Who we are
APIFleet (“we”, “us”) is a voice-agent platform operated from Dublin, Ireland. You can contact us about this policy at mariano@apifleet.dev.
This policy covers our website, workspace, API and communications with us. APIFleet decides how account, security, support and business records are used and is the controller for that information.
For conversations handled by a customer’s assistant, the customer normally decides the purpose and use of the data. The customer is the controller and APIFleet processes that data to provide the configured service. If you called a business using APIFleet, contact that business first about your call. We can help route your request.
Data we process
What we receive depends on the features you use and the assistant’s configuration.
- Accounts: email address, authentication information, workspace membership, roles, API-key records and preferences.
- Assistant configuration: instructions, knowledge documents, tool definitions, provider credentials, phone-number bindings and webhook destinations that workspace users supply.
- Conversations: caller and destination numbers when provided, audio, transcripts, timing, duration, tool inputs and results, recordings, summaries, outcomes and usage estimates.
- Testing: microphone audio from browser tests, text or audio supplied for speech previews and transcription, simulation scenarios and results.
- Operations and support: messages you send us, service requests, IP addresses, browser information, diagnostic events and workspace activity.
- Payments: transaction, receipt and account-funding information when payment features are used. Stripe handles payment details through its own payment interface.
We receive information from you, workspace administrators, callers, connected providers and the services your assistant is configured to contact. Avoid putting unnecessary personal or sensitive information in instructions, knowledge, tests or tool results.
Google sign-in
If you choose Google sign-in, we request the openid, email and profile permissions. Google returns identity and basic profile information. We verify your email address and store it with your APIFleet user and workspace records to authenticate you and manage access.
This sign-in does not request access to Gmail, Google Drive or Google Calendar. APIFleet does not persist Google access or refresh tokens. We create our own session cookie after sign-in.
Google sign-in information is used for account access, support and security. It is available to authorised APIFleet operators and infrastructure providers as necessary for those purposes. We do not sell it, use it for advertising, or send it to voice or language-model providers as part of signing in.
You can remove APIFleet’s access in your Google Account connections. Removing access does not itself delete your APIFleet account; contact us to request deletion. Our use of Google information is subject to the Google API Services User Data Policy.
Why we use information
For information we control, the purpose and legal basis depend on the relationship:
- Providing accounts and requested services: performing our contract with you, or our legitimate interest in serving the organisation you represent.
- Security, support and reliability: our legitimate interests in protecting accounts, preventing abuse, investigating faults and operating the platform.
- Understanding feature use: our legitimate interest in improving the service through limited activity measurement.
- Payment administration and required records: performance of the contract and applicable legal obligations.
- Responding to privacy requests or legal proceedings: legal obligations and, where relevant, our legitimate interest in establishing or defending claims.
Where we rely on consent, you may withdraw it at any time. Required account or service information is necessary to supply the relevant feature; without it, we may be unable to do so. Customers are responsible for establishing a lawful basis for caller data that we process on their instructions.
Calls, recordings and AI
Audio and text are sent to the speech and AI providers used by the configured pipeline. Tools can send conversation details to customer-selected endpoints, and webhooks can deliver call events and conversation records to the customer’s systems. When post-call analysis is enabled, the transcript and relevant tool evidence may be processed to generate a summary, sentiment, outcome or follow-up actions.
APIFleet can save call recordings, including browser tests, as well as transcripts and tool activity. Customers must tell participants about AI, recording and transcription and obtain consent where required. An AI or recording announcement is not automatically added to every assistant.
AI output can be inaccurate. Customers should review it before relying on it for decisions affecting people. APIFleet does not use Google sign-in information to train AI models. Processing by a selected AI provider is also governed by that provider’s terms and the applicable account settings.
Who receives information
Information is accessible to authorised workspace users, APIFleet operators and the providers needed to deliver the requested service. The providers involved depend on the feature and configuration.
- Hosting and account access
- Hetzner hosts the production service. Google provides optional sign-in. Resend delivers email sign-in links.
- Contact and activity measurement
- Cloudflare and Google handle email sent to our contact address. A self-hosted Umami service supports workspace activity measurement.
- Voice, AI and telephony
- Supported configurations can use OpenAI, Google Gemini, Deepgram, Soniox, Microsoft Azure, Amazon Web Services, ElevenLabs, Cartesia, Telnyx, Twilio, Voximplant and VoIPcloud. Post-call analysis can use OpenAI or TypeSafe. A conversation is sent only to providers involved in its configured processing, not to every supported provider.
- Customer integrations
- HTTP tools and webhook endpoints chosen by the customer receive the information required by their configuration. Customer-supplied provider credentials can connect the customer’s own provider accounts.
- Payments
- Stripe processes payments when payment features are used. APIFleet does not need to receive complete card numbers or card security codes.
We may also share information where necessary to comply with law, respond to valid legal requests or obtain professional advice. We do not sell personal data.
International processing
Our production hosting is in Europe. Google, Stripe, speech and AI providers, and customer-connected services may process information in other countries, including the United States. A European hosting location does not mean all conversation processing stays in Europe.
Locations and transfer arrangements depend on the provider, account and region selected. Contact us for details of the arrangements relevant to your workspace, including any applicable adequacy decision or contractual safeguards, before sending data that requires a specific region or transfer arrangement.
Keeping and deleting data
We keep account and workspace information for as long as it is needed to provide the service, resolve support or security matters, or meet applicable record-keeping requirements. The type of data, customer instructions, account status and any legal obligation determine the period.
Saved recordings currently have no automatic expiry. An authorised workspace administrator can delete a saved recording. This removes its active audio files; it does not also delete the associated call log, transcript or copies sent to a connected provider or customer endpoint.
For account closure, transcript or call-log deletion, or a broader data-removal request, email mariano@apifleet.dev. We assess the request against customer instructions and any information that must be retained by law. Backup copies are separate from active workspace data and may remain after an active record is deleted; we will explain any relevant limits when handling your request.
Connected providers and customer systems may retain their own copies under their agreements and settings. Removing data from APIFleet does not automatically remove those copies.
Protecting information
Our safeguards include HTTPS, workspace access controls, scoped API keys and encryption of stored provider credentials. Access is limited according to the service role and operational need. No service can guarantee absolute security. Protect your API keys and provider credentials, and check the destinations and permissions of tools you connect.
Your rights
Depending on applicable law, you may request access to, correction, deletion, restriction or portability of personal data; object to processing based on legitimate interests; and withdraw consent where it is used. You may complain to the Irish Data Protection Commission or your local data-protection authority.
Email mariano@apifleet.dev with enough information to identify your account or the relevant conversation. Please do not send passwords, API keys or complete payment-card details. We may need to verify your identity. For customer-controlled conversation data, we will work with or direct you to the relevant customer.
Changes to this policy
We will update this page when our processing changes and show the revision date above. Where required, we will notify affected users before a material change takes effect. You can ask for clarification or a copy of the policy by contacting mariano@apifleet.dev.