Privacy Practices

This describes how OneVA LLC (“OneVA”) handles personal information at OneVA.ai. It covers two different relationships, and the distinction matters:

• Our customers. For your account, billing, and support information, we decide how it is used — we are the controller.
• People your agents speak to. For call audio, transcripts, and anything a caller tells your agent, we process it on your instructions and on your behalf. You are the controller; we are the processor. Your own privacy notice governs those callers, not this one.

Using the California categories, we collect:

• Identifiers — name, email, phone number, company, account and organisation IDs.
• Commercial information — plan, billing history, usage in minutes. Card details go to our payment processor; we never see or store them.
• Internet activity — pages visited in the dashboard, device and browser information, IP address, and error logs.
• Audio and electronic information — call recordings and transcripts, where recording is enabled.
• Content you upload — knowledge-base documents, agent instructions, contact and lead lists.
• Inferences — call summaries, intent tags, and lead scoring generated from call content.

Recording is a per-agent setting that you control and can switch off at any time. When it is on, audio and a transcript are stored in your account and are visible to users you have invited.

As a safeguard, recording and transcription are withheld automatically for calls to or from states that require every party to consent, unless the agent's owner has turned that on. The call still connects; only the record of it is not kept.

The demo on our own homepage works differently, because those calls are ours rather than a customer's. We ask you to agree to the recording on the form before the call is placed, and we store that agreement — the wording you accepted, when, and the IP it came from. Without it we don't record at all.

Obtaining consent to record is your responsibility, not ours. Some U.S. states require every party on a call to consent. Our Terms cover this in more detail.

We say this plainly because biometric identifiers are separately regulated — including under the Illinois Biometric Information Privacy Act, the Texas CUBI statute, and Washington's biometric law — and because a voice product should be clear about where it stands.

• To operate the Service — connecting calls, running agents, storing results.
• To bill you and manage your subscription.
• To provide support, and to investigate problems you report.
• To keep the Service secure, and to detect abuse or fraud.
• To send service email, and marketing email you can unsubscribe from at any time.
• To meet legal obligations.

We do not sell or share personal information, as those terms are defined by California law, and we do not use your call content to train our own AI models.

We use the subprocessors below to run the Service. Each receives only what it needs, under contract.

We also share information where the law requires it, to protect our rights or someone's safety, and with an acquirer if the business is sold — in which case this notice continues to apply until replaced.

• Account and billing records — for as long as your account is open, then as long as needed for tax and legal purposes.
• Call recordings and transcripts — until you delete them, or until your account closes.
• Knowledge-base documents — until you delete them. Deleting a document also removes the searchable extracts made from it.
• Assistant conversations — automatically deleted after 14 days without activity.
• Closed accounts — data may be exported for 30 days after closure, then deleted from live systems, with backups ageing out afterwards.

Depending on where you live, you may have the right to know what we hold, get a copy, correct it, delete it, and not be discriminated against for asking. California residents have these rights under the CCPA as amended by the CPRA, and residents of other U.S. states with comprehensive privacy laws have similar ones.

We honour browser opt-out preference signals, including Global Privacy Control, where they apply.

To exercise a right, email support@oneva.ai. We will verify your request and respond within the period the law allows. If your request concerns a call handled by one of our customers' agents, we will refer you to that customer, since the data is theirs.

For users in Canada, we handle personal information in line with PIPEDA. We collect only what is needed for the purposes described here, obtain consent appropriate to the sensitivity of the information, and give you access to what we hold on request. Because AI is central to this Service, we describe its role specifically rather than relying on a general statement about improving our services. Complaints can be raised with us first, and then with the Office of the Privacy Commissioner of Canada.

We and our subprocessors are based primarily in the United States, and information is processed there. If you are in Canada or elsewhere, using the Service means your information is transferred to and processed in the United States under the protections described here.

Data is encrypted in transit and at rest. Credentials for services you connect are encrypted before storage. Access is limited to people who need it. No system is perfectly secure, and we cannot guarantee absolute security — if a breach affects you, we will notify you as the law requires.

We use cookies and similar technology to keep you signed in, remember preferences, and understand how the dashboard is used. You can control cookies in your browser, though signing in will not work without the essential ones.

The Service is for business use and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe we have, contact us and we will delete it.

We may update these practices. The date above changes when we do, and we will give notice of material changes in the product or by email.

Questions, requests, or complaints: support@oneva.ai.