Privacy Policy

1. What we collect

• Account details: your name, email address and a password stored only as a bcrypt hash. We never see the password itself.
• Talk time: the seconds consumed per session, the agent you used, and the session start and end times. This is what your allowance is calculated from.
• Payment records: the gateway, the transaction reference the gateway gives us, the amount, the currency and the status. Card and wallet credentials never reach our servers.
• Content you create in the product, such as tasks you ask an agent to remember.
• Basic technical logs: IP address, browser type and error traces, kept to keep the service secure and working.

2. Microphone and audio

Your microphone is used only while a session is open, and only after your browser asks for permission. Audio is captured in the page, resampled, and streamed over an encrypted WebSocket to the speech model that answers you.

We do not store raw audio recordings. What we keep is the transcript text needed to show your conversation and to bill talk time correctly, plus the second counts.

3. Who processes data for us

• A speech and language model provider, which receives your audio stream and the agent prompt in order to generate a reply.
• bKash and Binance Pay, which process your payments and return a transaction status to us.
• Our hosting provider, where the application and database run.

4. Why we are allowed to process it

We process account and billing data to perform the contract you accepted, technical logs for our legitimate interest in keeping the service secure, and anything optional only with your consent, which you can withdraw.

5. How long we keep it

• Account data: while your account exists, then up to 30 days in backups.
• Conversation transcripts: 90 days by default.
• Talk-time records and payment receipts: kept while the account is open and for the period tax and accounting rules require afterwards.
• Security logs: 30 days.

6. Your choices

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or close your account. Write to the address at the bottom and we will respond within 30 days. Deleting an account removes transcripts and tasks; payment records we are legally required to keep stay in a restricted archive.

7. Cookies

We set one cookie, vs_session, which keeps you signed in. It is HTTP-only, so page scripts cannot read it, and it is marked SameSite=Lax so other sites cannot use it to act as you. We do not set advertising or cross-site tracking cookies, so there is no cookie banner to dismiss.

8. Security

• Traffic is encrypted with TLS in production.
• Passwords are hashed with bcrypt and never logged.
• Sessions expire after 12 hours.
• Payment webhooks are verified by signature before anything is credited.
• Database access is limited to the application account.

9. Children

The service is not intended for anyone under 18. If we learn that a child has created an account, we close it and delete the data.

10. Contact

For any privacy question, or to exercise a right above, email [email protected].