This Data Use Policy explains in detail how Scandeer LLC processes, stores, and protects data within the VOX Voice AI Platform. This document supplements our Privacy Policy and is intended for customers, enterprise users, and their data protection officers.

1. Data Categories and Processing Purposes

1.1 Tenant Account Data

Data: Name, email, hashed password, organization name, billing details
Purpose: Authentication, account management, billing
Legal basis: Contract performance
Retention: Duration of account + 90 days post-cancellation

1.2 Agent Configuration Data

Data: Agent names, prompts, voice settings, tool configurations, knowledge base documents
Purpose: Powering voice agent behavior
Legal basis: Contract performance
Retention: Until deleted by tenant or account closure

1.3 Conversation Data

Data: Transcripts (text), conversation metadata (timestamps, duration, latency, turn counts, token usage)
Purpose: Analytics, quality review, agent improvement
Legal basis: Legitimate interests / contract performance
Retention: 12 months default; configurable per tenant; deletable on demand

1.4 Audio Recordings

Data: Raw audio of voice conversations (opt-in only)
Purpose: Quality assurance, agent fine-tuning
Legal basis: Consent (tenant enables; tenant responsible for end-user consent)
Retention: 30 days default; configurable

1.5 Usage and Telemetry Data

Data: API request logs, latency metrics, error rates, feature usage events
Purpose: Platform reliability, performance monitoring, billing calculation
Legal basis: Legitimate interests
Retention: 90 days in raw form; aggregated metrics indefinitely

2. Data Storage and Location

Data Type	Storage System	Provider	Region
Tenant config, agents, API keys	PostgreSQL	Supabase	US East
Conversation transcripts	MongoDB	MongoDB Atlas	US East
Session state, queues	Redis	Redis Cloud	US Central
Knowledge base vectors	Qdrant	Self-hosted	OVHCloud EU/US
AI model inference	vLLM / STT / TTS	Self-hosted GPU	OVHCloud EU/US

3. Sub-processors

We engage the following sub-processors to operate the Service:

Supabase Inc. — PostgreSQL database hosting
MongoDB Inc. — MongoDB Atlas document database
Redis Ltd. — Redis Cloud cache and pub/sub
OVHCloud SAS — VPS and GPU compute infrastructure
Stripe Inc. — Payment processing
Cloudflare Inc. — DNS, CDN, and tunnel services

4. Data Security Measures

Encryption in transit: TLS 1.3 for all API and WebRTC connections
Encryption at rest: AES-256 for all stored data via provider-managed encryption
Authentication: Bcrypt (cost factor 12) for password hashing; optional OAuth SSO
Access control: Role-based access (owner / admin / agent / viewer) with principle of least privilege
Infrastructure: Private networking between services; no public database endpoints
Secrets management: Environment-variable injection via Coolify; no secrets in Git
Audit logging: All admin actions logged with timestamp and actor

5. AI Model Data Usage

Conversation data processed by our self-hosted AI models (Llama 3.3, Parakeet STT, CosyVoice2 TTS) never leaves our infrastructure. We do not send voice or transcript data to external AI API providers. During development, we use OpenAI gpt-4o-mini as a fallback LLM; in this case OpenAI's data processing terms apply.

6. Data Portability and Deletion

Tenants can export all agent configurations and conversation transcripts in JSON format from the Dashboard → Account → Export Data page
Individual conversation logs can be deleted from the Conversations view
Full account deletion (including all data) can be requested at privacy@scandeer.com and will be completed within 30 days
API keys are immediately invalidated on deletion and cannot be recovered

7. Breach Notification

In the event of a data breach affecting your tenant data, we will notify you by email within 72 hours of discovery, consistent with GDPR Article 33 obligations. Notification will include the nature of the breach, data affected, likely consequences, and measures taken.

8. GDPR and CCPA Compliance

For EU/EEA customers, we act as a data processor for conversation data and a data controller for account data. Data Processing Agreements (DPAs) are available upon request for Pro and Enterprise customers. For California residents, we honor all CCPA rights including the right to know, delete, and opt out of sale (we do not sell personal data).

9. Contact

Data protection inquiries:
Scandeer LLC — Data Protection
Email: privacy@scandeer.com
Website: scandeer.ai