Terms of Service

1. Who we are and how these terms apply

Vora is operated by Stefan Stojanović, an individual based in the Republic of Serbia.

In these terms, “Vora”, “we”, “us” and “our” mean Stefan Stojanović, and “you” means the person or organization that accepts these terms. You can reach us at support@voicevora.com.

How these terms apply

These terms are a binding agreement between you and us. They apply when you create an account, accept them in the Service, place an order or otherwise use the Service. If you accept them for a company or other organization, you confirm that you have authority to bind it, and “you” then means that organization. Accounts, workspaces and agencies explains how the agreement is formed.

These terms include our acceptable use rules, our data processing terms and our refund policy. Our Privacy Policy explains how we handle personal data for which we are the controller. If you and we sign a separate written agreement, it prevails over these terms where the two conflict (see General terms).

The Vora Partner Program is governed by its own Partner Program terms, not by these terms.

2. Definitions

In these terms:

• Service means the Vora platform, including the dashboard at dashboard.voicevora.com and the related websites, applications, application programming interfaces (APIs), connectors, Platform Numbers and support that we provide.
• Workspace means an organization account in the Service, including any client workspace or sub-account created under it.
• User means an individual you allow to access your Workspace, in a role such as owner, admin, member or viewer.
• Agency means a customer that uses the Service to provide services to its own clients. Client means a business that an Agency serves through the Service.
• End User means a person who interacts with your agents or Workspace, or whose personal data is processed in your Workspace, such as a caller, chat user, contact, lead, or recipient of a call, text message or email.
• Customer Data means all data, including personal data, that you or your Users submit to the Service, that the Service collects or creates for you (for example from calls, chats, messages, emails, Connected Accounts and lead searches), and the Output produced for you. Examples are agent instructions, knowledge base documents, call audio, recordings, transcripts, summaries, caller profiles, chat and text messages, emails, CRM records, leads, reviews and voice samples. Customer Data does not include Account Data or Usage Data.
• Account Data means information about you and your Users that we use to run our relationship with you, such as names, email addresses, sign-in and Workspace membership details, billing and support records, security and audit logs, and the identity and business documents you give us for carrier and regulatory checks on phone numbers and text messaging. We handle Account Data as a controller, as our Privacy Policy explains.
• Output means text, audio, summaries, labels, drafts and other material that AI features of the Service generate for you.
• Connected Account means an account with a third party, such as Google, Microsoft, Meta, a CRM, a calendar or a telephony carrier, that you connect to the Service.
• Third-Party Service means any product or service that we do not provide and that you choose to use with the Service, such as Connected Accounts, your own carrier, AI provider or payment accounts, messaging platforms and AI assistants. Services that our sub-processors, listed under Service providers in our Privacy Policy, provide to us for the Service, including the carriers that provide Platform Numbers and send texts for you, are not Third-Party Services. An account you connect with the same company, such as your own Google, Telnyx or ChatGPT account, still is.
• Platform Number means a phone number that we obtain from a carrier and make available to you.
• Credits means the units in which the Service measures and charges usage.
• Fees means the amounts payable for subscriptions, Credits, phone numbers and other paid items.
• Usage Data means information about how the Service is used, such as feature use, counts of calls and messages, and performance and error data. Usage Data does not include the content of Customer Data, such as call audio, transcripts, messages or documents.

“Personal data”, “controller”, “processor” and “sub-processor” have the meanings given in the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (“Službeni glasnik RS”, No. 87/2018). “Including” means “including without limitation”.

3. The Service and early access

Vora is the operating system for AI agencies. Depending on your plan and on what is enabled for your Workspace, the Service lets you:

• build AI voice agents that answer and make phone and web calls, and chatbots for websites;
• manage contacts, deals, tasks, calendars and bookings in a built-in CRM;
• handle conversations in a unified inbox;
• automate work with workflows and connectors;
• give your agents knowledge bases built from your documents and websites;
• search for business leads, draft emails and run email outreach;
• import Google Business Profile reviews and reply to them;
• see analytics and insights; and
• use Vora from AI assistants such as ChatGPT and Claude, where available.

Early access

The Service is in early access. Access may be limited, for example by invitation. Many features are still in alpha or testing, and some may not yet be available to your Workspace, including text messages, phone numbers and booking, website chat and text messages in the inbox, sending email from Vora, and client workspaces, white-label and rebilling. Where these terms describe a feature that is not available to your Workspace, the terms for that feature apply once it becomes available to you.

We may add, change or remove features. Early-access features may be incomplete, may change and may be withdrawn. We aim to give reasonable notice before we remove a material feature you pay for, unless we must act sooner for security, legal or carrier reasons.

Availability and support

We use commercially reasonable efforts to keep the Service available and to fix problems. During early access we do not offer a service level agreement or an uptime commitment. The Service may be interrupted for maintenance, updates or incidents, or by problems with Third-Party Services, carriers or AI providers. We provide support by email at support@voicevora.com.

A tool for businesses

Vora is a business tool. Its agents speak for the business that configures them. Vora does not offer a general-purpose AI assistant to the public, and you must not use the Service to offer one, for example on WhatsApp.

The Service is intended for customer communication, sales, booking, support and related business tasks. It is not designed or intended for any high-risk use under the EU Artificial Intelligence Act, and you must not use it for one (see Acceptable use).

4. Accounts, workspaces and agencies

Who can use Vora

The Service is for business use only. To use it, you must be at least 18 years old and able to enter into a binding contract. Do not use the Service as a consumer for personal, family or household purposes.

Your account

• Give accurate information and keep it up to date.
• Keep your sign-in details and API keys secure, and do not share them.
• You are responsible for everything done through your account and the Workspaces you own, including by your Users and by tools or AI assistants you connect.
• Tell us straight away at support@voicevora.com if you think someone has accessed your account without permission.

Workspaces and Users

Owners and admins decide who can access a Workspace and in which role. Give each User only the access they need, and make sure your Users follow these terms.

If you join a Workspace that someone else owns, for example as a member of an Agency’s team or of a Client’s staff, you use that Workspace on behalf of its owner. The owner is our customer for that Workspace and is responsible for its Fees, its Customer Data and its Users. You must follow these terms, including our acceptable use rules, when you use it, but joining does not make you, or the organization you work for, our customer for that Workspace or responsible for its Fees. A request to delete your own account covers your sign-in, your other Account Data and the data from any accounts you connected yourself, which we delete as described in Customer Data and data processing. It does not cover the rest of that Workspace’s Customer Data, which we handle on the owner’s instructions.

Agencies and Clients

If you are an Agency:

• you must have your Clients’ authority for everything you do for them in the Service, including connecting their accounts, phone numbers and Business Profiles and contacting their customers;
• you are responsible for your Clients’ use of the Service, including use by Client staff you give access to, as if it were your own, and you must bind each Client that uses the Service to rules at least as strict as our acceptable use rules;
• your agreement with each Client must protect personal data at least as well as these terms and must allow you to engage us as a sub-processor (see Customer Data and data processing); and
• if white-label or rebilling features are enabled for you, you remain responsible to your Clients for your own services, prices and support, you must not describe the Service in a misleading way, and you must not give your Clients any warranty, service level or other commitment on our behalf. We are not a party to your agreements with Clients.

We may contact a Client directly where the law, a carrier or a platform requires it, or to prevent harm.

How the contract is formed

You enter into this agreement when you create an account, when you accept these terms where the Service asks you to, or when you first place an order or otherwise use the Service, whichever comes first. You buy paid plans and Credits through Paddle’s checkout, where you can review your order and correct mistakes before you pay. An order becomes part of this agreement once your payment is confirmed. These terms are available in English. You can save or print this page. We have not signed up to any code of conduct.

5. Acceptable use

You must not use the Service, or let anyone else use it, to do any of the things listed below. These rules apply to your agents, calls, messages, emails, content and workflows, and to anything you connect.

Illegal, harmful or deceptive use

• break any law or regulation, or help anyone else to do so;
• defraud, scam or phish anyone, or collect information under false pretenses;
• impersonate a person, business, government body or emergency service, or misrepresent who is calling, texting or emailing;
• display a caller ID or sender identity you are not authorized to use;
• harass, threaten, intimidate or abuse anyone, or promote violence, hatred or discrimination;
• create, request or share sexual content involving minors, which we will report to the relevant authorities, or other sexually explicit content;
• spread false or misleading information about elections or voting;
• infringe intellectual property, privacy or publicity rights, including by cloning a voice without the speaker’s explicit, informed permission;
• carry out surveillance, stalking or covert recording;
• decide anyone’s eligibility for housing, employment, insurance, credit or similar benefits using data obtained from Google, Microsoft or Meta, or use that data to build profiles of people without their consent;
• send data obtained from Google to advertising platforms, data brokers or information resellers, or use it for advertising, whether through workflows, webhooks, connectors, the API or otherwise, or use data obtained from Google in any other way that the Google API Services User Data Policy does not allow;
• use the Service for any practice prohibited by Article 5 of the EU Artificial Intelligence Act, or for any high-risk use listed in Annex III of that Act, such as screening, filtering or evaluating job applicants or workers, assessing people’s creditworthiness, pricing life or health insurance, or recognizing people’s emotions from their voice or other biometric data;
• present an agent as a licensed professional, or use agents to make medical, legal or financial decisions about people without review by a qualified person; or
• run emergency, life-support, safety or other systems where a failure could cause death, injury or serious damage.

Spam and unlawful marketing

• make calls or send text messages or emails that break the law, carrier rules or platform rules;
• send spam or unsolicited commercial or bulk email through a connected Google account (bulk commercial email through a connected Google account is allowed only to recipients who consented to receive it);
• use several connected Google accounts, or spread sending across them, to get around Gmail’s sending limits, spam filters or other Google abuse or safety restrictions;
• email addresses that were harvested by automated means or generated by automated means that combine names, letters or numbers into numerous permutations, or text numbers taken from opt-in lists that were bought, rented or shared;
• sell, rent, transfer or share the email address or phone number of anyone who has opted out, or use it for anything other than honoring the opt-out;
• share End Users’ phone numbers, text messages, or text messaging opt-in data and consent with anyone for that party’s own marketing or promotional purposes, whether through workflows, webhooks, connectors, Zapier, Make, the API or otherwise, or sell, rent, transfer or share text messaging opt-in data or consent with anyone other than service providers that process it only for you. If you are an Agency, this does not stop you from giving a Client the data of its own End Users;
• send text messages with content that carriers prohibit or restrict, such as sex, hate, alcohol, firearms or tobacco content, unless you meet the carriers’ conditions; or
• hide or falsify who sent a message, or use misleading headers or subject lines.

Sensitive data

Unless we have agreed otherwise in a signed written agreement, do not use the Service to collect, request or store:

• full payment card numbers or card security codes;
• protected health information covered by the US HIPAA rules, or other health data;
• government identification numbers, such as social security, national identity or passport numbers; or
• passwords, one-time codes or other credentials that belong to End Users.

If an End User volunteers such information without being asked, for example during a call, you do not breach this rule, but you must handle it lawfully as described in Your data and your legal responsibilities.

This does not stop you from entering credentials for your own accounts in the Service’s settings to connect a provider. Files uploaded through Vora forms are stored at web addresses that anyone with the link can open, so do not use forms to collect sensitive documents.

Children

The Service is not directed to children. Do not use it to target children, or to collect personal data from children under 16, or under a higher age where local law sets one, without any consent the law requires from a parent or guardian.

Security and fair use

• access another customer’s data, or try to get around access controls, usage limits or security measures;
• probe, scan or test the Service for vulnerabilities without our written permission;
• introduce malware, overload the Service, or disrupt it or any network it uses;
• reverse engineer, decompile or copy the Service, except where the law allows this despite this restriction; or
• resell or sublicense access to the Service, except as an Agency through the features we provide or under a written agreement with us.

Enforcement and reports

We may investigate suspected breaches, remove or disable content, pause agents, numbers, mailboxes or campaigns, and suspend or end accounts (see Suspension and termination). We may report unlawful activity to the authorities and cooperate with carriers and platforms. To report abuse, a security issue, or unwanted calls, texts or emails sent through Vora, email support@voicevora.com.

6. Your data and your legal responsibilities

You decide what your agents say, whom you contact and what data you put into the Service. You are responsible for those choices and for complying with every law that applies to you and to the people you contact, including data protection, consumer protection, telemarketing, messaging, email marketing and call recording laws.

Your role under data protection law

For Customer Data, you are the controller, or a processor acting for your Client, and we are your processor or sub-processor (see Customer Data and data processing). You must:

• have a lawful basis, and any consent that is needed, for all the processing you ask us to carry out;
• give End Users the information the law requires, in a privacy notice on your own website and at the right time, including how you use the Service, for example AI agents, call recording, caller memory, transcripts and copying call details into your CRM;
• respond to End Users who exercise their rights, using the tools in the Service and our help;
• carry out data protection impact assessments where the law requires them; and
• process special categories of personal data only where the law allows it and within our acceptable use rules.

What the Service does automatically

After every call, the Service:

• creates an AI summary and labels the call’s sentiment and outcome;
• extracts facts about the caller and saves them to a caller profile, whatever the agent’s memory setting; facts from chatbot conversations can be saved too. Agents use the profile to personalize later conversations with the same person only when the agent’s memory setting is on, which it is by default, and the profile is marked as consented. You can set that mark in the Service, and the Service’s AI sets it when it detects that the caller explicitly agreed to be remembered (see How Vora uses AI). If a caller asks not to be remembered, the AI may note this on the profile, which may stop later use of the profile, but facts from that call and from later calls may still be saved;
• creates a CRM contact for a caller it does not recognize; and
• by default, copies the full call transcript to the matching CRM contact.

You cannot currently turn off the summaries, the fact extraction or the creation of CRM contacts for callers the Service does not recognize. Tell End Users about these features where the law requires.

Sensitive information people volunteer

Callers and other End Users may mention their health or other special categories of personal data even when you do not ask for them. The Service then transcribes and summarizes what they say, may save facts from it to a caller profile and, by default, copies the transcript to your CRM. Where this can happen in your use, you must have a condition for processing that data under Article 9 of the GDPR or Article 17 of the Serbian Law on Personal Data Protection, carry out any data protection impact assessment the law requires, and delete what you do not need.

Data from other sources

You may obtain personal data other than from the person it is about, for example through lead search, enrichment, imports, contacts created from your sent email, or Meta lead forms. When you do, you must:

• give that person the information the law requires. Under the GDPR, you must do so within a reasonable period and at the latest within one month (30 days under the Serbian Law on Personal Data Protection), or by your first communication with the person, or the first disclosure of the data, if that is earlier; and
• check that you may lawfully contact each lead.

Lead search results come from public business listings and, where enabled, from enrichment providers. They may be incomplete or wrong.

Consent records and senders

• Obtain, and keep records of, the consent you rely on for calls, texts and emails, such as when and how it was given, the wording shown, the number or address, and the program it covers. Keep these records for at least as long as claims about those calls, texts or emails could be brought, which for TCPA claims in the US is generally four years.
• Consent belongs to the business and program it was given for. It cannot be transferred or assigned, so do not share or reuse it across Workspaces, Clients or other senders.
• When you attest a consent basis in the Service, for example for bulk calls, you confirm that it is true. We rely on your attestation and do not verify it.
• Where reminders and review requests are enabled for your Workspace, Vora sends reminders by text, email or WhatsApp, and review requests by text or WhatsApp, only to people whose caller profile is marked as consented. You can set that mark in the Service, and the Service’s AI sets it when it detects that a caller explicitly agreed to be remembered. That mark is not consent to receive texts, emails or WhatsApp messages, and Vora does not check that you hold such consent. Turn on reminders and review requests only for people from whom you hold the consent the law requires.

Your own policies and registrations

Carriers, messaging platforms and regulators look at the business that sends messages, not at the software it uses, and Vora’s policies do not replace yours. You must:

• publish your own privacy policy and terms on your own website, including the disclosures your calling and texting programs need;
• collect opt-in consent in your own name, respond to requests for help, and honor STOP requests and other opt-outs (Vora does not currently reply to HELP or STOP messages for you; see Text message programs);
• where carriers require a texting program to be registered, for example A2P 10DLC brand and campaign registration or toll-free verification in the United States, have it registered under the details of the business that sends the texts, your own or your Client’s, such as its legal name, address, website and business registration number, with its own opt-in flow, sample messages, privacy policy and terms. Texts sent through Vora use our carrier accounts, and the Service does not yet offer a way to register a program, so contact us at support@voicevora.com before you text people in the United States, cooperate with carrier know-your-customer checks, and do not text people in the United States through Vora until we confirm that your program is registered. Until then, do not turn on automatic texts, such as follow-up and missed-call texts, for agents that may text people in the United States. We may also block or stop texts for your Workspace;
• follow the rules for WhatsApp, Messenger and Instagram in Calls, phone numbers and messaging; and
• give us accurate information and documents that we reasonably ask for to meet these requirements or to respond to a complaint.

Meta lead forms

If you connect Meta Lead Ads, you use your own Meta app, and you are responsible for the notices, privacy policy link and consents on your lead forms. You may not sell Lead Generation Data under any circumstances. If you receive lead data for an advertiser, such as a Client, use and share it only for that advertiser, and do not combine it with data from any other advertiser. You must also follow Meta’s Lead Ads Terms. If you use lead data for anything other than the purpose described on the lead form, for example to add the person to email sequences or to have an agent call or text them, you must first get any consent that is needed.

What your agents say

You are responsible for the instructions, knowledge, prices, offers and other information you give your agents, and for what they say on your behalf. Check them before you go live and keep monitoring them.

Your confirmations

You confirm that you have the rights, permissions, consents and lawful bases needed for your Customer Data, for the instructions you give us, and for the calls, messages and emails you make or send through the Service.

7. AI features and outputs

How Vora uses AI

Vora uses AI models from third-party providers to run agents and chatbots, transcribe and voice calls, summarize conversations, label sentiment and outcomes from the text of conversations, extract facts about callers, classify emails, draft emails and review replies, search knowledge bases and help you build agents. These providers are listed under Service providers in our Privacy Policy. They process the content we send them in order to return results to us. If you connect your own AI provider account or model endpoint, that provider’s terms also apply. See How Vora uses AI for more detail.

Output

• AI can be wrong. Output may be inaccurate, incomplete, inappropriate or out of date, and agents may misunderstand people, give wrong answers or make booking mistakes.
• Review Output before you rely on it, publish it or send it. Do not use it as the only basis for decisions that have legal or similarly significant effects on people.
• As between you and us, you own the Output generated for you, to the extent the law allows. Output may not be unique, and others may receive similar Output.
• You are responsible for the Output you use, publish or send.
• Do not use the Service or its Output to develop or train AI models that compete with the Service or with our AI providers, and follow the usage policies of the AI providers listed under Service providers that apply to the features you use.

No training on your data

Vora does not use Google user data, Microsoft data, or Meta and WhatsApp data to create, train or improve AI or machine learning models, including generalized, foundational and fine-tuned models, does not sell that data or transfer it to anyone for that purpose, and does not store that data in conjunction with such models. The same applies to all other Customer Data, with one exception: when you choose to create a voice clone, our provider ElevenLabs makes a voice model from the voice samples you upload (see “Voice cloning” below).

Telling people they are talking to AI

Vora’s default agent instructions, which Vora adds when it builds an agent or chatbot for you, tell the agent to answer honestly if someone asks whether it is an AI, and never to claim to be human. Agents you start from scratch, and agents whose instructions you write, supply or edit yourself, for example through the API, follow only the instructions you give them and may not include this rule. Agents do not always say on their own that they are an AI. You must:

• make sure your agents clearly identify themselves as AI at the start of each interaction, for example in the agent’s greeting, wherever the law requires people to be told that they are dealing with AI, such as under Article 50 of the EU Artificial Intelligence Act or US state law;
• make sure every agent’s instructions tell it to answer honestly that it is an AI when asked and never to claim to be human, including instructions you write, supply or edit yourself, and never configure an agent to deny being an AI or to claim to be human;
• announce call recording and obtain consent where the law requires (see Calls, phone numbers and messaging); and
• tell people when a cloned or synthetic voice imitates a real person.

Voice cloning

You may clone only your own voice, or the voice of a person who has given you explicit, informed permission, in writing where the law requires it (for example under biometric privacy laws such as Illinois’s), to upload the recordings and to create and use an AI clone of their voice in your Workspace. Before you upload samples, you must confirm this in the Service, and the Service records your confirmation. Our provider ElevenLabs then creates the voice model at your direction. Do not use a cloned voice to deceive anyone. If the speaker withdraws permission, stop using the clone and ask us at support@voicevora.com to delete it.

8. Calls, phone numbers and messaging

Vora does not support emergency calls. Do not use Vora agents, Platform Numbers or the Service to make or route calls to 911, 112, 999 or any other emergency number. Calls to emergency numbers may fail, and the Service does not provide caller location to emergency services. Make sure your callers and staff have another way to reach emergency services, and set up your agents to direct anyone with an emergency to them.

Phone numbers and some calling and messaging features may not yet be available to your Workspace (see The Service and early access).

Platform Numbers

• We obtain Platform Numbers from our carriers, currently Multitel and Telnyx, and we are the carriers’ customer of record for them.
• Platform Numbers are licensed to you for use with the Service. You do not own them, and you may not resell or transfer them.
• Our carriers’ terms and policies apply to your use of Platform Numbers and pass through to you. You must comply with them and with any rules a carrier or regulator sets for your traffic. We will share the relevant carrier terms with you on request.
• Some countries and carriers require identity, address or business documents before a number can be assigned or kept. You must provide accurate documents when asked, and we may share them with the carrier for that purpose.
• We may suspend, replace or reclaim a Platform Number if a carrier or regulator requires it, if the number is used in breach of these terms, if Fees are unpaid, or after your account ends.
• Moving (porting) a Platform Number to another provider depends on the carrier and on the law. Where the law gives you a right to port a number, we will cooperate with a valid porting request, as long as the Fees for that number are paid. Otherwise, porting is not guaranteed.

Your own carrier account

If you connect your own account with a carrier such as Twilio, Telnyx or Plivo, you are that carrier’s customer of record. Your agreement with the carrier governs those numbers and charges, and you are responsible for any registrations with it.

Outbound calls

Calls made with AI-generated voices are calls made with an “artificial or prerecorded voice” under the US Telephone Consumer Protection Act (TCPA), as the Federal Communications Commission confirmed in Declaratory Ruling FCC 24-17. For every outbound call you make through the Service, you must:

• have the called person’s prior express consent, and their prior express written consent for telemarketing or advertising calls, as 47 CFR 64.1200 requires, including the disclosure that consent is not a condition of purchase, together with any written agreement the US Telemarketing Sales Rule requires for prerecorded messages;
• at the start of the call, clearly identify the business responsible for it, and give a telephone number at which that business can be reached;
• for telemarketing calls, and for other calls where 47 CFR 64.1200(b)(3) requires it, offer an automated voice or key-press opt-out within two seconds of that identification that, when used, immediately adds the number to your do-not-call list and ends the call;
• honor requests to stop calling made by any reasonable means, without insisting on a particular method, within the time the law allows and, in the US, within 10 business days at the latest;
• check numbers against the do-not-call registers that apply, such as the US National Do Not Call Registry, state do-not-call lists and the UK Telephone Preference Service, using your own access to each register (for the US National Do Not Call Registry, your own subscription, with any fees paid, as the US Telemarketing Sales Rule requires), and keep your own internal do-not-call list;
• keep a written do-not-call policy, train the people who run your calling, and honor each do-not-call request for as long as the law requires;
• for telemarketing, transmit caller ID information that includes a number the called person can call during regular business hours to ask not to be called;
• before calling or texting on consent you collected earlier, check whether the number has been reassigned, for example with the FCC Reassigned Numbers Database;
• register, and hold any license or bond, where state telemarketing laws require it;
• call only at times the law permits where the recipient is, and follow national and state rules on call frequency and content; and
• outside the US, follow local rules for automated calls. In the EU and the UK, marketing calls made with automated calling systems generally need the person’s prior consent.

Vora does not check or ensure that your agents’ greetings include this identification, an opt-out or an AI disclosure. Set up each agent’s greeting, opt-out handling and instructions yourself, and make sure that every request not to be called, whether it is made to an agent or in any other way, is added to your do-not-contact list in Vora, where it is available to your Workspace, or to your own do-not-call list. If you cannot meet these requirements with the Service, do not use it for telemarketing calls.

Vora’s checks are a backstop

Before an outbound call, the Service:

• checks the number against your Workspace’s do-not-contact list and against the do-not-call records we hold, and blocks the call if that check cannot be completed;
• requires a caller ID number that your Workspace owns; and
• for bulk calls, such as batch calls and campaigns, also requires a consent basis and allows calls only between 08:00 and 21:00 in the recipient’s local time, using time zone data that may come from you. Bulk calling may not be available to your Workspace.

Calls placed one at a time are not checked for consent or calling hours. That includes calls placed from the dashboard, through our API, through Zapier or by a workflow, even when you place many of them in a row.

These checks are a backstop, not a substitute for your own compliance. Our do-not-call records may be incomplete, or empty for a destination. Vora’s check does not give you access to any do-not-call register and does not replace your own checks. We may restrict the countries and types of numbers you can call.

Call recording

Audio recording is off by default. You can turn it on for each agent. If you do, you are responsible for complying with recording laws, in addition to the duties under “Transcription and AI processing of calls” below. In particular, you must:

• announce the recording and obtain consent where the law requires. Some US states, for example Washington and Florida, require the consent of everyone on the call, and in the EU and the UK recording needs a lawful basis and notice. Where people on a call are in different states or countries, follow the strictest rule that may apply;
• in Serbia, record calls under the Law on Electronic Communications (“Službeni glasnik RS”, No. 35/2023, Article 160) only to provide evidence of commercial transactions or other business communications, and only where the parties are aware, or should be aware, or have been explicitly warned that the call may be recorded. Recording for other purposes, such as quality review, also needs a lawful basis under the Serbian Law on Personal Data Protection; and
• make sure your agents actually give any recording notice you need, and that the notice is accurate. Place a test call to check. The “Announce” consent option does not currently add a notice. The “Ask” option and the TCPA compliance setting may not add one to agents you start from scratch or whose instructions you write yourself, and the TCPA compliance setting adds a recording notice only. When a notice is added, its default wording says that calls may be recorded “for quality and training purposes”. Vora does not use recordings to train AI models (see AI features and outputs), so if that wording does not fit your use, or if your agent gives no notice, write your own notice into the agent’s greeting.

When recording is on, the Service starts recording as the call connects, so any recording notice or consent question in the greeting is itself recorded. The Service does not stop or delete a recording automatically if a caller objects. Set up your agent to end the call if a caller does not agree to be recorded. If you need consent before any recording starts, do not turn recording on for that agent. Recordings are kept until they are removed; there is currently no automatic deletion, and deleting a recording in the Service hides it without erasing the audio file (see Customer Data and data processing).

Transcription and AI processing of calls

Whether or not audio recording is on, the Service sends the audio of every call to our AI providers as the call happens, so that your agent can understand and answer the caller, and it creates and stores a transcript, a summary and facts about the caller (see How Vora uses AI). Some laws, including the all-party consent laws of some US states, can treat listening to, transcribing or analyzing a call through a third-party service in the same way as recording it. You must give callers the notice, and obtain the consent, that these laws require for this processing and not only for audio recording, for example in your agent’s greeting. If you cannot do that for a call, do not use the Service for it.

WhatsApp, Messenger and Instagram

Where these channels are enabled for your Workspace, they connect your own WhatsApp Business account, Facebook Page or Instagram account, and you must follow Meta’s terms and policies, including the WhatsApp Business Messaging Policy. In particular, you must:

• message people only if they gave you their phone number or username and opted in to receive messages from you;
• respect every request to block you or to opt out, whether it is made on the channel or elsewhere;
• keep a published privacy policy;
• not ask people to share full payment card numbers, financial account numbers, identity card numbers or other sensitive identifiers;
• use information Meta gives you about the people you message, other than the content of your conversations with them, only as reasonably needed to support messaging with them;
• not forward or share information from one person’s chat with any of your other customers or with another Client;
• when an agent replies automatically, offer a prompt and clear way to reach a person, such as a transfer to your staff, a phone number or an email address; and
• not use these channels to offer a general-purpose AI assistant.

If the Service sends WhatsApp messages for you from a WhatsApp Business account that Vora manages, where this is enabled for your Workspace, the same rules apply. In particular, each recipient must have opted in to receive WhatsApp messages about your business from that number, and each message must clearly name your business. We may stop sending at any time if Meta requires it or if we believe these rules are not being met.

9. Text message programs

Text messaging is in early access and may not be available to your Workspace.

Who sends texts through Vora

Vora sends text messages on behalf of its customers, for example follow-up texts after a call, missed-call text-backs and appointment reminders, through our carriers, currently Multitel and Telnyx, using Vora’s carrier accounts. The business the message comes from, our customer, is the sender and is responsible for its texting program. Vora does not send marketing texts of its own. If we ever start a text program of our own, we will ask for consent first and describe the program here before it starts.

If you receive texts sent through Vora

• Message frequency varies.
• Message and data rates may apply.
• To stop texts from a business, reply STOP (or another opt-out word such as UNSUBSCRIBE, CANCEL, END or QUIT), on its own, to its message, or contact the business directly. When Vora can match a STOP reply to a text sent for a business, it records the reply as an opt-out for that business, and the business must honor it.
• Vora does not currently send an automatic reply to STOP or HELP, and it applies a STOP reply automatically only to that business’s reminder and review-request texts. It does not yet stop the business’s follow-up texts, missed-call texts or calls, so if texts or calls continue, contact the business or email support@voicevora.com.
• If you reply START, UNSTOP or YES on its own after a STOP, Vora may treat it as a request to receive that business’s texts again.
• For help, contact the business that sent the message, or email support@voicevora.com.
• Wireless carriers are not liable for delayed or undelivered messages.
• Each business’s own privacy policy and terms apply to its texting program. Our Privacy Policy explains how we handle phone numbers and text messages.

If you send texts through Vora

You run your own texting program. You must:

• get each recipient’s consent before you text them, and their prior express written consent for marketing texts, and tell recipients that consent is not a condition of purchase where the law requires;
• show in your call to action and in your own SMS terms your business or program name, a description of the messages, how often you send them (for example “Message frequency varies.”), “Message and data rates may apply.”, “Reply STOP to cancel.”, a customer care email address or phone number where people can get help, and links to your privacy policy and terms. While Vora does not reply to HELP for your Workspace, do not add “Reply HELP for help.”;
• respond to requests for help and honor STOP requests. Vora does not currently reply to HELP or STOP messages for you, or pass HELP messages on to you, so give your customer care contact in your call to action and in your messages;
• not ask recipients to reply YES, START or UNSTOP for any other purpose, such as confirming an appointment, because in the Service those replies can lift an earlier STOP;
• honor opt-outs made by any reasonable means, including STOP replies, messages such as “please stop”, calls and emails, within the time the law allows and, in the US, within 10 business days at the latest;
• make sure each opt-out applies to all of your texts and calls. Vora keeps two opt-out records that are not yet linked: STOP replies, which Vora applies to reminder and review-request texts, and your do-not-contact list, which Vora checks before calls, follow-up and missed-call texts and email. Where the do-not-contact list is available to your Workspace, add every number that opts out to it;
• send only the kinds of messages the recipient agreed to, at times the law allows, and follow carrier rules and the CTIA Messaging Principles and Best Practices;
• for marketing texts, check each number against the do-not-call registers that apply, such as the US National Do Not Call Registry and state do-not-call lists, using your own access to each register, and follow the same do-not-call list, policy and training rules as for calls, because US do-not-call and calling-time rules also apply to texts sent to mobile numbers (47 CFR 64.1200(e)). Your do-not-contact list in Vora is not a do-not-call register (see Calls, phone numbers and messaging);
• before you turn on automatic texts for an agent, such as follow-up and missed-call texts, make sure each one is lawful for every person who may receive it, including at the local time it will arrive, for example because the caller asked for a text or gave consent. If you are unsure which are on, or need one stopped, email support@voicevora.com and we will help;
• not turn on reminder texts, or review requests by text or WhatsApp, unless you hold the consent the law requires to message everyone who will receive them (see “Consent records and senders” in Your data and your legal responsibilities);
• have your program registered where carriers require it, as described in Your data and your legal responsibilities, and do not text people in the United States through Vora until we confirm that it is registered; and
• keep consent records (see Your data and your legal responsibilities).

Follow-up and missed-call texts are off until you turn them on for an agent. If you turn on missed-call text-backs in an agent’s settings, the Service may fill in default wording. That wording uses the agent’s name, which may not be your business name, and includes no opt-out instructions, so check it before you rely on it. Once these texts are on, Vora sends them automatically after each call that triggers them, whatever the time is where the recipient is. Vora does not check consent before sending them, and the only opt-out record it checks is your do-not-contact list.

Vora records an opt-out automatically only when the whole reply is one of its opt-out keywords, such as STOP. It does not record other replies, such as “please stop texting me”, which you must also honor.

If you cannot see the replies or opt-out records for texts sent for your Workspace in the Service, email support@voicevora.com and we will help you get the opt-out information you need to honor them.

Mobile information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

10. Email outreach and marketing

Email outreach and broadcasts may not be available to your Workspace (see The Service and early access). When you send outreach or broadcast email through the Service, it goes from your own connected mailbox, and you are responsible for it. Reminder emails, where enabled for your Workspace, are sent for you through our email provider, and the rules in this section apply to them too.

Connected mailboxes

Connect only mailboxes you own or are authorized to connect, and tell the people who use them how Vora processes them. When you connect a mailbox for outreach, Vora:

• reads the messages in its inbox during the sync window, not only replies to your emails, and stores them in your Workspace;
• sends their text to our AI provider DeepInfra to classify and label each message and, for some messages, to draft replies;
• when one of your contacts replies, other than with an automatic reply such as an out-of-office, stops that contact’s active outreach sequences and records the reply on the contact as engagement with a lead-scoring weight, and records a reply classified as positive again, with a higher weight; and
• may automatically add a sender who does not want more email to your do-not-contact list, even if the sender is not one of your contacts.

See Google user data and Microsoft data in our Privacy Policy.

Rules for every commercial email

You must comply with the US CAN-SPAM Act, which has no exception for business-to-business email and whose obligations cannot be contracted away, and with the rules of each country where your recipients are. Every commercial email you send must:

• have accurate sender and routing information and a subject line that is not misleading;
• identify the sender accurately. Set a display name and signature for every mailbox before you send: if a mailbox has none, the Service currently fills in a default name that is not yours;
• be identified as an advertisement where the law requires;
• include a valid physical postal address of the sender, meaning the business whose products or services the email promotes: your own, or, if you are an Agency sending for a Client, usually the Client’s. Do not rely on any address or footer the Service adds automatically, which may not be the sender’s; and
• include a clear way to opt out that keeps working for at least 30 days after you send. The Service adds a one-click unsubscribe header to outreach and broadcast emails. That header also lists an unsubscribe email address at your sending domain: unsubscribe@ followed by the domain of the mailbox. Vora does not set up or monitor that address. If the domain is yours, set the address up and act on what it receives. If you send from a shared domain such as gmail.com, the address is not yours, so rely on your own visible link. The Service adds no visible unsubscribe link to outreach emails, and the unsubscribe link that Vora’s ready-made broadcast templates insert does not currently work, so add your own visible unsubscribe link or instructions and test that it works before you send.

Stop marketing to anyone who opts out within 10 business days of their request, and never sell or transfer an opted-out address.

Email addresses found through lead enrichment are not consent to receive email. Check that you may lawfully email each one, and do not send to any address that our acceptable use rules prohibit.

Consent in the EU, the UK and Serbia

Where the law requires it, send marketing email only with the recipient’s prior consent, for example to individuals under the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations, unless an exception such as the soft opt-in applies. In Serbia, commercial electronic messages need the recipient’s prior consent (Law on Electronic Commerce, “Službeni glasnik RS”, Nos. 41/2009, 95/2013 and 52/2019, Article 8). Always give a valid address for opt-out requests, and accept withdrawals of consent.

Objection and notice at first contact

When you use personal data to contact someone for direct marketing, you must, at the latest in your first message, tell them about their right to object to direct marketing, clearly and separately from any other information (GDPR Article 21(4)), and give them the information the law requires about your processing (GDPR Article 14; Serbian Law on Personal Data Protection, Article 24). If they object, stop.

Google and bulk-sender rules

• Do not send spam or unsolicited commercial email through a connected Google account. Send bulk commercial email through a Google account only to recipients who consented to receive it.
• Demo emails that Vora sends to leads in a demo campaign can go out from any of your Workspace’s connected mailboxes: the Service uses whichever has sent the fewest emails that day, and you cannot currently choose which. So if any of your connected mailboxes is a Google account, send a demo campaign only to leads who have agreed to receive email from you. Do not connect extra Google accounts to send more email than Google’s limits allow.
• Follow the sending rules of mailbox providers. For example, Google requires senders of more than 5,000 messages a day to Gmail addresses to authenticate with SPF, DKIM and DMARC, to offer one-click unsubscribe with a visible unsubscribe link, and to keep spam complaint rates below 0.3%.

Tracking, suppression and limits

Open tracking and click tracking are on by default for each mailbox. When a recipient opens a tracked email or clicks a tracked link, the Service records the time, any link clicked, the recipient’s IP address and browser details, and records the open or click as engagement with a lead-scoring weight. Turn tracking off where you do not have a lawful basis for it, for example where the law requires the recipient’s consent for tracking pixels. The Service adds bounces, complaints and unsubscribes to your Workspace’s do-not-contact list, also called the suppression list, and checks that list before sending. It may pause or limit sending to protect deliverability, for example when bounce rates are high. These features are backstops, and you remain responsible for your sending.

11. Integrations and third-party services

You can connect Third-Party Services to the Service, such as Google, Microsoft and Meta accounts, CRMs like HubSpot, Salesforce, Pipedrive and Zoho, calendars, carriers, payment providers, automation tools like Zapier and Make, and AI assistants. Some integrations are available only on some plans or to some Workspaces.

Your authorization

When you connect a Third-Party Service, you authorize us to access it and act in it for you as you instruct and as the feature describes, for example to read and write CRM records, check availability and book appointments in a calendar, send email and read a mailbox, or run workflow steps. Connect only accounts you own or are authorized to connect. For a Microsoft 365 or Outlook mailbox, you expressly and specifically authorize us to send from it the emails that you, your team and your sequences schedule, and any demo emails for which the Service picks that mailbox; to read and store the messages in its inbox; to have our AI provider classify those messages and draft replies; based on those messages, to stop outreach sequences to contacts who reply, to record their replies as engagement with lead-scoring weights and to update your do-not-contact list; to show the sender and up to 160 characters of a message in your notifications; to pass the sender’s address, the subject and the message IDs of replies to workflows you build, and to Zapier or any other service you subscribe to Vora’s email-reply trigger; to add senders’ addresses to Vora’s helpdesk when its email inbox is turned on; to give your mailbox address to our warm-up provider when warm-up is enabled; and to show these messages in an AI assistant you connect to Vora. For Microsoft 365 connectors you add to workflows or agents, you also authorize us to send email and list messages, create and list calendar events, list files and create folders, and send messages to a Teams channel, as you configure. All of this is described under Microsoft data in our Privacy Policy.

Their terms apply

Your use of a Third-Party Service is governed by your agreement with its provider. We do not control Third-Party Services and are not responsible for their availability, security or content, or for how they handle data. A provider may change or end its service or API, and we may then need to change or end the integration. Vora is not affiliated with or endorsed by Google, Microsoft, Meta, OpenAI or Anthropic.

Lead search and Google Maps

Lead search includes Google Maps features and content. Your use of Google Maps features and content is subject to the then-current versions of the Google Maps End User Additional Terms of Service and the Google Privacy Policy. Lead search also uses OpenStreetMap data, © OpenStreetMap contributors. Do not copy, scrape or export lead search results outside the Service except as the Service allows.

Google data

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our Privacy Policy explains, for each Google feature, what we access and why (see Google user data).

Disconnecting

You can disconnect most integrations in the Service. Disconnecting does not by itself delete data already synced into your Workspace, and for most integrations it does not revoke Vora’s access at the provider. To remove access completely, also revoke it with the provider: for Google at https://myaccount.google.com/linkedapps (see Google’s help article), for Microsoft at https://account.live.com/consent/Manage or https://myapps.microsoft.com, and for Meta in your Facebook or Instagram settings. To have synced data deleted, see Deleting your data and revoking access.

AI assistants

If you connect Vora to an AI assistant, such as ChatGPT or Claude where available, the assistant can call Vora tools with your permissions.

• The information those tools return, for example inbox messages, calendar events, CRM records, leads, reviews or call details, including what the Vora app in ChatGPT shows in its cards, goes to the assistant’s provider, which handles it under your agreement with them and not as our sub-processor.
• Actions an assistant takes through Vora count as your actions. In ChatGPT, actions with a bigger effect, such as sending email, placing a test call to your phone or publishing an agent, are only prepared there, and nothing runs until you approve it in the Service.
• You can revoke access at any time under Connected apps in the Service. Access tokens already issued remain valid for up to one hour after you revoke.

Vora in ChatGPT is a business tool for managing your voice agents, inbox, calls and CRM. It is not intended for protected health information. Do not use the Vora app in ChatGPT for patient or health records. See Vora in ChatGPT, Claude and other AI assistants for the data involved.

Your own provider accounts

If you connect your own account with a provider, such as a telephony carrier, an AI provider or a payment processor, that provider bills you directly, its terms govern your account, and you are responsible for how you use it. When you take payments from your own customers through your own payment provider account, you are the merchant.

APIs and automation tools

If we give you API keys, keep them secret and use them only as documented. Requests made with your API keys, or through Zapier, Make or similar tools, are your actions and are subject to these terms, including the rules on outbound calls in Calls, phone numbers and messaging.

12. Google Business Profile

Reputation features let you connect Google Business Profile, import reviews of your locations, draft replies and publish owner replies. When you use them, these rules apply:

• Authorization. Connect and manage only Business Profile listings that you own or are authorized to manage for the business owner. If you manage a listing for a Client, get the Client’s authorization before you reply to reviews for them.
• Replies only when you act. Vora uses the connection to read your locations’ reviews and to publish, edit or delete owner replies when an owner or admin of your Workspace chooses to. Vora does not publish replies automatically. AI-drafted replies are suggestions that you review, and can edit, before you publish them. To draft one, we send the review’s rating and text, without the reviewer’s name, to our AI provider OpenAI.
• Signed-in use only. Use the Business Profile features only while signed in to Vora. Apart from Vora’s review widget and the Vora app in ChatGPT, which you connect with your own Vora sign-in, both described below, do not give anyone else access to Business Profile data through Vora, and do not use Vora’s API, workflows, workflow connectors or other scripts to read Business Profile data or to publish, edit or delete replies. Where workflows are enabled for your Workspace, Vora’s Business Profile workflow connector can be connected. It lists your reviews and starts a workflow when a new review arrives, passing the reviewer’s name, the rating and the review text to that workflow. Do not connect it. When a new review arrives, Vora also generates review events, which carry the review’s rating, source and ID and, where workflows are enabled, can start workflows. Do not let review events for Business Profile reviews start your workflows: if you build workflows on review events, limit them to other review sources. We may disable the connector, or stop these events from starting workflows, at any time.
• Content rules. Your replies must follow Google’s prohibited and restricted content policies and these terms.
• Telling Clients about changes. If you manage a Client’s Business Profile, tell the Client within 48 hours about changes made to their account through Vora, such as replies you publish, edit or delete, in a notice of your own that is separate from any notice Google sends.
• No lead generation. Except for what the Business Profile workflow connector passes to a workflow if it is connected despite the rule above, Vora uses the reviews and other data it receives from Business Profile only to provide the reputation features to you: listing your reviews; alerting your Workspace in Vora to new reviews below three stars; drafting replies and publishing your replies in Vora; generating the review events described above, which also create that alert; listing your reviews in the Vora app in ChatGPT if you connect it; and showing them in Vora’s review widget. The widget shows your average rating, review count and star distribution, calculated together with any Facebook reviews, and, for recent reviews, the rating, the reviewer’s first name, the date and the source, never the review text. It loads these details from a public Vora address that works with the ID of any active agent in your Workspace, whether or not you add the widget to your website. Business Profile data is never used for lead generation. Do not use it, or copy it out of Vora, to identify, contact or market to reviewers or anyone else, other than by publishing your owner replies on Google. The Vora app in ChatGPT cannot publish, edit or delete replies.
• Stopping use. You can stop Vora’s access at any time by removing Vora in your Google Account at https://myaccount.google.com/linkedapps (see Google’s help article). Removing access there may also disconnect other Vora features that use the same Google account. Disconnecting Business Profile in Vora marks the connection as inactive, but it does not revoke Vora’s access at Google or delete reviews already imported. To have imported reviews and stored connection details deleted, email support@voicevora.com (see Customer Data and data processing).
• No endorsement. Using Vora with your Business Profile does not create, suggest or imply a partnership with, sponsorship by, or endorsement by Google. Vora is not affiliated with or endorsed by Google.

Our Privacy Policy explains how long imported reviews are kept (see How long we keep information).

13. Customer Data and data processing

Your data

As between you and us, you own your Customer Data. Data that comes from third parties, such as lead search results from Google Maps or OpenStreetMap and imported Google Business Profile reviews, remains subject to those third parties’ rights and terms. You give us a worldwide, non-exclusive, royalty-free license to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service for you, to follow your instructions and to comply with the law. We do not sell Customer Data, and we do not use Customer Data to create, train or improve AI models, except for a voice clone you choose to create (see AI features and outputs).

Usage Data

We may use Usage Data to operate, secure, support and bill the Service, and to improve it in a form that does not identify you, your Users or End Users.

Our data processing terms

This part applies when we process personal data in Customer Data for you as your processor, or as a sub-processor where you act for a Client. These data processing terms form part of these terms. They set out our commitments as your processor under Article 28 of the GDPR and of the UK GDPR and Article 45 of the Serbian Law on Personal Data Protection.

As your processor, we will:

1. Follow your instructions. Process personal data only on your documented instructions, including with regard to transfers to other countries, unless the law requires otherwise, in which case we will tell you first unless the law forbids it. These terms, your settings in the Service and your use of its features are your instructions. Some processing is part of the Service whatever your settings: after every call, the Service creates a summary and extracts facts about the caller into a caller profile, as described in Your data and your legal responsibilities. By using the Service, you instruct us to carry out that processing. The Service cannot currently stop it for an individual caller. If a caller objects, you can erase that caller’s data with the tools described in point 6 below, or email support@voicevora.com for help, but facts from later calls with that caller may be saved again. We will tell you straight away if we believe an instruction breaks data protection law.
2. Keep it confidential. Make sure that everyone we authorize to process personal data is bound by confidentiality.
3. Keep it secure. Take appropriate technical and organizational measures to protect personal data, as described under How we protect information. They include encrypted connections (TLS), AES-256-GCM encryption of the OAuth tokens and provider credentials for accounts you connect that the Service keeps in our credential stores, role-based access and audit logging. As that section explains, some records that contain credentials are not yet covered by that encryption.
4. Limit staff access. Make sure our staff view Customer Data only with your documented consent on a support request, to investigate bugs, security issues or abuse, to comply with the law, or in aggregated and anonymized form for internal operations.
5. Use sub-processors with notice. You give us general authorization to engage the sub-processors listed under Service providers. We will tell you in advance about any intended addition or replacement by updating that list, and also by email if you ask us at support@voicevora.com, so that you can object. If you object on reasonable data protection grounds and we cannot resolve your concern, you may stop using the affected feature or end the affected part of the Service. We remain responsible to you for our sub-processors’ processing of your personal data.
6. Help with End User requests. Help you respond to End Users who exercise their rights. Workspace owners and admins can export or erase an End User’s data with the tools under Privacy & compliance in the Service. These tools do not yet remove every copy, such as call recordings, raw transcript segments, CRM call-transcript activities and stored inbox emails. After an erasure, the raw transcript segments that remain are no longer reached by the automatic 30-day transcript deletion, and recordings are never deleted automatically, so email support@voicevora.com to have them and the other copies removed.
7. Help with your obligations. Give you reasonable help with security, personal data breach notifications, data protection impact assessments and consultations with supervisory authorities, taking into account the information available to us.
8. Report breaches. Tell you without undue delay after we become aware of a personal data breach affecting your Customer Data, and give you the information we have to help you meet your obligations.
9. Handle authority requests. Tell you about a request from a public authority for your Customer Data, unless the law forbids it, and disclose only what the law requires.
10. Delete or return data. Let you export the Customer Data that the Service’s export features cover while your account is active and, at your choice, return or delete Customer Data when the Service ends for you, as described under “Retention and deletion” below.
11. Support audits. Make available the information reasonably needed to show that we meet this section, and allow for and contribute to audits, including inspections, by you or by an auditor you appoint who is bound by confidentiality, on reasonable notice and at your cost. Audits may take place no more than once in any 12-month period, unless a supervisory authority requires it or after a personal data breach affecting your Customer Data. We may first answer with documents and written answers. Audits must not give access to other customers’ data, and on-site audits need at least 30 days’ notice and take place during business hours.

Agencies and Clients

Where you process personal data for a Client, you confirm that the Client has authorized you to engage us as a sub-processor and that your instructions to us are authorized by the Client. You will pass on to the Client any information or notices we give you under this section that concern the Client.

US state privacy laws

Where the California Consumer Privacy Act or another US state privacy law applies to personal information in Customer Data, we process it as your service provider, contractor or processor, for the business purposes described in the table above. We will not sell or share that personal information, as those laws define these terms; retain, use or disclose it for any purpose other than providing the Service to you under these terms, or as those laws otherwise permit; retain, use or disclose it outside our direct business relationship with you; or combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with a person, except as those laws permit. We will comply with the obligations those laws place on us, give that personal information the level of privacy protection they require, and tell you if we decide that we can no longer meet these obligations. You may take reasonable and appropriate steps to make sure we use that personal information in line with these obligations, and to stop and remediate any unauthorized use, including by asking us to delete it.

Who we share Customer Data with

We disclose Customer Data only:

• to our sub-processors listed under Service providers, to provide the Service;
• to carriers and messaging platforms, to deliver your calls and messages and to meet their registration and know-your-customer requirements;
• to Third-Party Services that you connect or tell us to send data to;
• to the people your agents and Workspace communicate with, as you set them up, for example the free times and booking details an agent gives a caller;
• to anyone who views Vora’s review widget, on your website or at its public Vora address, which works with the ID of any active agent in your Workspace: your average rating, review count and star distribution and, for recent reviews, the rating, the reviewer’s first name, the date and the source, never the review text;
• to carriers and messaging platforms, and to authorities where the law allows, as far as reasonably necessary to investigate or stop fraud, abuse, or unlawful calls, messages or content sent through your account, or to answer a complaint or a call-tracing request about them;
• to a successor that takes over our business, which must keep to these terms (see General terms). Google user data passes to a successor only after we obtain your explicit prior consent, and text messaging opt-in data and consent never pass; and
• where the law requires it, as described above.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

International transfers

We are established in Serbia, which does not have an EU adequacy decision. Our core application servers are in Germany (Hetzner). Our other providers may process data in the EU, the United States, India and other countries. For personal data that a customer in the EU, the EEA or the UK sends us, we will put in place the European Commission’s standard contractual clauses, or the UK equivalent, on request. If the GDPR or the UK GDPR applies to your transfer, ask us for them at support@voicevora.com before you send personal data to us through the Service: as the exporter, you are responsible for having a transfer safeguard in place. See International transfers.

Retention and deletion

• Raw call transcripts are deleted automatically 30 days after the call by default, except as described in point 6 above. AI summaries and the transcript copies saved to your CRM are kept.
• Call recordings, stored inbox emails, CRM transcript copies, chat handoff transcripts, Google Business Profile reviews and most other data from Connected Accounts are kept until they are removed; there is currently no automatic deletion.
• Deleting a call recording in the Service hides it from your Workspace, but the audio file stays in storage until we erase it at your request to support@voicevora.com.
• Logs, audit records and billing records are kept as long as needed for security, fraud prevention, accounting and legal obligations.
• You can delete an individual call transcript in the Service, which also deletes its summary but not the copy on the CRM contact’s timeline. The CRM does not let you delete those copies, so ask us to remove them. You can also use the End User export and erasure tools described above.
• Disconnecting an integration does not by itself delete data already synced.
• We delete the personal data in your account, including data from accounts you connected, within 30 days of a verified request to support@voicevora.com. There is no self-serve account deletion yet, and a request to close your account counts as a request to delete it. This does not cover data we must keep by law, such as invoices, the minimum needed to keep honoring an opt-out, or data in routine backups, which ages out.
• When you ask us to close your account, tell us if you want a copy of your Customer Data first. We will give you what the Service’s export features can produce before we delete it.
• Cancelling a subscription does not close your account or delete data. If your account ends for any other reason, for example because we end it under Suspension and termination, you can ask us at support@voicevora.com within 30 days for a copy of the Customer Data that the Service’s export features can produce, unless the law prevents it. After that, we will delete the Customer Data, except data we must keep by law, the minimum needed to keep honoring an opt-out, and data in routine backups, which ages out.

Export what you need before you ask us to close your account. Exports are available feature by feature, for example for CRM contacts, smart lists, sessions, transcripts, usage and call analytics. There is no single whole-account export yet. Email support@voicevora.com if you need help. Our Privacy Policy has more detail (see How long we keep information and Deleting your data and revoking access).

Data we control

We are the controller of Account Data, Usage Data and website data, as our Privacy Policy explains. Paddle acts as an independent controller of the payment and tax information it collects at checkout.

14. Fees, billing and taxes

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

This means Paddle handles checkout, payment, invoicing, tax and the processing of refunds for your orders, and Paddle’s buyer terms also apply to your purchase. We provide support for the Service itself at support@voicevora.com, and you can ask us for a refund as set out in Refund and cancellation policy.

Prices and taxes

Prices, included Credits and plan features are shown in the Service, on its plans and billing pages, and at checkout before you buy. Unless checkout shows otherwise, prices exclude taxes. Paddle calculates any applicable tax, such as VAT or sales tax, and shows it at checkout. If we agree a custom plan with you in writing, its terms apply, and Paddle still processes the order as our Merchant of Record.

Subscriptions

Paid plans are subscriptions. When you subscribe, you authorize Paddle to charge the plan price, plus tax, at the start of each billing period (currently monthly) until you cancel. Subscriptions renew automatically. You can cancel at any time by emailing us or contacting Paddle, and cancellation takes effect at the end of the current billing period (see Refund and cancellation policy).

Credits and usage

Using the Service consumes Credits at the rates shown in the Service at the time of use. Plans may include Credits, and you can buy more. The rules for Credits, including any renewal, rollover or expiry, are those shown in the Service and at checkout when you buy. Credits have no cash value, cannot be transferred or exchanged for money, and end when your account ends, except as set out in Suspension and termination. If you run out of Credits, some features may stop until you add more. We may offer free or trial access with limits that we may change.

Other charges

Phone numbers and some other items may carry recurring charges, which are shown in the Service. Third-Party Services you connect, such as your own carrier, AI provider or payment processor, bill you directly under their own terms.

Price changes

We may change our prices. A new subscription price applies from your first billing period that starts after we have given you reasonable advance notice. If you do not agree, cancel before it applies.

Failed payments and invoices

If a payment fails or is reversed, we may suspend paid features or your account until the problem is resolved. Paddle issues the invoices and receipts for your orders.

15. Refund and cancellation policy

This is our refund policy. It applies to all our orders, which Paddle processes as our Merchant of Record.

Cancelling a subscription

You can cancel a subscription at any time by emailing support@voicevora.com with the subject “Cancel my subscription” from the email address on your account, or by contacting Paddle using the details in your receipt. We will confirm the cancellation by email. If you ask before your next billing date, your plan stays active until the end of the period you have paid for, and you will not be charged again. If you asked us before that date to cancel, or to close your account, and a renewal is still charged, that renewal was not due, and we will refund it in full through Paddle. Cancelling does not close your account or delete your data (see Customer Data and data processing).

Full refund within 14 days of a new subscription

If you ask within 14 days of the first payment of a new subscription, we will refund that payment in full, whether or not you have used the Credits included in the plan. This refund does not cover Credits you bought separately or other usage charges. When we make it, the subscription ends.

What is not refundable

Apart from the 14-day refund above, renewal payments, purchases of additional Credits (top-ups), Credits you have used and other usage charges are non-refundable, except where the law requires a refund, where a confirmed fault on our side prevented you from using what you paid for, as set out under “Cancelling a subscription” above, or as set out in Suspension and termination.

How to ask for a refund

Email support@voicevora.com from the email address on your account, with the Paddle order or receipt reference (a reason is optional for the 14-day refund), or contact Paddle using the details in your receipt. Paddle issues approved refunds to your original payment method. How long a refund takes to appear depends on your bank or card provider.

Chargebacks

Please contact us before you dispute a charge with your bank. We may suspend an account while a chargeback is open.

Your legal rights

This policy does not limit any rights you have under mandatory law.

16. Intellectual property and feedback

We and our licensors own the Service, including its software, design, documentation and trademarks. Subject to these terms and to payment of the Fees, we give you a limited, non-exclusive, non-transferable right to use the Service for your business while you have an account, and to let your Users and, if you are an Agency, your Clients use it. We keep all other rights.

You keep all rights in your Customer Data and in Output (see Customer Data and data processing and AI features and outputs). You must have the rights needed for everything you add to the Service, including documents, websites you import, voice samples and recordings.

Do not use Vora’s name or logo, except to say accurately that you use the Service or as the Partner Program terms allow. Where white-label features are enabled for you, you may present the Service under your own brand as those features allow.

If you send us ideas or suggestions, you give us a perpetual, irrevocable, worldwide, royalty-free and transferable license to use, change and build on them for any purpose, without paying you. You do not have to send us feedback.

To report content in the Service that you believe infringes your rights, email support@voicevora.com.

17. Confidentiality

“Confidential Information” means non-public information that one party shares with the other and that is marked as confidential or should reasonably be understood to be confidential. Your Customer Data is your Confidential Information. Non-public information about the Service, our pricing offers and our security is ours.

The receiving party will:

• use the other party’s Confidential Information only to provide or use the Service under these terms;
• protect it with at least reasonable care; and
• share it only with its staff, contractors and service providers who need it for that purpose and are bound by confidentiality, or as these terms otherwise allow, for example in Customer Data and data processing.

These duties do not apply to information that is or becomes public through no fault of the receiving party, that it already knew, that it receives lawfully from a third party without a duty of confidence, or that it develops independently. A party may disclose Confidential Information where the law requires, after telling the other party where the law allows. These duties continue for as long as the information remains confidential.

18. Suspension and termination

Suspension

We may suspend all or part of the Service, including agents, Platform Numbers, mailboxes, campaigns or integrations, if:

• you breach our acceptable use rules or another important part of these terms;
• your use creates a security risk or may harm the Service, other customers, End Users or anyone else;
• a carrier, platform, regulator or court requires it, or we receive credible complaints about calls, texts or emails you send;
• Fees are overdue or a payment is reversed; or
• the law requires it.

Where it is practical, we will tell you first and give you a chance to fix the problem. We will lift a suspension once the reason for it is resolved, unless we end your account. We are not liable for a suspension made in line with this section, and Fees continue to apply while the Service is suspended because of your breach or unpaid Fees.

Ending these terms

• By you. You can stop using the Service at any time. To cancel your subscription, email us or contact Paddle (see Refund and cancellation policy). To close your account and have its data deleted, email support@voicevora.com (see Customer Data and data processing). A request to close your account also cancels your subscription, so you will not be charged again. Any refund is given only as set out in Refund and cancellation policy.
• By us. We may end these terms or your account by notice if you materially breach them and do not fix the breach within a reasonable time after we tell you about it. We may end them straight away for serious or repeated breaches of our acceptable use rules, for fraud, or where the law, a carrier or a platform requires it. We may also stop offering the Service, or end early access, for everyone, with reasonable notice.

When your account ends

• Your right to use the Service ends, and we may switch off your agents, numbers and integrations.
• Platform Numbers may be reclaimed (see Calls, phone numbers and messaging).
• Fees already paid are refunded only as set out in Refund and cancellation policy, and unpaid Fees become due. If we stop offering the Service for everyone, or end your account for a reason other than your breach of these terms or of the law, we will refund through Paddle any unused Credits you bought separately and, where the law requires it, the unused part of any prepaid subscription period.
• Customer Data is handled as described in Customer Data and data processing, including the 30 days in which you can ask for a copy. Export what you need before your account ends.
• Sections that by their nature should continue, including those on Fees, Customer Data, confidentiality, disclaimers, limitation of liability, indemnification and governing law, continue to apply.

19. Disclaimers

To the extent the law allows, the Service, Output and early-access features are provided “as is” and “as available”. Except as these terms expressly state, we make no warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted, secure or error-free operation.

In particular, we do not guarantee that:

• calls connect, or that texts and emails are delivered, on time or at all, because delivery depends on carriers, mailbox providers and other third parties;
• AI agents and Output are accurate or suitable for your purpose;
• Third-Party Services work or remain available; or
• compliance features, such as do-not-call checks, calling-hour limits, do-not-contact lists and consent prompts, make your use lawful. They are tools, not legal advice.

Nothing in these terms excludes warranties or rights that cannot be excluded under mandatory law.

20. Limitation of liability

To the extent the law allows:

• neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill or business opportunities, arising out of or relating to these terms or the Service, even if it was told they were possible; and
• our total liability arising out of or relating to these terms or the Service, whatever the legal basis, is limited to the Fees you paid for the Service, including through Paddle and excluding taxes, in the 12 months before the claim.

These limits apply to every claim arising out of or relating to these terms or the Service, including claims under our data processing terms and the US state privacy law commitments in Customer Data and data processing. They do not apply to your obligation to pay Fees, to your obligations under Indemnification, or to your breach of our acceptable use rules.

Nothing in these terms limits or excludes liability that cannot be limited or excluded under applicable law, such as liability for intentional misconduct or gross negligence, for death or personal injury caused by negligence, or for fraud, or the mandatory rights of consumers.

21. Indemnification

You will defend us against any claim, complaint or regulatory action by a third party or an authority, and pay the losses, damages, fines, penalties and reasonable legal costs that result from it, where it arises from:

• your Customer Data or your instructions to us;
• calls, text messages, emails or other communications made or sent through your account, including claims under the TCPA, the CAN-SPAM Act, ePrivacy and anti-spam laws, and call recording laws;
• what your agents say, your use of Output, and voice clones you create;
• your breach of these terms or of the law, or the use of the Service by your Users or Clients; or
• your Connected Accounts, or your agreements with Clients or with providers of Third-Party Services.

You will also pay us any fees, fines or charges that a carrier, messaging platform or registry imposes on us because of calls, messages, content or registrations made through your account.

This section does not apply to the extent a claim or charge results from our breach of these terms, or from our gross negligence or willful misconduct. Fines and penalties are covered only where the law allows them to be passed on.

We will tell you promptly about a claim and give you reasonable help at your cost. You may control the defense and settlement of a claim brought by a private third party, and we may take part with our own lawyers at our cost. We control our own dealings with any regulator, court, carrier or platform. If you do not take over the defense of a claim promptly after we ask, we may defend or settle it ourselves at your cost. You may not settle a claim in a way that admits fault on our behalf or places obligations on us without our written consent.

22. Governing law and disputes

These terms, and any dispute or claim arising out of or in connection with them or the Service, are governed by the laws of the Republic of Serbia, without regard to its conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

The competent courts of the Republic of Serbia have exclusive jurisdiction over any such dispute. This does not prevent either party from asking any competent court for urgent interim relief, for example to stop misuse of the Service or of Confidential Information. If you are a consumer despite our business-only rule, you keep the protection of the mandatory law of your country of residence, including any right to bring proceedings in its courts.

Before you start proceedings, please contact support@voicevora.com so that we can try to resolve the dispute informally.

If we provide a translation of these terms, the English version prevails.

23. Changes to these terms

We may update these terms, for example to reflect changes to the Service, the law or our providers’ requirements. We will publish the updated terms on this page with a new effective date.

If a change is material, we will tell you by email or in the Service at least 15 days before it takes effect. Changes take effect on the date stated, except that changes required by law, or that concern new features, may take effect immediately. If you do not agree to a change, cancel before the change takes effect. If you cancel before a material change takes effect, the previous terms continue to apply to you until the end of your current billing period, except for changes required by law. Otherwise, if you keep using the Service after the change takes effect, the updated terms apply to you.

24. General terms

• Entire agreement and order of precedence. These terms, including our acceptable use rules, data processing terms and refund policy, together with the plan and price details shown at checkout for your orders, are the whole agreement between you and us about the Service and replace any earlier agreement on the subject. If they conflict, this order applies: (1) a separate written agreement signed by both of us; (2) our data processing terms in Customer Data and data processing, for the processing of personal data, except that the exclusions and limits in Limitation of liability also apply to them; (3) the rest of these terms; and (4) the plan and price details shown at checkout, which prevail only on price, Credits and billing period. Our Privacy Policy is a notice that explains how we handle personal data. It is not part of this agreement, except for the list of sub-processors under Service providers and the security measures under How we protect information, which form part of our data processing terms. We will not reduce the overall level of protection those security measures give your Customer Data. Other references to the Privacy Policy in these terms are for information only. Third-party terms and policies that these terms mention, such as carrier, Google, Meta and Paddle terms, apply between you and those third parties, or as these terms say.
• Assignment. You may not transfer these terms without our written consent. We may transfer them to a successor to our business, and we will tell you if we do. Google user data is transferred only after we obtain your explicit prior consent. Text messaging opt-in data and consent are never transferred to any third party, as our Privacy Policy explains.
• Subcontractors. We may use subcontractors and service providers to deliver the Service, and we remain responsible for our obligations under these terms.
• Events beyond our control. Neither party is liable for a failure or delay caused by events beyond its reasonable control, such as outages at carriers or at cloud or AI providers, internet failures, natural disasters, war or government action. This does not excuse your obligation to pay Fees.
• Notices. We will send notices to the email address on your account or show them in the Service. Send notices to us at support@voicevora.com.
• Electronic communications. You agree to receive communications from us electronically.
• Relationship. We are independent contractors. These terms do not create a partnership, employment or agency relationship.
• Third parties. These terms give no rights to anyone other than you and us.
• Export controls and sanctions. You confirm that neither you nor any of your Users or Clients is named on, or owned or controlled by anyone named on, a sanctions list of the United Nations, the European Union, the United Kingdom or the United States, or is located in, or ordinarily resident in, a country or region subject to comprehensive sanctions under those laws. You must comply with the export control and sanctions laws that apply to your use of the Service, and you must not use the Service for, or make it available to, any such person or place. Because our providers are bound by those laws, we may suspend or end the Service immediately if this confirmation stops being true.
• Severability and waiver. If any provision is unenforceable, the rest of these terms remains in effect, and that provision applies to the extent it can. If we do not enforce a provision, that is not a waiver.
• Partner Program. If you take part in the Vora Partner Program, its own Partner Program terms govern your participation in it, and these terms govern your use of the Service.

25. Contact

For questions about these terms, support, refunds, privacy and data requests, deletion requests, abuse reports and legal notices, email support@voicevora.com.

For sales inquiries, email sales@voicevora.com.

For questions about an order or a payment, you can also contact Paddle, our Merchant of Record, using the details in your receipt.