AI phone answering: a data-handling checklist

Before an AI receptionist takes a call for your business, you should know what it keeps about each caller, where that record goes, who can see it, how long it stays, which other companies touch it, and what happens when a caller asks for it to be deleted.

This checklist works for any AI phone-answering vendor. For Vocapable, the answers live on the Trust Center, the privacy policy and the data processing addendum; where those pages do not state something, this guide says so rather than filling the gap.

The checklist

Question to ask	Why it matters	Where Vocapable answers it
Is the whole call recorded or transcribed?	Audio is hardest to redact.	Receptionist page: no full-call recording
What does each call leave behind, and where does it go?	Nobody else should get it by default.	Receptionist page: inbox, signed webhooks, CSV, API
Who on our team can see caller details?	Not every login should see a gate code.	Trust Center: access by company and role; no role list published
Is our data separated from other customers’ data?	Shared software shares a database.	Trust Center and DPA section 2
How long is data kept, what survives deletion, and can we export it?	Retention is where vendors go vague.	Privacy policy, DPA section 4, Trust Center
Which other companies process our data, and where?	Another place for an incident.	DPA sections 3 and 6
Is our data used to train AI models?	The question buyers forget to ask.	Privacy policy: no foundation-model training
Does the AI tell callers it is an AI?	Callers share based on who is listening.	AI technology disclosure and AUP
How are sign-ins and credentials protected?	An account takeover exposes every record.	Trust Center: encrypted credential store; no second sign-in step described
What certifications, audits and breach notice exist?	A badge is not evidence.	DPA sections 2 and 5
What happens when a caller asks for deletion?	The request will come to you.	Privacy policy and DPA section 4

What is recorded, and what is not

The capability table on the receptionist page states that full-call recording is not part of the receptionist offer, and that every call leaves a record of what was asked and what was answered: the caller’s name and number, the request in the caller’s own words, and the fields you chose to ask for.

The legal pages cover the whole platform, including outbound products where recording can be configured: the privacy policy lists call audio and transcripts, where recording is enabled and the law allows it, among the categories collected on customers’ behalf, and the DPA names them as call data. The privacy policy also states that customer content and call recordings are not used to train foundation models; ask every vendor for the same sentence.

Where caller details go, and who sees them

When a call ends, the record lands in your team inbox and on your signed webhooks; CSV export and the API carry it onward. No named connector to a CRM or dispatch product exists and the receptionist writes to no calendar, so caller data reaches only the places you connect.

The Trust Center says workspace access should match the company and role a person actually needs; it publishes no list of roles or what each can read, so ask for one. On isolation, the Trust Center states that tenant-scoped records and database row-level security enforce the company boundary beneath the application, and the DPA lists row-level security, encryption in transit and at rest, credential vaulting, access logging and confidentiality obligations for personnel with access.

Retention, deletion and export

The privacy policy keeps account data for the life of the account plus two years, and service data, which includes call records, per customer configuration and the DPA. The DPA adds the deletion rule: on termination or a verified deletion request, personal information is deleted or de-identified within 60 days, with two carve-outs. Compliance evidence (consent, disclosure and opt-out records, attestations, per-call policy snapshots) is kept at least five years as the legal-defense record of both parties, and do-not-call suppression entries are kept indefinitely, since deleting one would cause the contact it exists to prevent. Deleted contacts are tombstoned so no new call can start to them.

On export, the Trust Center points you to supported exports and API resources; neither the privacy policy nor the DPA states an export window after termination, so export before closing an account.

Subprocessors and where data is processed

The DPA names the subprocessors: Amazon Web Services for hosting and storage, Twilio for telephony, Stripe for payments, xAI and other model providers as configured for language-model inference, and Resend for transactional email. Vocapable provides the current list on request, gives notice of additions and remains responsible for their performance. Bring your own Twilio account or model keys and that provider works under your own agreement, not as a Vocapable subprocessor. Processing takes place in the United States, for US businesses and US calling.

The privacy policy adds the boundaries: no sale or sharing of personal information as the CCPA defines those terms, no data brokers, and no sharing of information about the people its customers call.

The AI disclosure and the facts the receptionist uses

Every call opens with an AI disclosure, which the AI technology disclosure page calls a non-removable floor; the acceptable use policy prohibits configuring an agent to deny being an AI, claim to be human, or defeat or omit the disclosure.

The receptionist answers only from business information you approve: setup drafts those answers from your public website pages, you edit every one before it takes a call, and anything unapproved gets “I do not have that”. That review is your first defense. None of the linked pages uses the words prompt injection, so ask every vendor what happens when a caller, or a page the vendor read, tries to give the AI instructions. The AI technology disclosure also warns that the model can say something inaccurate even when its sources are correct, so decide where human review belongs.

Account access and certifications

The Trust Center states that provider credentials are encrypted in the credential store, and that API keys and other secrets belong in protected configuration, not in shared notes, support messages or client-side code. Neither it nor the legal pages describes a second sign-in step for customer accounts, so do not assume one exists; ask every vendor what protects a sign-in.

Vocapable holds no third-party security certification and says so: the DPA states that no third-party audit is represented to exist today and commits to sharing summaries if one does. The Trust Center offers evidence you can read rather than badges, and the DPA commits to breach notice without undue delay after confirmation.

Details that should not be collected on a call

Decide before launch what the receptionist will ask for. The acceptable use policy prohibits using the service to collect payment-card data or protected health information absent a separately executed plan that expressly permits it. Gate codes, alarm codes, medical details and card numbers belong with the person who returns the call, so leave them out of the fields the receptionist captures. A caller may still volunteer something in their own words, so decide who reads those records.

When a caller asks for their data to be deleted

Illustrative scenario: a caller left a callback request last month and now emails your office asking you to delete it. Under the privacy policy, the request belongs with the business that collected the information; Vocapable, as service provider, forwards any such request it receives to the responsible customer and assists. The DPA commits Vocapable to reasonable assistance with data-subject requests, and its deletion rule applies to a verified request: deletion or de-identification within 60 days, with the carve-outs above. The privacy policy also states that do-not-call requests are honored immediately and permanently on the platform, and that privacy requests to Vocapable itself go to support@vocapable.com with the subject “Privacy request”.