Privacy Policy

This policy explains what information Prosodi collects, why we collect it, who we share it with, and what you can do about it. Prosodi is operated by 17798415 Canada Inc. (“Prosodi”, “we”, “us”), a company incorporated in Canada.

Prosodi builds and operates voice AI agents that answer telephone calls on behalf of businesses. This policy covers the Prosodi website at https://prosodi.ai, the Prosodi dashboard, including when an agency offers it under its own brand or domain, and the voice agents we run for our customers.

This policy explains our practices; it is not a contract and gives no contractual rights. Our Terms of Service govern the use of Prosodi.

1. Our role

In this policy, “our customers” means the agencies that use Prosodi and the client organizations they offer it to. We handle personal information in two different roles:

• For our own purposes, we decide how we handle the information of people who visit our website, contact us, or have a Prosodi account, and the information we need to bill, support and secure the service.
• On behalf of our customers, we process the information that goes through their voice agents: calls, recordings, transcripts, callers’ details and the documents they upload. The agency, or the agency’s client, decides why and how that information is used, and we process it on their instructions. We may also use it, once de-identified, to improve Prosodi (section 5).

Prosodi is white-label: agencies offer it to their clients under their own brand, so you may call a business, or use a dashboard an agency gives you, without seeing our name. If so, that business’s or agency’s privacy notice explains how it handles your information, and it is responsible for its own practices.

2. Information we collect

Account information

When you create a Prosodi account we collect information such as your name, email address and profile picture. If you sign in with Google, we receive these from your Google Account rather than asking you to type them. We also keep your role, the agency or organization you belong to, and the settings you choose. If an agency or a client invites you, it gives us your name and email address.

Billing information

When an agency subscribes or adds funds, our payment processor collects its payment details. We may receive limited information from it, such as the billing name and address, the card type and its last four digits, and the payment history. We never receive full card numbers.

Verification information

When we ask an agency to verify its identity, its business or how it uses Prosodi, as our Terms of Service allow, we collect the information it gives us for that, such as the business’s legal name, registration details, address and website, the name and role of the person acting for it and, where we need it, an identity document.

Usage, device and log information

When you use the website or the dashboard, we and our providers automatically collect information such as your IP address, browser and device type, the pages you visit, the date and time, and errors. The dashboard also records security and audit events, such as sign-ins and changes to settings, with the IP address and browser they came from.

Cookies and analytics

The dashboard uses cookies and similar browser storage that it needs to sign you in, keep you signed in and protect your session. You can block or delete cookies in your browser settings; the dashboard does not work without its necessary cookies. We do not currently respond to browsers’ “Do Not Track” signals.

The website uses Google Analytics only if you agree to it. Until you click “Accept” in the website’s cookie banner, the website loads no Google Analytics code and sets no analytics cookies. If you accept, Google Analytics sets cookies that tell us how visitors find and use the website, such as which pages they view, and Google handles that information under its own privacy policy. The website keeps your choice, whether you accept or decline, in a cookie for 12 months, then asks again. You can withdraw your consent at any time through the “Cookie settings” link at the bottom of the website: Google Analytics then stops at once, and its cookies are deleted.

Data from Google APIs

If you connect a Google Account, we access only the data covered by the scopes you consent to. Those scopes, and what we do with each, are listed in full in section 3.

Call data

When a caller reaches an agent we operate, or an agent calls someone, we process information such as the following on behalf of the business the agent works for:

• the call audio, as the call happens, so the agent can hold the conversation;
• a recording of the call, where the business has turned recording on;
• a transcript of the conversation, and summaries and evaluations of the call made from it, where the business has turned transcripts on;
• the caller’s phone number and metadata such as the time, length and outcome of the call;
• what the caller tells the agent, such as their name, contact details, the reason for the call and any message they leave.

Recording and transcripts are both off unless the business turns them on.

Callers can say anything during a call, so call data can include any kind of personal information, including sensitive information such as health or financial details, even where our Terms of Service do not allow the business to collect it.

This is what allows the agent to hold the conversation, and it is what our customers review afterwards in their dashboard. When a call comes from a phone number that is shown, the caller is saved as a customer record of that business, with the details the agent collected, so the business can recognise them on later calls. Where the business has turned it on, we also keep a copy of the audio sent for speech recognition, to diagnose recognition problems. An agent can also send call details to the business’s own systems, or to services it chooses, through tools the business sets up.

Agents and documents

We store what our customers put into Prosodi to set up their agents, such as instructions, greetings, documents uploaded to a knowledge base, tools and phone numbers.

Demo requests and the waitlist

When you request a demo or join our waitlist on this website we collect your name, your work email address, your agency’s name and website, and what you tell us about your agency: its monthly revenue range, the tools it uses today, what it needs from Prosodi, and any notes you add. We use this only to prepare for your demo, to tell you when you can start using Prosodi, and to follow up with you about it. It is stored in our database, where only the Prosodi team members with administrator access can see it, and it is encrypted at rest. A demo request is also sent to our team by email.

Launch program applications

When you apply for our launch program on this website we collect your name, your work email address, your LinkedIn profile if you give it, your role, your agency’s name, website and country, its team size, how many paying clients it has, its monthly revenue range, the voice AI platform it uses today, what it sells and to whom, what it needs from Prosodi, the call minutes it expects, when it could start, how you heard about us, and any notes you add. We use it only to review your application and to contact you about the program. It is stored in our database, where only the Prosodi team members with administrator access can see it, and all of it except the country is encrypted at rest. When an application arrives, our team receives an email notice that contains none of your details.

Information from other sources

We also receive information about you from others, such as the agency or client that invites you, Google when you sign in with it or connect it, our payment processor, providers that help us verify businesses and prevent fraud, and public sources such as business websites and directories.

Other information you give us

We also collect any other information you choose to give us, for example when you contact us, ask for support, answer a survey or meet our team.

3. Google user data, scope by scope

We request the narrowest set of scopes that lets the agent do its job. This table is the complete list of what we ask for.

We do not read, index, or store the contents of your calendar beyond what is needed to answer the availability question in front of us and to write the booking a caller asked for. We never access Gmail, Drive, Contacts, or any other Google service.

4. Limited Use disclosure

Prosodi’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we confirm that:

• We use Google user data only to provide and improve the features you connected your account for — checking availability and managing bookings on your calendar.
• We do not transfer or sell Google user data to third parties for advertising, market research, or any purpose unrelated to the features above.
• We do not allow humans to read Google user data except where you have given explicit consent, where it is necessary for security purposes or to comply with the law, or where the data has been aggregated and anonymised.

5. Artificial intelligence and machine learning

Prosodi is a voice AI product, so we want to be unambiguous about this: we do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not permit our service providers to do so either.

Calendar availability and booking details are passed to a language model during a live call solely to conduct that call — for example, to say out loud which times are free, or to confirm the appointment just booked. That processing happens at the moment of the call and is not retained by the model provider for training.

More generally, we may use call audio, recordings, transcripts and the documents our customers upload to develop and improve Prosodi’s own features, such as speech recognition, turn-taking, handling interruptions and response times, including by training and evaluating the AI models behind them. We do this only with information we have de-identified, so that it no longer identifies the caller, the business or anyone else, and never with data obtained from Google APIs. Our AI providers receive call information to perform their part of each call, such as recognising speech, generating the agent’s replies and speaking them. Some of them may also use it to improve their own models and services, under their own terms. Where an agency connects its own AI provider account, that provider handles the information under the agency’s own agreement with it.

6. How we use information

We use the information we collect to:

• provide and operate Prosodi, including running calls and showing our customers their data;
• create and manage accounts, and verify who is signing in;
• bill for the service, take payments and collect amounts owed;
• answer questions, provide support, and send service messages about accounts, security and changes to Prosodi;
• keep Prosodi secure, and prevent, detect and investigate fraud, abuse and breaches of our Terms of Service;
• understand how Prosodi is used and improve it, using usage information and aggregated or de-identified information;
• tell business contacts about Prosodi, as the law allows; you can unsubscribe from these messages at any time;
• comply with the law, respond to lawful requests, and protect our rights and those of others;
• for any other purpose you agree to.

We use the call data and documents we process for our customers to provide Prosodi to them, on their instructions, to keep the service secure and prevent abuse, to comply with the law, and, once de-identified, to improve Prosodi as section 5 describes.

7. How we store and protect your data

Data is encrypted at rest, and in transit between your browser and our systems. Phone calls also travel over the telephone network, which is not encrypted from end to end. The only Google credential we store is a long-lived refresh token, which is encrypted in our database and used to obtain short-lived access tokens as needed. Access tokens are held in memory for the life of a request and never written to disk.

Access to production systems is restricted to the Prosodi personnel who need it to operate the service, and is logged.

Prosodi team members with administrator access can see account and usage information across the service, as their work requires, so that we can run, bill, support and secure it. They are bound by confidentiality obligations.

We do not listen to calls or read transcripts as a matter of course. Authorized personnel may access call data when a customer asks us to, for example for support, when needed to investigate a security incident or abuse, or when the law requires it, and may work with de-identified call data to improve Prosodi (section 5).

No method of sending or storing information is completely secure, and we cannot guarantee the security of your information. If a breach of our security safeguards affects personal information, we notify the people and regulators concerned as the law requires, or the customer we process it for.

We do not hold any certification, attestation or audit report for any security, privacy or compliance standard or law, including SOC 2, ISO/IEC 27001, HIPAA, PCI DSS, the GDPR, PIPEDA or Quebec’s privacy law. Where we say that Prosodi is designed around or aligned with a standard or law, we describe what we aim for, not a certification or a promise of compliance.

8. Who we share data with

We do not sell personal information and we do not share it for advertising. We share it only as described below.

Service providers

Service providers process personal information on our behalf to operate the service. They fall into these categories:

• Cloud hosting and database providers — where the data is stored.
• Telephony and real-time audio providers — which carry the call itself.
• AI model providers— which recognise speech, generate the agent’s side of the conversation and speak it while the call is happening, and summarise calls afterwards.
• Knowledge retrieval providers — which index the documents a customer uploads so the agent can answer from them.
• Email providers — for account and service notifications, and to deliver demo requests to our team.
• Payment processors — which take payments from agencies.
• Analytics providers — which measure how visitors use our website.

Of these, only our cloud hosting, real-time audio, and AI model providers can receive data obtained from Google APIs, and only for as long as the call that uses it is in progress.

Telephone carriers, payment processors and some AI providers also use some of this information for their own purposes, such as routing and billing calls, preventing fraud, improving their own models and meeting their legal obligations, under their own privacy policies.

The companies that handle personal information for us when we provide the service to our customers are named in our sub-processor list, with what each one does and where.

Agencies and their clients

Call data and customer records are visible to the agency and to the client organization they belong to, according to the access each sets. If you have an account in a client’s workspace, the agency that runs it can see your account details and activity.

Services our customers connect

Where an agency or a client connects its own accounts or services, such as its own AI provider, storage or email account, or a tool that sends call details to another system, we send that service the information the setup requires. That service handles it under its own terms and the customer’s agreement with it.

Other disclosures

We may also disclose information where we are legally required to, or to protect the rights and safety of Prosodi, our customers, or the public. If we are involved in a merger, acquisition, financing or sale of all or part of our business, personal information may be transferred as part of it, under this policy or one that protects it as much. We may share aggregated or de-identified information that does not identify anyone, and we share personal information in other ways when you ask us to or agree to it.

9. Retention and deletion

We keep personal information for as long as we need it for the purposes described in this policy, and longer where the law requires or allows it, as described below.

A Google Calendar connected to a workspace can be disconnected from the workspace’s Integrations page. When it is, we ask Google to revoke our access, and we delete the stored credential, the connected account’s email address and the agents’ links to that calendar. Events already written to the calendar remain there.

Signing in with Google gives us no ongoing access to your Google Account, and we store no Google credential for it. We keep your Google Account’s identifier and the link to your profile picture with your account information, as described below.

We keep account information for as long as your account is active, and usage, device and log information for as long as we need it to run, secure and improve Prosodi. We keep call data until the agency or client deletes it, one of its retention settings removes it, or its account ends. Your data can be deleted on request: write to privacy@prosodi.ai. Deleted data stays in our backups until they age out on our normal backup cycle.

We may keep some information longer where we need it to meet legal, tax or accounting obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements, and we may keep aggregated or de-identified information that identifies no one.

We keep the record of which version of our terms, of this policy or of an agency’s own terms and privacy notice each account and agency agreed to or was shown, with the IP address and browser it came from, as evidence of that agreement, including after the account or agency is closed.

A demo request or waitlist entry is kept in our database, and a demo request also in our team’s email. It can be deleted on request: write to privacy@prosodi.ai.

A launch program application is kept in our database. It can be deleted on request: write to privacy@prosodi.ai.

You can also revoke Prosodi’s access directly from your Google Account at myaccount.google.com/permissions.

10. International transfers

Prosodi is based in Canada. We store and process personal information mainly in the United States, and our service providers may process it in Canada, the United States and other countries. This includes information about people in Quebec, which may be communicated outside Quebec. The laws of those countries may protect personal information differently from yours, and their courts and authorities may be able to access it. Where personal information is transferred outside your country, we rely on contracts and other safeguards, including standard contractual clauses where they apply.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, to withdraw your consent, and to object to or restrict some uses of it. Canadian residents have these rights under PIPEDA and, in Quebec, under Quebec’s privacy law; residents of the EEA and the UK have them under the GDPR; residents of some US states have them under their state’s privacy law. To exercise any of them, email privacy@prosodi.ai. We respond within 30 days of receiving your request, or tell you within those 30 days that we need more time, where the law allows it.

We may ask you to confirm your identity before we act on a request, and someone acting for you must show that you authorized them. Where the law allows, we may decline a request, for example when we must keep the information by law or when it would reveal someone else’s information, and we will tell you why. If we decline, you can ask us to reconsider by writing to privacy@prosodi.ai with “Privacy appeal” in the subject line, and we answer within 45 days. We will not treat you differently for exercising your rights. If you are still not satisfied, you can complain to the privacy regulator where you live, such as the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Where Prosodi operates an agent on behalf of a business customer, that customer is the controller of the call data and we act as their processor. If your request concerns a call you made to a business using Prosodi, we will refer you to that business or handle it on their instructions.

You can unsubscribe from our marketing emails at any time with the link in each one. We still send service messages about your account for as long as you have one.

12. Automated processing

Voice agents use AI to understand callers and to respond to them. We do not use them to make decisions about anyone that have legal or similarly significant effects. The businesses that use Prosodi decide how they use their agents and the results; if one makes a decision about you based only on automated processing, that business is responsible for telling you and for handling your requests about it as the law requires.

13. Children

Prosodi is a business product and is not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes. Anyone can call a business that uses Prosodi; the business is responsible for information its agents collect from callers, whatever their age.

14. Other websites and services

Our website, the dashboard and agents may link to or connect with websites and services that we do not operate. This policy does not cover them, and we are not responsible for their privacy practices. Read their privacy policies.

15. Changes to this policy

We may change this policy at any time. We publish the changed policy on this page and update the effective date at the top, which identifies the version. Each version stays available at its own address on this site, such as prosodi.ai/privacy/2026-11-12 for this one. A change takes effect on that date unless we say otherwise. If the change is significant, we will also tell account holders by email or in the dashboard, where practical before it takes effect.

This policy explains how we handle personal information. It is not a contract, and we do not ask you to agree to it. When you create an account, the sign-up page asks you to confirm that you have read the privacy notice it links to (this policy, or the privacy notice of the agency whose service you are joining), and we record which version you were shown, when, and the IP address and browser it came from. If a change would have us use your personal information for a new purpose that needs your consent, we will ask for that consent separately.

16. How we govern personal information

These are the rules we follow to protect personal information from the time we collect it until it is destroyed. Our Privacy Officer (section 17) has approved them.

Who is responsible

Our Privacy Officer is responsible for these rules and for making sure we follow them. The Privacy Officer approves what Prosodi collects and which service providers receive it, answers privacy requests and complaints, leads our response to security incidents and keeps our register of them, and makes sure everyone at Prosodi who handles personal information knows these rules.

The people who build and run Prosodi may collect, use and share personal information only as this policy describes. Only those who need access to production systems to operate the service have it. Their access is logged, and each of them is bound by confidentiality obligations. Anyone at Prosodi who sees a problem with how personal information is handled must report it to the Privacy Officer at once.

Keeping and destroying information

Section 9 says how long we keep each kind of information. When that time ends, or when we accept a request to delete information, we delete it from our database and our file storage. For call data this happens automatically: our systems delete recordings, transcripts and customer records once they pass the period the agency or client has set. Copies in our backups are overwritten on our normal backup cycle.

Complaints

If you believe we have mishandled your personal information or have not followed this policy, write to privacy@prosodi.ai and tell us what happened. Our Privacy Officer looks into every complaint and answers in writing within 30 days, saying what we found and what we did about it. If your complaint concerns a call with a business that uses Prosodi, we will refer you to that business or handle the complaint on its instructions. Making a complaint is free, and we will not treat you differently for making one. If our answer does not satisfy you, you can complain to the privacy regulator where you live (section 11).

17. Contact us

Questions about this policy, or about the personal information we hold about you, go to privacy@prosodi.ai. Our Privacy Officer, the person in charge of protecting personal information at Prosodi, is our Chief Executive Officer, who can be reached at that address.