> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.voicebip.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.voicebip.com/_mcp/server.

# Privacy Policy

> How Voicebip collects, uses, shares, and protects personal data under the NDPA and NDPR.

*Last updated: May 14 2026*

This Privacy Policy explains how **Temlio Communications Limited** (RC1575783),
operating the Voicebip platform ("**Voicebip**", "**we**", "**us**"), collects, uses,
shares, and protects personal data. We process personal data in accordance with the
**Nigeria Data Protection Act (NDPA) 2023** and the **Nigeria Data Protection Regulation
(NDPR)**.

## 1. Who we are and how to contact us

Voicebip is the data controller for personal data about our **developers** (account
holders). For personal data about **End Users** that developers process through the
platform, Voicebip generally acts as a **data processor / sub-processor** on the
developer's behalf — see the [Data Processing Agreement](/reference/dpa-compliance).

Data protection contact / DPO: [legal@temlio.com](mailto:legal@temlio.com).

## 2. Scope

This policy covers the Voicebip API, dashboard, MCP server, SDKs, and websites. It does not
cover developers' own applications or third-party services you connect to.

## 3. Personal data we collect

**About developers (we are controller):**

* Account data — name, email, password hash, workspace details.
* Billing data — top-up records, transaction references, plan and balance information (we do **not** store full card details; payments are handled by our payment processors).
* Technical data — IP address, device/browser metadata, API request logs, and usage metrics.

**Processed on developers' behalf (we are processor):**

* Phone numbers (E.164) of End Users.
* Call audio and, where enabled, **call recordings** and **transcripts**.
* Message content (SMS, WhatsApp) and conversation history.
* Any prompts, variables, or metadata developers attach to Agents.

## 4. How we use personal data

* To provide, operate, and secure the Services (routing calls/messages, running Agents, generating transcripts).
* To meter usage and process billing.
* To provide support and communicate service, security, and billing notices.
* To detect, prevent, and investigate fraud, abuse, and violations of our [Terms of Service](/legal/terms).
* To comply with legal obligations, including telecommunications and data-protection law.

## 5. Legal bases for processing (NDPA)

We rely on one or more of: **performance of a contract** (providing the Services),
**consent** (where required, e.g. certain communications), **legal obligation**, and
**legitimate interests** (security, fraud prevention, service improvement) balanced against
data-subject rights.

## 6. Call recording and consent

Recording is **off by default** and controlled per workspace. Where a developer enables
recording, the developer is responsible for providing notice to, and obtaining any consent
required from, End Users before recording. Recordings are stored encrypted and access is
restricted.

## 7. Sub-processors

We use the following third parties to provide the Services. They process personal data only
as needed to perform their function and under contractual safeguards.

| Sub-processor                 | Purpose                                  | Processing region       |
| ----------------------------- | ---------------------------------------- | ----------------------- |
| Google (Gemini)               | AI inference (hosted voice/messaging AI) | United States (US-East) |
| OpenAI                        | AI inference (secondary)                 | United States (US-East) |
| Deepgram                      | Speech-to-text / text-to-speech          | United States (US-East) |
| ElevenLabs                    | Speech-to-text (Scribe) / text-to-speech | United States (US-East) |
| Kapso.ai → Meta Platforms     | WhatsApp message delivery                | United States (US-East) |
| Paystack                      | Payments (NGN)                           | Nigeria                 |
| Stripe                        | Payments (international)                 | United States (US-East) |
| Postmark                      | Transactional email                      | United States (US-East) |
| Colocation facility (Nigeria) | Telephony compute                        | Nigeria                 |

An up-to-date list is available on request. We notify developers of material sub-processor
changes as set out in the [DPA](/reference/dpa-compliance).

## 8. Cross-border transfers

Some processing occurs **outside Nigeria** — notably the AI inference, payment, email, and
WhatsApp-delivery providers listed in Section 7, which are located primarily in the **United
States**. Core telephony compute and primary storage remain in Nigeria. Where we transfer
personal data across borders, we apply the safeguards required by the NDPA/NDPR (such as
adequacy assessment, contractual protections, or consent where applicable).

## 9. Data retention

We retain personal data only as long as necessary for the purposes above or as required by
law. Call and message records carry a retention window after which they expire. Developers
can shorten retention or erase specific End-User data at any time (see Section 10). On
account closure, we delete or anonymize personal data within 30–45 days, except
where retention is legally required (e.g. billing/tax records).

## 10. Your rights

Subject to the NDPA/NDPR, you (and End Users, via the relevant developer) may request:
access, rectification, erasure, restriction, portability, and objection to processing, and
may withdraw consent where processing is consent-based.

* **Developers:** exercise rights via the dashboard or by contacting [legal@temlio.com](mailto:legal@temlio.com).
* **End-User erasure:** developers can permanently anonymize an End User's call and message
  history by calling `DELETE /v1/contacts/{e164}` — see [Contact Erasure](/guides/contact-erasure).

You also have the right to lodge a complaint with the **Nigeria Data Protection Commission
(NDPC)**.

## 11. Cookies and analytics

Our dashboard and websites may use cookies and similar technologies for authentication,
preferences, and product analytics.

## 12. Children's data

The Services are intended only for users aged 18 and above. We do not knowingly collect
personal data from anyone under 18. If we learn that we have collected such data, we will
delete it.

## 13. Security

We use technical and organizational measures to protect personal data, including encryption
in transit and at rest, tenant isolation (row-level security), access controls, and signed
webhooks. No system is perfectly secure; we will notify affected parties and the NDPC of a
personal-data breach as required by law.

## 14. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the
dashboard or by email, and the "Last updated" date above will change.

## 15. Contact

Temlio Communications Limited — 6, Olatunde Sanni Crescent, Mende Maryland, Lagos, Nigeria
Data protection / DPO: [legal@temlio.com](mailto:legal@temlio.com)