Privacy Policy
1. Introduction and scope
This Privacy Policy explains how Voxgrid Inc (“sip.io”, “we”, “us” or “our”) handles personal data in connection with:
- our websites, including sip.io, our documentation, and our status page at status.sipio.dev (the “Websites”);
- the sip.io customer console, web app and webphone, the REST API at api.sipio.dev/v1, and the customer MCP server at mcp.sipio.dev/mcp; and
- our communications services: SIP trunking, phone numbers, bring-your-own-carrier (“BYOC”) trunks, programmable voice (IVR, queues, auto dialer), call recording, AI transcription and summaries, SMS/MMS and WhatsApp Business messaging, and related features (together, the “Services”).
This Policy applies to customers, prospective customers, resellers and their end users, authorised users of customer accounts, website visitors, status page subscribers, and people who contact us. It does not cover the privacy practices of our customers, who decide how they use the Services to communicate with their own contacts. If you have received a call or message from a business that uses sip.io, please read that business’s privacy notice and contact it directly.
2. Who we are and our role
sip.io is a service operated by Voxgrid Inc, a Delaware corporation with its principal place of business at 1646 W Snow Ave, Ste 169, Tampa, FL 33606, USA.
Controller. We are the controller of personal data we collect to run our business: account and billing data, identity verification (“KYC”) data, website and cookie data, support communications, marketing and sales data, and the operational and traffic data we need to route, bill, secure and comply with telecommunications obligations for the Services.
Processor. When customers use the Services to place and receive calls, send messages, record calls, store voicemail, generate transcripts or summaries, or upload contact lists and other content (“Customer Content”), we process that data on the customer’s behalf and on its instructions. In that case the customer is the controller (or, for a reseller’s sub-account, the reseller or its end customer may be), and our processing is governed by our Data Processing Addendum. Requests from individuals about Customer Content should be directed to the relevant customer; if we receive one, we will pass it on where we can identify the customer.
Some traffic data (for example call detail records, or “CDRs”) is processed in both roles: on the customer’s behalf to provide the Services, and as a controller for billing, fraud prevention, regulatory reporting and legal compliance.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account and contact data | Name, business name, email, phone number, job title, login credentials (stored hashed), authorised users, roles, API key metadata | You, your organisation, your reseller |
| Billing and wallet data | Billing address, tax ID, wallet top-ups, invoices, transaction history, payment method token and last four digits (full card details are held by our third-party payment processor, not by us) | You, our payment processor |
| Identity verification (KYC) data | Company registration documents, proof of address, government ID of a representative, end-user address and identity documents required to assign numbers in certain countries | You, your end users, verification partners |
| Usage data and CDRs | Calling and called numbers, caller ID, date, time, duration, route, trunk, cost, call outcome, message metadata (sender, recipient, timestamps, status, segments) | Generated by the Services |
| Call recordings, voicemail, transcripts and summaries | Audio of recorded calls, voicemail audio, AI-generated transcripts and summaries | Generated when a customer enables these features |
| Message content | SMS/MMS bodies and media, WhatsApp Business conversation content and media | Customers and the people they message |
| SIP signalling logs and network data | SIP headers and messages, IP addresses, ports, user agents, registration events, authentication attempts, media endpoints | Generated by the Services and our edge servers |
| Device and registration data | SIP device identifiers, device model and firmware strings, registration location (IP-based), webphone browser details | Your devices and browsers |
| Website and cookie data | IP address, browser type, pages viewed, referrer, cookie identifiers, bot-check signals (Cloudflare Turnstile) | Your browser; see our Cookie Policy |
| Support and communications | Support tickets, emails, chat messages, call notes, contact-form submissions, status page subscriptions (email address) | You |
| Sales and marketing data | Business contact details, communication preferences, event attendance, CRM notes | You, your organisation, public business sources |
| Emergency calling data | Registered emergency address associated with a number or device | You |
We do not ask for, and ask you not to send us, special category data (such as health data) except where you choose to include it in Customer Content, which is processed under the Data Processing Addendum.
4. How we use personal data and our lawful bases
Where the EU or UK General Data Protection Regulation (“GDPR”) applies, we rely on the following lawful bases under Article 6:
| Purpose | Lawful basis |
|---|---|
| Creating and administering accounts; providing, routing, connecting and terminating calls and messages; operating numbers, trunks and BYOC connections | Performance of a contract (Art. 6(1)(b)); for business customers’ staff, our legitimate interest in serving the customer (Art. 6(1)(f)) |
| Billing, wallet management, invoicing, tax and accounting | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Identity and address verification for numbers, and know-your-customer checks | Legal obligation (Art. 6(1)(c)) where required by telecoms rules; otherwise legitimate interests in preventing misuse (Art. 6(1)(f)) |
| Fraud, toll-fraud, robocall and abuse prevention; network security; SIP brute-force detection and blocking | Legitimate interests (Art. 6(1)(f)); legal obligation where required (Art. 6(1)(c)) |
| Emergency calling and location data for emergency services | Legal obligation (Art. 6(1)(c)); vital interests (Art. 6(1)(d)) |
| Call recording, transcription and summaries | Processed as a processor on the customer’s instructions; the customer is responsible for its own lawful basis |
| Responding to support requests and service communications, including status updates | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Improving and developing the Services, measuring performance and capacity | Legitimate interests (Art. 6(1)(f)), using aggregated or de-identified data where practical |
| Website analytics and non-essential cookies | Consent (Art. 6(1)(a)) |
| Direct marketing to business contacts | Legitimate interests (Art. 6(1)(f)), or consent where required by ePrivacy rules; you can opt out at any time |
| Responding to lawful requests from authorities, traceback requests, and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
We do not use Customer Content (recordings, transcripts, message content) to train general-purpose AI models, and we do not permit our AI subprocessor to do so. See AI Services Terms.
We do not make decisions that produce legal or similarly significant effects about individuals based solely on automated processing. We do use automated rules to detect fraud and abuse (for example, temporarily blocking an IP address after repeated failed SIP authentication attempts or pausing traffic that matches toll-fraud patterns). You can contact us to have such a decision reviewed by a person.
5. How we share personal data
We do not sell personal data. We share it only as follows:
- Subprocessors and service providers that host, operate or support the Services, such as cloud infrastructure, email delivery, CRM, payments and AI processing. The current list is at Subprocessors.
- Carriers, number providers and interconnect partners, including our wholesale number and termination provider and upstream carriers, to the extent needed to route and complete calls and messages, port numbers, and register numbers or brands with regulators and industry bodies (for example 10DLC registries or number assignment authorities).
- Messaging platforms, such as Meta for WhatsApp Business, when a customer uses those channels.
- Emergency services, who receive caller location and callback information when an emergency call is placed.
- Resellers. If your account is provided through a reseller or white-label partner, that partner can see account, usage and billing data for your sub-account.
- Authorities and legal process. Law enforcement, regulators, courts and other public authorities where required by law or valid legal process, or to protect life or safety. Our approach is described in our Law Enforcement Guide.
- Industry traceback and anti-fraud bodies, such as the USTelecom Industry Traceback Group, when investigating illegal robocalls or fraud. See Report Abuse.
- Professional advisers, such as lawyers, auditors and insurers, under confidentiality obligations.
- Corporate transactions. A buyer, successor or investor in connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to confidentiality and to this Policy continuing to apply to the transferred data.
- With your direction or consent, for example when you connect a third-party integration through the API or MCP server.
6. International transfers
We operate infrastructure in several regions. Our cloud services run on Cloudflare’s global network with data stored in the United States and the European Union, and our session border controllers and media servers run on Oracle Cloud Infrastructure (OCI), Google Cloud (GCP), Amazon Web Services (AWS) and regional colocation partners, in the United States (Ashburn), the European Union (Frankfurt), Israel (Jerusalem/Tel Aviv) and Asia-Pacific. The providers are listed on our Subprocessors page. Calls and messages are, by their nature, carried across borders to reach their destination.
When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use appropriate safeguards, including:
- the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914);
- for UK data, the UK International Data Transfer Addendum to the EU SCCs, or the UK International Data Transfer Agreement;
- for Swiss data, the SCCs with the amendments required by the Swiss Federal Act on Data Protection;
- reliance on adequacy decisions where available, including the European Commission’s adequacy decision for Israel and, where a recipient is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
Where Israeli law applies to transfers out of Israel, we transfer data in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
You can request a copy of the relevant safeguards by contacting privacy@sip.io.
7. Retention
We keep personal data only as long as we need it for the purposes described above, unless a longer period is required by law. Customers can configure some retention periods themselves.
| Data | Retention |
|---|---|
| Call detail records (CDRs) and message metadata | Held in our primary database for 90 days (the “hot window”), then moved to an archive and retained for as long as required for billing, tax, regulatory and legal purposes, after which they are deleted or anonymised |
| Call recordings and voicemail | 30 days by default; each account can configure a shorter or longer period, or delete recordings at any time |
| AI transcripts and summaries | Retained with the related recording unless the customer configures or deletes them separately |
| Message content (SMS/MMS, WhatsApp) | 365 days by default; configurable per account |
| SIP signalling logs and IP data | Up to 90 days |
| Security logs (authentication attempts, IP bans) | As long as needed to detect and prevent attacks, normally no longer than 90 days |
| Account and billing data | For the life of the account, then for the period required by tax, accounting and telecommunications laws in the relevant jurisdiction |
| KYC documents | For the life of the number assignment or account, then as required by the relevant number regulator or law |
| Support communications | For the life of the account and a reasonable period afterwards to handle follow-up and claims |
| Website analytics data | As set out in our Cookie Policy |
| Marketing data | Until you opt out or the data is no longer relevant |
Backups are overwritten on a rolling schedule; deleted data may remain in backups until they expire.
8. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, per-account isolation, access controls, monitoring and incident response. Details are in our Security Overview. No system is completely secure, and customers are responsible for protecting their credentials, devices and SIP endpoints (see Toll Fraud).
9. Your rights
9.1 EU, EEA and UK
Subject to conditions and exceptions in law, you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erase your data;
- restrict processing;
- object to processing based on legitimate interests, and object at any time to direct marketing;
- data portability for data you provided to us under contract or consent;
- withdraw consent at any time, without affecting processing that took place before withdrawal; and
- not be subject to solely automated decisions with legal or similarly significant effects.
We will respond within one month, which may be extended by two further months for complex requests. We may need to verify your identity before acting.
9.2 California and other US states
If the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) or a similar US state law applies to you:
- Categories collected (past 12 months): identifiers (name, email, phone number, IP address, account ID); customer records (billing address, payment token); commercial information (wallet top-ups, purchases); internet or network activity (website use, SIP logs, API usage); geolocation (approximate location from IP; registered emergency address); audio and electronic information (call recordings, voicemail) where a customer enables them; professional information (business contact details); and inferences limited to fraud and risk scoring. Sources, purposes and recipients are described in sections 3 to 5.
- No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.
- Sensitive personal information. We collect account login credentials, government identification numbers (for KYC), and the content of communications processed on customers’ behalf. We use sensitive personal information only for purposes permitted by the CCPA regulations (such as providing the Services, security, fraud prevention and legal compliance) and not to infer characteristics about you.
- Your rights: to know what we collect, use and disclose; to access; to delete; to correct; to opt out of sale or sharing (which we do not do); to limit use of sensitive personal information (which we already limit); and not to receive discriminatory treatment for exercising your rights.
- Authorised agents. You may use an authorised agent to submit a request. We will ask the agent for signed permission and may ask you to verify your identity directly.
- Verification. We verify requests by matching information you provide against our records, and for account holders, by requiring you to sign in or confirm from your account email.
- Non-discrimination. We will not deny service, charge different prices or provide a different quality of service because you exercised your rights.
9.3 Israel
Where the Israeli Privacy Protection Law, 5741-1981 (as amended, including by Amendment 13) and its regulations apply, you have the right to review personal data about you held in a database, and to request that it be corrected or deleted if it is inaccurate, incomplete, unclear or outdated. We maintain our databases in accordance with the Privacy Protection (Data Security) Regulations, 5777-2017. Where the law requires a database to be registered with, or notified to, the Israeli Privacy Protection Authority, we register or notify it, and we provide the information required by section 11 of the law when we collect data directly from you, including whether you are legally required to provide it, the purposes of use, and to whom it may be transferred. You may write to privacy@sip.io to exercise these rights.
9.4 How to exercise your rights
Email privacy@sip.io or use the privacy settings in your account. If your request concerns Customer Content (for example a recording of a call with a business), we will refer it to the relevant customer and support them in responding, as described in the Data Processing Addendum.
10. Children
The Services and Websites are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children as a controller. If you believe a child has provided us personal data, contact privacy@sip.io and we will delete it.
11. Representatives and contact
- Privacy contact / Data Protection Officer: privacy@sip.io
- EU representative (GDPR Art. 27): where the law requires one, details are available on request from privacy@sip.io
- UK representative (UK GDPR Art. 27): where the law requires one, details are available on request from privacy@sip.io
- Postal address: Voxgrid Inc, 1646 W Snow Ave, Ste 169, Tampa, FL 33606, USA
12. Complaints
If you have a concern, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA member state where you live, work or where the alleged infringement occurred; in the UK, with the Information Commissioner’s Office; in Switzerland, with the Federal Data Protection and Information Commissioner; and in Israel, with the Privacy Protection Authority. California residents may contact the California Privacy Protection Agency.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version on this page with a new version date, and record material changes in our Legal Changelog. Where changes are material, we will notify account holders by email or in the console in advance where practicable.