Draft · Pending counsel review

This document is a working draft. It is a legal document and must be reviewed and approved by counsel before it is published or relied upon. Highlighted [COUNSEL] markers flag the specific determinations that require counsel input.

Legal · Callio

Privacy Policy

Last updated: [COUNSEL: set the effective date on publication]

This Privacy Policy explains how Lyric Voices, Inc. (“Lyric”) collects, uses, and protects information in connection with Callio, its brand-voice governance product. It is written for the enterprise brands, agencies, and teams that use Callio. Callio is not a consumer-facing product.

1. About Callio

Callio is a vendor-agnostic brand-voice governance product. It helps a brand define its brand voice as a governed specification, or spec, and keep its AI voice agents consistent to that spec. Customers use a guided intake to create and manage their voice specs. Callio is built for enterprise brands, agencies, and their teams. It is not a consumer-facing product, and individual consumers are not its intended users.

2. Information We Collect

2.1 Account and Authentication Data

Account and authentication data, managed through Supabase, so that customers can sign in and create, view, and manage their voice specs.

2.2 Brand and Business Contact Information

Name, role, business email address, and company name for authorized users and account contacts.

2.3 Billing Information

The billing details necessary to process payment, handled by Stripe. Callio does not store full payment card numbers.

2.4 Intake Content

The content a customer provides during the intake: the brand-voice description the customer writes in free text, the voice selections the customer makes, and the resulting voice spec.

2.5 Customer-Provided Configuration Content

Configuration content a customer authors for its spec, including the customer's disclosure statements (compliance-sensitive text the customer writes), industry acronyms and terms, and brand-specific acronyms, terms, and lexicon. This content may include the customer's own regulated or compliance-sensitive language. Callio treats it as a distinct, sensitive category and applies the access controls described in Section 9.

2.6 Transactional Email Data

The data necessary to send account and product emails, such as confirmation after signup and after a spec is created.

2.7 Technical and Usage Data

IP address, browser type, device identifiers, standard server, performance, and error logs, and metadata about how product features are used.

3. What Callio Does Not Collect

The following are current facts about Callio as of this policy's effective date:

Callio does not record the user's own voice. The intake is listen-and-pick; users make selections and do not speak.
Callio does not capture or process recordings, transcripts, or audio from the calls handled by a customer's deployed agents.
Callio does not run product analytics.

As Callio's capabilities expand, we may process additional data — including audio input and audio from deployed agents to measure voice consistency — and may introduce product analytics; we will update this Privacy Policy and provide any applicable notices before any such change takes effect.

4. How We Use Information

Callio uses the information it collects to:

Operate, secure, and improve Callio
Authenticate users and protect against unauthorized access
Bill customers for the product
Send account, security, and product communications to authorized users
Meet our legal, regulatory, and contractual obligations

5. What Callio Does Not Do

Callio does not sell customer data to advertisers, data brokers, or any third party.
Callio does not use customer content to train AI models without the customer's explicit consent. [COUNSEL: confirm the consent mechanism]

6. Third-Party Subprocessors

Callio relies on the following third-party services to operate. Each service processes only the data necessary to perform its function, under its own privacy and security obligations.

Supabase: authentication and database
Anthropic (Claude): reasoning
ElevenLabs: voice generation and speech-to-text
Cloudflare R2: audio asset storage
Vercel: hosting and edge delivery
Stripe: billing
Resend: transactional email

Callio maintains an up-to-date list of its subprocessors and will provide the current list on request, so that changes to our vendors do not require republishing this policy.

7. Data Retention

Callio retains personal information for the duration of the active customer relationship and for any additional period required to meet legal, tax, accounting, and regulatory obligations. Customers may request earlier deletion, subject to those obligations, as described in Section 8. [COUNSEL: specify the exact retention periods by data category]

8. Your Data Rights

Authorized users may request:

Access to the personal information Callio holds about them
Correction of inaccurate or incomplete information
Deletion of personal information, subject to legal and contractual retention requirements
Portability of personal information in a structured, machine-readable format where applicable

To exercise any of these rights, email info@lyricvoices.ai. [COUNSEL: confirm the response window and any jurisdiction-specific rights]

9. Security

Callio applies technical and organizational measures appropriate to the information it processes, including:

Encryption of data in transit and at rest
Access controls that limit data and infrastructure access to personnel with a documented business need
Audit logging of access to customer content, including the sensitive configuration content described in Section 2, such as customer-authored disclosure statements and lexicon
Periodic review of security policies and controls

No system can be guaranteed perfectly secure. Callio will notify affected customers of any unauthorized access to their data without undue delay and in accordance with applicable law. [COUNSEL: confirm breach-notification timing and obligations] If you believe an account has been compromised, contact info@lyricvoices.ai.

10. International Data Handling

Callio works with customers internationally. Information may be processed in the regions where the underlying service infrastructure operates, including the United States and the European Union. Where required by law, Callio applies appropriate safeguards for cross-border transfers of personal data. [COUNSEL: specify the transfer mechanisms and applicable jurisdictions]

11. Changes to This Policy

Callio may update this Privacy Policy from time to time. The 'Last updated' date above reflects the most recent revision. For material changes, Callio will notify account contacts by email and post a notice on this page before the change takes effect.

12. Contact

Lyric Voices, Inc. Email: info@lyricvoices.ai