Privacy Policy

1. Introduction & Who We Are

Voice2Work ("Voice2Work," "we," "us," or "our") is a field service management (FSM) SaaS platform built exclusively for appliance repair shops. We provide a web application at app.voice2work.com and companion mobile applications for iOS and Android (collectively, the "Service").

This Privacy Policy explains how Voice2Work collects, uses, stores, shares, and protects personal information about users of our Service — including shop owners, office staff, and field technicians who use the platform, as well as end-customers whose information is entered into the system by our business customers ("Shops").

By accessing or using the Voice2Work Service, you acknowledge that you have read and understood this Privacy Policy. If you are a Shop using our platform, you are also responsible for ensuring your own customers and technicians are informed about how their data is processed within your Voice2Work account, as described below.

Data Controller / Developer Contact:
Voice2Work, Inc.
Email: hello@voice2work.com
Privacy inquiries: privacy@voice2work.com

2. What Data We Collect

Voice2Work collects the following categories of personal and operational data:

2.1 Account Data

When you create a Voice2Work account, we collect:

• Full name
• Business email address
• Business name and address
• Phone number
• Job role or title within the shop (e.g., owner, dispatcher, technician)
• Password (stored as a one-way cryptographic hash — we cannot retrieve your plain-text password)

2.2 Job & Customer Data

The core function of Voice2Work is to help Shops manage appliance repair jobs. When Shops create and manage jobs, the following customer and job data is processed:

• End-customer names
• End-customer physical addresses (for service calls)
• End-customer phone numbers
• Appliance brand, model number, and serial number
• Repair notes, diagnostic notes, and technician observations
• Job history, status updates, and timestamps
• Labor charges, parts used, and invoice amounts
• Warranty claim information (including manufacturer warranty data)

Voice2Work acts as a data processor for this category of data. The Shop (our customer) is the data controller for their end-customers' personal information. We process it solely to provide the Service.

2.3 Calls, Texts & Voicemail Data

When a Shop uses Voice2Work for calls and texts with its customers, including Vera, the AI phone answering module, we process:

• Phone numbers of the people who call and text the Shop, and of those it calls and texts
• The content of texts the Shop's team and its customers exchange, and of automatic texts sent on the Shop's behalf (e.g., appointment updates, technician-on-the-way messages, Estimates, Invoices, and receipts)
• Call records: who called whom, when, for how long, and how the call ended
• Call recordings and voicemails (audio), and the transcripts and summaries of calls Vera answers
• Records of a customer agreeing to receive texts, and STOP and HELP replies
• Delivery status and timestamps

Calls and texts are carried by Twilio, and Vera's calls by Vapi (see Section 5 for full disclosure). Call recordings and voicemail audio are deleted after 90 days (Section 7). We maintain opt-out records to honor STOP requests in compliance with TCPA and carrier requirements.

Moving a phone number to Voice2Work. When a Shop moves an existing phone number to Voice2Work, the account number, transfer PIN, and bill it provides are sent to Twilio to request the move, and Voice2Work does not keep them. We keep the name on the account, the service address, and the name and email of the person who signs the transfer form with the request.

2.4 Images (Appliance Nameplates / OCR)

Users may upload or capture photographs of appliance nameplates to automatically extract model and serial numbers using Optical Character Recognition (OCR). We process:

• Photos of appliance nameplates captured via the mobile app camera or uploaded from device storage
• Extracted text (model number, serial number, manufacturer data)

Mobile nameplate photos are sent to OpenAI for equipment-data extraction only after the mobile AI permission check. A photo may also be saved as an ordinary Job attachment. The mobile choice and provider processing are explained in sections 2.8 and 5.

2.5 Location Data (Technician GPS)

The Voice2Work mobile app may request access to your device's GPS location for the purpose of dispatch routing and technician tracking. Specifically:

• GPS coordinates of field technicians are collected only while the mobile app is actively in use (foreground use only)
• We do not collect background location data when the app is not in use
• Location data is used exclusively for: (a) routing technicians to job sites, and (b) displaying technician positions on the dispatch board for dispatchers and shop owners
• Location data is displayed in real time to authorized users of the same Shop account and is not shared externally

You may deny location permission at any time in your device settings. Denying location permission will disable GPS-based dispatch features but will not affect core job management functionality.

2.6 Payment & Billing Data

When subscribing to Voice2Work or accepting customer payments through the platform:

• Subscription billing information is collected by Stripe, our payment processor (see Section 5). Voice2Work does not store, log, or have access to full credit card numbers, CVV codes, or bank account numbers at any time.
• We receive from Stripe: a payment confirmation token, last four digits of a card (for display purposes), card brand, and billing email address.
• Invoice records (amounts, dates, subscription tier) are stored within our platform for accounting and support purposes.

2.7 Usage & Analytics Data

We collect anonymized and pseudonymized data about how the Service is used in order to improve performance and user experience:

• Page views and feature interaction events (e.g., which screens are used most frequently)
• Session duration and navigation flows
• Device type, operating system version, and browser type
• App crash reports and error logs
• IP address (used for session management and fraud prevention; not linked to individual analytics profiles)

Analytics are collected through Posthog or a similar privacy-respecting analytics platform configured to anonymize user identifiers (see Section 5).

2.8 AI Processing Data

AI processing can include recordings, typed text, photos, relevant Job and customer records, and conversation context. This material may contain customer names, addresses, phone numbers, email addresses, or other personal information. We do not claim that all AI inputs are anonymous.

For AI actions you start in the mobile app, Voice2Work asks for permission before sending this information to OpenAI and Anthropic for transcription, extraction, answers, or image analysis. You may decline and continue manually, and change your choice under Privacy & Security > AI processing. The choice is specific to you and your company workspace. A material change in recipients, data categories, or purposes requires a new choice.

This permission controls personal mobile AI actions. It does not change the web application's permission behavior or company-run background automations, which are managed separately. Turning it off blocks new mobile AI requests; it cannot recall information already sent or delete ordinary saved Job records.

3. How We Collect Data

Voice2Work collects data through the following mechanisms:

3.1 Direct Input

The majority of data in Voice2Work is entered directly by users (shop owners, dispatchers, technicians) when creating accounts, logging jobs, recording repair notes, or adding customer records. We collect what you and your team type, select, or upload into the platform.

3.2 Mobile App Permissions

The Voice2Work mobile app (iOS and Android) may request the following device permissions:

• Camera: To photograph appliance nameplates for OCR-based data extraction. The camera is accessed only when you initiate a photo capture within the app.
• Photo Library / Media Access: To select and upload photos from your device's camera roll (e.g., appliance photos, before/after repair images attached to job records).
• Location (When In Use): To provide GPS dispatch routing for technicians. We request "when in use" permission only — not "always on" background location.
• Push Notifications: To send job alerts, technician assignments, and status updates to your device. You may disable push notifications at any time in your device settings.

All permission requests include an in-app explanation of the purpose before the system dialog is displayed. You may deny or revoke any permission at any time without losing access to unrelated features of the app.

3.3 Automated Collection

When you use the Service, we automatically collect certain technical data: server logs (IP address, request timestamps, HTTP status codes), session tokens, and analytics events. This data is collected to maintain service availability, security, and to improve the product.

3.4 Third-Party Services

Some data is received from third-party services that are integrated into Voice2Work (e.g., payment confirmations from Stripe, delivery receipts from Twilio). We do not purchase data from data brokers or third-party marketing databases.

3.5 Cookies & Similar Technologies

The Voice2Work web application uses session cookies and local storage tokens strictly for authentication and session management. We do not use third-party advertising cookies or cross-site tracking cookies. Analytics may use a first-party identifier stored in the browser to measure product usage patterns; this identifier is anonymized and does not link to any personally identifiable information.

4. How We Use Your Data

We use the data we collect for the following purposes, each with a corresponding legal basis under applicable law:

We do not use your data for:

• Selling or renting personal information to third parties
• Targeted or behavioral advertising
• Building profiles for data broker resale
• Training AI models on your proprietary job data or customer data without explicit consent

5. Third-Party Services & AI Disclosure

Voice2Work integrates with the following third-party services. Where we share personal or operational data with these services, the data is shared solely for the disclosed purpose and governed by each provider's privacy practices and, where applicable, data processing agreements with Voice2Work. We only work with providers that maintain strong privacy and security standards.

All third-party providers listed above have executed Data Processing Agreements (DPAs) with Voice2Work where required under GDPR. We regularly review our subprocessors to confirm that their privacy and security practices remain adequate.

6. Data Sharing

Voice2Work shares personal data only in the following circumstances:

6.1 Subprocessors

As described in Section 5, we share data with service providers (Twilio, Vapi, Stripe, AWS, OpenAI/Anthropic, Posthog) who help us operate and deliver the Service. These providers act as data processors on our behalf and are contractually prohibited from using your data for any purpose other than providing their designated service to us.

6.2 Within Your Organization

Data entered into a Shop's Voice2Work account is accessible to all authorized users within that Shop account (subject to any role-based access controls the Shop owner configures). Voice2Work does not merge data between separate Shop accounts.

6.3 Legal Requirements

We may disclose personal data to law enforcement, government authorities, or other parties when we believe in good faith that disclosure is required by applicable law, court order, subpoena, or legal process; or when necessary to protect the rights, property, or safety of Voice2Work, our users, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, personal data may be transferred to a successor entity. We will provide notice (via email or prominent in-app notice) before your personal data is transferred and becomes subject to a different privacy policy.

6.5 With Your Consent

We will share data for any other purpose only with your explicit, informed consent.

7. Data Retention

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy, subject to the following standards:

When the applicable retention period expires, data is either securely deleted or anonymized so that it can no longer be linked to any individual. Deletion is performed using industry-standard secure erasure procedures on both primary storage and all backups within 90 days of the deletion date.

8. Data Security

Voice2Work implements a defense-in-depth security posture appropriate for a B2B SaaS platform handling sensitive business and customer data. Our security measures include:

8.1 Encryption

• Encryption in transit: All data transmitted between your device and Voice2Work servers is encrypted using TLS 1.2 or higher (HTTPS/WSS). We enforce HSTS (HTTP Strict Transport Security) on all web endpoints.
• Encryption at rest: All databases, file storage, and backups are encrypted at rest using AES-256 encryption managed by AWS.
• Password storage: Passwords are never stored in plain text. They are hashed using bcrypt with a per-user salt prior to storage.

8.2 Access Controls

• Role-based access control (RBAC) ensures that platform users can only access data appropriate for their assigned role.
• Voice2Work employees and contractors access production data only through audited, authenticated, and least-privilege administrative channels. Access is logged and reviewed.
• Customer data is logically isolated by Shop account — one Shop cannot access another Shop's data.

8.3 Infrastructure Security

• All infrastructure is hosted on Amazon Web Services, which is certified to ISO 27001, SOC 2 Type II, PCI DSS, and other security standards.
• Network-level protections include firewalls, VPC isolation, and DDoS mitigation.
• Automated vulnerability scanning and dependency audits are performed on a regular schedule.

8.4 Incident Response

In the event of a security breach that affects personal data, Voice2Work will notify affected users within 72 hours of discovery, consistent with GDPR Article 33 and applicable US state breach notification laws. Notifications will include the nature of the incident, data affected, steps taken, and recommended user actions.

While we implement strong security measures, no system is 100% immune to risk. We encourage users to use strong, unique passwords and enable any multi-factor authentication (MFA) options available within the platform.

9. Your Rights (GDPR / CCPA / General)

Depending on where you are located, you may have the following rights regarding your personal data. Voice2Work honors these rights for all users regardless of jurisdiction.

9.1 Rights Available to All Users

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that inaccurate or incomplete personal data be corrected.
• Right to Deletion ("Right to be Forgotten"): You may request that we delete your personal data, subject to retention obligations required by law (e.g., tax records).
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Right to Object: You may object to processing of your personal data for legitimate-interest purposes (including analytics). We will honor objections unless we have a compelling legal basis to continue.
• Right to Restrict Processing: In certain circumstances, you may request that we limit how your data is used while a dispute or request is being resolved.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., GPS location access), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.

9.2 California Residents (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: The right to know what personal information we collect, use, disclose, and sell.
• Right to Delete: The right to request deletion of personal information we have collected from you.
• Right to Opt Out of Sale or Sharing: Voice2Work does not sell personal information and does not share personal information for cross-context behavioral advertising. There is nothing to opt out of. We have not sold or shared personal information in the preceding 12 months.
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined by the CPRA, we use it only for the purposes described in this policy and do not use it to infer characteristics about you.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

9.3 EU / UK Residents (GDPR) — Lawful Basis for Processing

If you are in the European Economic Area or United Kingdom, your rights are governed by the General Data Protection Regulation (GDPR) or UK GDPR respectively. Our lawful bases for processing personal data are: (a) contract performance — processing is necessary to deliver the Service you have subscribed to; (b) legitimate interests — we have a legitimate interest in improving our product and maintaining security, which we have weighed against your rights and found proportionate; (c) compliance with legal obligations — certain processing is required by applicable law (e.g., financial record-keeping); and (d) consent — for location data, camera access, and certain optional communications, where you have given explicit, informed permission that you may withdraw at any time.

You have the right to lodge a complaint with a data protection supervisory authority if you believe your rights have been violated. In the EU, this is the authority in your country of residence.

9.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

Email: privacy@voice2work.com

Please include your name, email address associated with your Voice2Work account, and a description of your request. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request to protect against unauthorized access to your data.

10. Children's Privacy (COPPA)

Voice2Work is a business-to-business (B2B) SaaS platform intended exclusively for use by appliance repair shop operators, technicians, and business staff. The Service is not directed at children under 13 years of age, and we do not knowingly collect personal information from children under 13.

We do not believe it is likely that a child under 13 would use our platform given its exclusive focus on professional appliance repair business operations. However, if we discover that we have inadvertently collected personal information from a child under 13, we will delete that information promptly.

If you are a parent or guardian and believe that your child has provided personal information to Voice2Work, please contact us at privacy@voice2work.com and we will take immediate steps to delete the information and terminate any associated account.

This policy is consistent with the Children's Online Privacy Protection Act (COPPA) requirements applicable to operators of online services in the United States. Voice2Work is not required to comply with COPPA's opt-in consent requirements because our Service is not directed at children and we do not knowingly collect data from children.

11. Mobile App — Special Disclosures

The Voice2Work mobile app (available on iOS via the Apple App Store and Android via Google Play) includes features that interact with device hardware and system-level capabilities. The following disclosures apply specifically to the mobile app:

11.1 SMS Usage

Texts a technician sends in the Voice2Work mobile app, and customer notifications, are sent server-side through Twilio from the Shop's business number. When the Shop has no business number, or the technician chooses to text from their own phone, the app's Text button opens the device's own messaging app with the customer's number filled in instead: the technician sends that text from their phone, through their own carrier, and Voice2Work does not see or keep it. The app does not read your personal SMS messages or inbox, nor does it request access to your device's SMS/messaging history. The READ_SMS, SEND_SMS, or RECEIVE_SMS Android permissions are not requested by Voice2Work.

11.2 Camera & Photos

The app requests camera access solely to photograph appliance nameplates for OCR-based model/serial extraction, and to capture job-site photos that technicians may attach to job records. The app requests photo library access solely to allow selection of existing photos to attach to job records. Photos are uploaded to secure Voice2Work servers (hosted on AWS S3 with encryption at rest and in transit). We do not perform facial recognition or biometric analysis on any photos. Photos attached to job records are retained as part of the job record per the retention schedule in Section 7.

11.3 Location Services

The app requests "When In Use" location permission to support GPS-based dispatch — specifically, to display technician locations on the dispatch board and to assist with routing. We explicitly request "When In Use" (foreground) location only, never "Always" (background) location. Location data is not shared with third parties and is only visible to authorized users of the same Shop account (e.g., the shop owner and dispatchers). You can revoke location permission at any time via your device settings (iOS: Settings → Privacy & Security → Location Services → Voice2Work; Android: Settings → Apps → Voice2Work → Permissions → Location). Revoking location will disable GPS dispatch features but will not affect other app functionality.

11.4 Push Notifications

The app may request permission to send push notifications. These are used exclusively for operational alerts: new job assignments, status changes, customer messages, and urgent dispatch alerts. We do not send marketing or promotional push notifications without your explicit consent. You may disable push notifications at any time in your device's notification settings, or within the Voice2Work app under Notification Preferences.

11.5 Microphone

Voice2Work's voice-to-text features (Intake AI voice notes) may use your device microphone to capture voice input for transcribing job notes. Microphone access is requested only when you actively use a voice-input feature. Audio is transcribed in real time and is not stored as raw audio — only the resulting text transcript is retained. Voice2Work does not access the microphone at any other time.

11.6 Data Safety (Google Play) & App Privacy (Apple)

The information disclosed in this policy is consistent with Voice2Work's declarations in the Google Play Data Safety section and the Apple App Store App Privacy details. If you observe any discrepancy between this policy and the app store disclosures, please notify us at privacy@voice2work.com so we can correct the inconsistency promptly.

11.7 Consent Revocation

Any consent-based data processing (location, camera, microphone, push notifications) can be revoked at any time by:

• Adjusting permissions in your device settings (iOS: Settings → Privacy & Security; Android: Settings → Apps → Voice2Work → Permissions)
• Contacting us at privacy@voice2work.com to request that any data collected under revoked consent be deleted

12. Account Deletion

You have the right to delete your Voice2Work account and associated data at any time. Account deletion is handled as follows:

12.1 How to Delete Your Account

Account deletion can be initiated through any of the following methods:

• In-app (web): Log in to app.voice2work.com → Account Settings → Danger Zone → Delete Account.
• In-app (mobile): Open the Voice2Work mobile app → Profile → Account Settings → Delete Account.
• By email: Send a deletion request to privacy@voice2work.com from the email address associated with your account. Include "Account Deletion Request" in the subject line.

12.2 What Happens After Deletion

Upon account deletion:

• Your account credentials and profile data will be deleted within 7 days.
• All job records, customer records, and operational data associated with your Shop will be permanently deleted within 30 days.
• Backups containing your data will be purged within 90 days of the deletion request.
• Financial records (invoices, payment records) will be retained for 7 years as required by applicable accounting and tax law. These records will be stripped of non-essential personal identifiers wherever possible.
• You will receive an email confirmation once the deletion is complete.

12.3 Technician / Staff Accounts

If you are a technician or staff member (not the account owner), you may request deletion of your individual profile by contacting your Shop owner or by emailing privacy@voice2work.com. Shop owners can remove staff accounts through the Team Management settings.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational factors. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered account holders at the email address associated with their account, at least 14 days before the changes take effect
• Display an in-app banner notification for a period of at least 30 days following the update
• For changes that affect how we process data in ways that require consent, we will request explicit re-consent before the new processing begins

Non-material changes (such as typographical corrections, clarification of existing practices, or updated third-party links) may be made without advance notice, though the "Last Updated" date will always reflect the most recent revision.

Your continued use of the Voice2Work Service following the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms, to the extent permitted by applicable law. If you disagree with any material changes, you may delete your account as described in Section 12.

We maintain an archive of prior versions of this Privacy Policy. To request a copy of a prior version, contact privacy@voice2work.com.

14. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us using one of the following methods:

For GDPR-specific inquiries from EU or UK residents, please include "GDPR Request" in the subject line of your email. For CCPA requests from California residents, include "CCPA Request" in the subject line.

We take privacy concerns seriously and will work in good faith to address any issue you raise. If you are not satisfied with our response, you may have the right to file a complaint with your local data protection authority (in the EU) or the California Privacy Protection Agency (in California).