Privacy Policy

Last updated: September 27, 2026

This Privacy Policy explains how Thinking Minds Inc. ("Vocue", "we", "us", or "our") collects, uses, discloses, and retains information in connection with the Vocue websites, portals, Chrome extension, APIs, and related services (collectively, the "Service").

1. Scope

This policy covers information processed when authorized organizations and their users use the Service. Each customer organization controls the business information it connects to Vocue (for example, its CRM records and calling lists) and is responsible for having a lawful basis to provide it. Users should only connect information they are authorized to use.

2. Information we collect

• Account and organization information: name, email address, organization name, role, authentication identifiers, user preferences, and subscription and billing details. Full payment-card numbers are processed by our payment provider; we do not store them.
• CRM information: when you connect a CRM via OAuth, we access the contact, lead, company, activity, and custom-field data you authorize and that is needed to provide the Service — for example, to project intelligence alerts into lead records and log call activity back to them.
• Calling information: phone numbers dialed or received, call status, duration, disposition and outcome, voicemail-drop usage, and related operational metadata.
• Call recordings and transcripts: calls placed through the Service may be recorded and transcribed at your organization's direction, so that recordings, transcripts, and dispositions can be logged to your CRM.
• AI SDR and consent records: AI-call transcripts, opt-out events, and consent records (consent state, timestamps, and E-SIGN artifacts) for leads subject to AI calling.
• Company intelligence: company names, domains, public-source events, evidence links, jobs, news, website information, and generated briefs and alerts.
• User-provided content: outreach guidance, voicemail-drop recordings, signatures, digest preferences, and other configuration supplied by an authorized user.
• Technical information: service logs, browser and request metadata, Chrome extension telemetry, error information, and security events needed to operate, secure, and troubleshoot the Service.

3. How we use information

We use information to: authenticate users and enforce organization boundaries; provide the Service, including intelligence alerts, call cards, dialing, voicemail, AI SDR calling, and CRM logging; process subscriptions, talk minutes, and AI credits; provide customer support; maintain security, prevent fraud and misuse, and enforce our Terms; troubleshoot and improve reliability; comply with legal obligations; and — only in aggregated or de-identified form — improve the Service. Vocue does not sell personal information.

4. Call recordings

Call recording is performed at your organization's direction. You are responsible for providing any notices to, and obtaining any consents from, call participants that are required by the call-recording laws of each jurisdiction where you place or receive calls. Recordings and transcripts are stored within your organization's account boundary and are available to your authorized users and logged to your connected CRM.

5. Chrome extension

The Vocue Chrome extension operates within the CRM pages you authorize. It uses browser capabilities needed to authenticate you, display call cards and the dialer workflow, retrieve your organization's data, and maintain call state. The extension does not collect data outside the pages and purposes required for the Service, and we do not sell Chrome extension user data or use it for advertising.

6. How we share information

• Service providers: we disclose information to providers acting on our behalf — for cloud hosting, authentication, data storage, payment processing, telephony, AI transcription and voice services, and the CRM platforms you connect — only as needed to provide the Service and subject to contractual privacy and security obligations.
• At your direction: when you connect a CRM or other integration, we share the data needed for that integration to function, such as logging calls, recordings, and dispositions to your CRM records.
• Legal and safety: we may disclose information where required by law or where we reasonably believe disclosure is needed to protect rights, safety, or the integrity of the Service.
• Business transfer: in connection with a merger, acquisition, or sale of assets, information may transfer subject to this policy, and we will provide notice as appropriate.

We do not share Customer Data for other companies' marketing, and we do not use one organization's data for another organization's benefit.

7. Your choices and rights

• Organization administrators can manage users, roles, and connected integrations from the portal. Disconnecting a CRM integration revokes our access going forward.
• You may request access to, correction of, export of, or deletion of your information by contacting us at the address below. We will respond within a reasonable period and as required by applicable law.
• Marketing emails include an unsubscribe mechanism; transactional and service notices are part of the Service.

8. Retention

We retain information while your account is active and as reasonably necessary to provide the Service, maintain security and audit records, resolve disputes, and meet legal obligations. AI-calling consent records are retained in an immutable audit trail for up to seven years. When information is deleted, residual copies may remain in backups or required audit records for a limited period.

9. Security

We use reasonable administrative, technical, and organizational safeguards — including encryption in transit and at rest, authenticated organization boundaries and tenant isolation, and access controls — designed to protect information. No system is completely secure, and we cannot guarantee absolute security.

10. International processing

Vocue and its service providers primarily process information in the United States and may process it in other locations where they operate. Those locations may have data-protection laws different from your jurisdiction.

11. Children

Vocue is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

12. Changes to this policy

We may update this policy as the Service changes. We will update the date above and provide additional notice when appropriate. Continued use of the Service after an update constitutes acceptance where permitted by law.

13. Contact

Questions about this policy, or requests to access, correct, export, or delete your information, may be sent to support@vocue.io.