On this page
- What call data does an AI receptionist collect?
- What questions should you ask an AI receptionist vendor about data?
- How do you tell a good answer from a weak one?
- What are you responsible for as the business?
- What does Voksha do with call data?
- When is an AI receptionist the wrong fit for sensitive calls?
- How This Guide Was Sourced
- Frequently Asked Questions
- Conclusion
An AI receptionist usually keeps four things from every call: a recording, a transcript, a written summary and the caller's details (name, number, reason for calling). Who can see them, how long they stay, and whether they are used to train AI depends on the vendor's contract and privacy policy, not on the technology. Before you sign, ask six questions: retention, encryption, data location, training use, deletion and access controls. Then check the answers are written in the policy, not just said on a sales call.
This guide is for owners and office managers who handle customer calls and want to know where that data ends up. It explains what is collected, gives you the six questions to ask any vendor, shows how to read the answers, and sets out what Voksha's own privacy policy and terms say. It is not legal advice. Confirm your obligations with your own counsel.
Key Takeaways
- Every call creates data. Expect a recording, a transcript, a summary and the caller's details. Ask how long each one is kept, separately.
- The FTC's first rule is to keep less. "Don't collect personal information you don't need," and "Hold on to information only as long as you have a legitimate business need" (FTC, Start with Security, retrieved 2026-11-03). SOURCED
- "Used to improve our AI" needs a definition. Ask whether that means your raw recordings or anonymized, aggregated data, and whether you can opt out.
- Access is the most common weak spot. Ask who on the vendor's side and on your own team can open a recording, and how sharing links work.
- Compliance labels vary by plan. With some vendors, including Voksha, HIPAA, GDPR and CCPA commitments come with the top plan only. Check the plan, not the homepage.
What call data does an AI receptionist collect?
Most AI receptionists keep the full call, a text version and the caller's details. That makes summaries useful, and it is why the data needs protecting.
A typical call leaves:
- The recording: the audio of both sides.
- The transcript: the call as text.
- A summary: what the caller wanted and what happened.
- Caller details: phone number, name, and anything else they said, such as an address, a date of birth or a description of a problem.
- Booking and usage data: appointments made, call times and lengths.
The sensitive part is often what callers volunteer: symptoms, a legal dispute, a policy number. Plan for the data callers actually share, not the data you asked for.
What questions should you ask an AI receptionist vendor about data?
Ask these six, and ask for the answer in writing. A link to the exact line in the privacy policy or contract is the best answer you can get.
| Question | What to ask exactly | Why it matters |
|---|---|---|
| 1. Retention | How long do you keep recordings, transcripts and caller details? Separately for each. Can I shorten it? | The FTC advises keeping data "only as long as you have a legitimate business need" |
| 2. Encryption | How is data encrypted at rest and in transit? Which standard? | Stops stolen files or intercepted traffic from being readable |
| 3. Data location | Which countries are recordings stored and processed in? Which subprocessors handle them? | Some clients and some laws care where data sits |
| 4. Training use | Do you use my calls to train AI models? Raw or anonymized? Can I opt out? | Your callers' words should not end up in someone else's product |
| 5. Deletion | How do I delete a single call, and all data when I leave? How long until it is gone? | You need to honor a caller's deletion request |
| 6. Access controls | Who at your company can open a recording? Who on my team can? How do shared links work? | Most leaks are about who could see what |
Two more are worth asking if they apply. Breach notice: how quickly will you tell me if my data is exposed? Compliance by plan: which plan includes a BAA, if you handle health information?
The FTC's breach guide notes that "All states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification" of certain breaches, and advises businesses to check which laws apply to them (FTC, Data Breach Response: A Guide for Business, retrieved 2026-11-03).
How do you tell a good answer from a weak one?
A good answer is specific, written down and matches the policy. A weak answer is a reassurance.
| Topic | Weak answer | Strong answer |
|---|---|---|
| Retention | "We keep data as long as needed." | "Recordings 90 days by default, transcripts one year, and you can delete sooner." |
| Encryption | "Bank-level security." | "AES-256 at rest, TLS 1.3 in transit." |
| Location | "In the cloud." | "Named regions and named subprocessors." |
| Training | "We use data to improve the product." | "Only anonymized, aggregated data; here is the clause." |
| Deletion | "Just ask support." | "Email this address; here is the deadline; here is what is kept by law." |
| Access | "Only authorized staff." | "Role-based access; here is how sharing links and team roles work." |
If a sales rep and the written policy disagree, the policy wins.
What are you responsible for as the business?
The vendor protects the data it holds. You still decide what is collected, who on your team sees it and what callers are told.
Four things stay with you:
- Recording consent. Some states require every party on a call to consent to recording. Add a clear disclosure to your greeting. The call recording laws by state guide covers the rules.
- What the AI asks for. Don't have it collect card numbers, Social Security numbers or detailed medical history unless you truly need them. The FTC puts it simply: "No one can steal what you don't have" (FTC, Start with Security, retrieved 2026-11-03).
- Your own team's access. The FTC advises controls so employees have access "only on a 'need to know' basis" and to "Insist on complex and unique passwords" (same source). Remove people when they leave.
- Your contract. The FTC also advises: "Insist that appropriate security standards are part of your contracts" with service providers (same source). If you handle health information, a BAA is part of that. See the HIPAA-compliant AI receptionist guide.
The FTC's older guide sums it up: take stock, scale down, lock it, pitch it, plan ahead (FTC, Protecting Personal Information: A Guide for Business, retrieved 2026-11-03).
What does Voksha do with call data?
Here are our own answers to the six questions, taken from Voksha's published privacy policy, terms and approved security facts. Voksha is operated by TechnoKeen Inc.
| Question | What Voksha's policy and published facts say |
|---|---|
| What is collected | Call recordings, call transcripts, caller information (phone numbers, names and anything callers provide), appointment data and lead information (Privacy Policy, section 2.2) |
| Retention | Call recordings 90 days by default, configurable based on your plan. Call transcripts 1 year or until you request deletion. Account information while active and for 30 days after deletion. Earlier deletion on request to [email protected] (section 7) |
| Encryption | AES-256 at rest, TLS 1.3 in transit |
| Data location | North American data centers, with Canadian data storage. The policy also notes information may be processed in countries other than your own, including the United States (section 11) |
| Training use | The policy lists "Train and enhance our artificial intelligence models using anonymized and aggregated data" as a use (section 3). The terms say you keep ownership of recordings, transcripts and customer information, and grant a limited licence to provide the service and improve models "using anonymized and aggregated data" (Terms of Service, section 11) |
| Selling data | "We do not sell your personal information" (Privacy Policy, section 5) |
| Deletion on leaving | Data is kept for 30 days after termination, then permanently deleted unless the law requires otherwise (Terms, section 14) |
| Access | Role-based access controls (Privacy Policy, section 6). In the dashboard, anyone on an agent, including members, can see calls, transcripts and recordings (Reading your calls) |
| Breach notice | Breach notification within 72 hours |
| Compliance | SOC 2 compliant and ISO 27001 compliant on all plans. HIPAA compliant with BAAs, GDPR and CCPA compliant on the Enterprise plan only |
One practical point from the docs: the link inside an email or SMS notification opens your calls without a login, and the docs say to "treat the link as a password" and send it to a person, not a group chat (The call link, retrieved 2026-11-03). If someone needs calls regularly, add them as a team member instead, so you can remove them in one click.
Also note what the terms put on you: Voksha records and transcribes calls, and you are responsible for obtaining caller consent and configuring a recording disclosure (Terms, section 6).
When is an AI receptionist the wrong fit for sensitive calls?
Sometimes the answer is to keep a call type away from any vendor. Consider a person-only line if callers routinely share data you would not want stored in a third party's system, such as full card numbers, or if a client contract forbids storing their information with outside processors. For regulated health or legal calls, use a vendor and plan that will sign the agreements you need, or keep those calls with your own staff.
How This Guide Was Sourced
Written by the Voksha team. Voksha builds AI receptionists for small businesses. We are not a neutral reviewer, and one section of this guide describes our own data practices.
Sources and retrieval dates:
- FTC, Start with Security: A Guide for Business (August 2023). Retrieved 2026-11-03
- FTC, Protecting Personal Information: A Guide for Business (October 2016). Retrieved 2026-11-03
- FTC, Data Breach Response: A Guide for Business (August 2023). Retrieved 2026-11-03
- Voksha Privacy Policy, sections 2, 3, 5, 6, 7 and 11, and Voksha Terms of Service, sections 6, 11 and 14. Retrieved 2026-11-03
- Voksha docs: Reading your calls and The call link. Retrieved 2026-11-03
Voksha's encryption, data location, breach notification and compliance facts are its published product facts. Policy statements are quoted or paraphrased from the policy and terms, with nothing added. No Voksha call data is used in this guide.
This guide explains good practice and cites the regulator. It does not tell you that you are compliant with any law. Confirm with your own counsel.
Frequently Asked Questions
Do AI receptionists record every call?
Most do, because the recording and transcript produce your summary. Voksha records and transcribes calls. Ask any vendor whether recording can be turned off.
Does an AI receptionist use my calls to train its AI?
It depends on the vendor; search the privacy policy for "train" or "improve". Voksha's policy says it uses anonymized and aggregated data to train and improve its models.
How long are call recordings kept?
It varies by vendor. Voksha's policy keeps call recordings for 90 days by default, configurable based on your plan, and transcripts for 1 year or until you request deletion.
Can a caller ask me to delete their recording?
They can ask, and depending on where you and they are located, a law may require you to act. Make sure your vendor can delete a single call. With Voksha, you can request earlier deletion by emailing [email protected]. Confirm your obligations with your own counsel.
Is an AI receptionist HIPAA compliant?
Only if the vendor signs a Business Associate Agreement and the plan covers it. With Voksha, HIPAA compliance with BAAs comes with the Enterprise plan only, from $990/month.
Conclusion
Call data privacy comes down to six written answers: how long, how encrypted, where, used for what, deleted how, and seen by whom. Get them in writing, collect less, keep access tight, and add a recording disclosure to your greeting. For more questions to ask, see 10 questions to ask before buying an AI receptionist and 5 security features to look for.
This guide is general information, not legal advice. Confirm with your own counsel before you rely on it.
If you need HIPAA, GDPR or CCPA commitments for regulated calls, talk to sales about Enterprise.
