh tokens encrypted, so the connection keeps working without asking you to sign in again. Disconnecting an account deletes the stored tokens.

Limited Use

Phynxa’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the user-facing features described above
• we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or sale with notice to you
• we do not use it for advertising, and we do not sell it
• we do not use it to develop, improve or train generalised AI or machine-learning models
• people at Phynxa do not read it unless you ask us to, it is necessary for security or abuse investigation, or the law requires it.

Stopping access

Disconnect a Google account from the Integrations page, or remove Phynxa at any time from your Google Account permissions page. If you delete your Phynxa account, the stored tokens are deleted too.

5. AI models and service providers

To run a voice agent we send the content of a conversation to the AI, speech and voice providers the agent is set to use. These can include OpenAI, Google (Gemini), Deepgram, ElevenLabs and Cartesia, and telephony providers such as Twilio, Telnyx, Plivo, Vonage and Exotel. Which ones apply depends on the agent’s configuration. They process the data to provide their service to us and are bound by their own terms and privacy commitments.

We also use providers for hosting and infrastructure, payments (PayPal) and transactional email. We give them only the data they need for their task.

6. When we share information

We share personal data:

• with the service providers described above, to run the platform
• with the tools you connect: CRMs, calendars, webhooks and other integrations send and receive data as you configure them, and those services have their own privacy policies
• with other members of your workspace, according to the roles and permissions set by your workspace administrators
• when the law requires it, or to respond to a valid request from authorities
• to protect the rights, safety and security of Phynxa, our customers or others
• in a merger, acquisition or sale of assets, in which case we will tell you and the new owner must honour this policy.

We do not sell personal data.

7. Cookies and similar technologies

Phynxa uses only the cookies it needs to work. They keep you signed in, hold a short-lived sign-in or email-verification step, and protect the “Sign in with Google” step against forgery. We do not use advertising or cross-site tracking cookies.

You can block cookies in your browser, but you will then be unable to sign in.

8. Security

We protect personal data with measures that include encrypting stored credentials and tokens, hashing passwords, separating each workspace’s data, role-based access, rate limiting and audit logging of sensitive actions.

No system is perfectly secure. If you suspect unauthorised access to your account, tell us at info@phynxa.com straight away.

9. Retention and deletion

We keep account information while your account is active. Call data and Customer Data are kept until the customer deletes them or closes the account, unless the customer’s configuration, their contract with us or the law sets a different period.

You can delete your account from the dashboard. When an account is deleted we remove or de-identify its personal data, except where we must keep some records for legal, tax, fraud-prevention or security reasons. Backups are overwritten on their normal cycle.

10. International transfers

Phynxa and its providers operate in several countries, so personal data may be processed outside the country where you live. Where we transfer personal data internationally, we do so using safeguards that the applicable law accepts, such as contractual commitments.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• correct it
• delete it
• restrict or object to some processing
• receive a copy in a portable format
• withdraw consent where we rely on it.

Many of these can be done in the dashboard. For the rest, or if you are a caller or contact of one of our customers, email info@phynxa.com. We may need to verify who you are first. You also have the right to complain to your data-protection authority.

12. Children

Phynxa is for businesses and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the product or the law changes. The current version is always at www.phynxa.com/privacy with its “Last updated” date. If a change is material we will tell active customers, for example by email or in the dashboard.

14. Contact us

Phynxa
Lake City Tower, Office 103
Cluster D, Al Thanyah Fifth
Jumeirah Lakes Towers (JLT)
Dubai, United Arab Emirates

Email: info@phynxa.com
Phone / WhatsApp: +971 54 574 7577