Privacy Policy

1. How the Service Works — Our Role (Controller / Processor)

The Service is a business-to-business product in which an AI voice agent answers phone calls placed to our business customers ("Customers") and automates tasks such as booking, information, and customer management (CRM).

We act in two capacities:

• For Customer account data (sign-up, billing, usage records), we are the data controller.
• For information about the people who call a Customer's phone line ("Callers") — including call content, recordings, and phone numbers — we act as a processor, handling that data on behalf of and under the instructions of the Customer. In that case the Customer is the controller for Caller data and is responsible for obtaining any consent and providing any notice required for call recording and AI processing.

2. Information We Collect

a. From business Customers

• Account data: name, email address (via Google Sign-In), profile information
• Business data: business name, connected phone numbers, service configuration
• Billing data: subscription and usage billing information. Actual card details are handled by our payment processors and are not stored by us — PortOne and Toss Payments for customers in Korea, and Stripe for customers in the United States and Canada.
• Customer-support communications

b. During call handling (on behalf of Customers)

• Caller phone number (caller ID)
• Voice recordings of calls (where the Customer enables recording)
• Transcripts of call content and AI-generated summaries / memory
• Information shared during a call (e.g., appointment times, inquiry details)

c. Collected automatically

• Service usage records, access logs, device/browser information, IP address
• An authentication token essential to operating the Service (stored in your browser's local storage). We do not use advertising or tracking cookies.

3. How We Use Information

• Providing the Service (AI voice answering, booking, information, customer management)
• Identity verification, account management, and customer support
• Billing and payment processing
• Quality assurance (QA), error analysis, and performance improvement
• Complying with legal obligations and handling disputes

4. Sub-processors and Disclosure to Third Parties

To operate the Service reliably we engage the following sub-processors. We do not sell your personal information.

We do not otherwise disclose personal information to third parties except where required by law or with the data subject's consent.

5. Cross-Border Transfer of Personal Information

To provide the Service, personal information may be processed outside the Republic of Korea. The transferred items, countries, purposes, and retention are as follows:

• Recipients and countries: see the sub-processor list in Section 4 (including the United States)
• Items transferred: the data described in Section 2 (call audio, transcripts, caller numbers, account data, etc.)
• Purpose: AI voice/language processing, cloud storage, telephony connectivity, and payment processing (for US and Canada customers)
• Retention period: as set out in Section 6

You may refuse the cross-border transfer of your personal information; however, doing so may limit your ability to use all or part of the Service.

6. Retention Period

• Call recordings and transcripts: retained for 1 year from collection for quality assurance and dispute resolution, then deleted
• Guest (non-logged-in) session data: deleted after a maximum of 24 hours
• Account data: retained until account closure (termination), then deleted without undue delay
• Payment and transaction records: retained for 5 years as required by Korean consumer-protection and tax law

Where a statutory retention obligation applies, we retain data for the required period.

7. Security Measures

• Encryption in transit (HTTPS/TLS) and protection of stored data
• Access controls applied on a least-privilege basis
• Retention and monitoring of access logs

8. Your Rights and How to Exercise Them

Customers may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, and may withdraw consent. Users in Canada have rights of access and correction; users in California have rights to know about and delete personal information and to opt out of its sale (we do not sell personal information), and will not be discriminated against for exercising these rights.

To exercise your rights, contact support@livespeech.ai.

Requests concerning a Caller's personal information should be directed to the business Customer who controls that data. As a processor, we will assist the Customer in accordance with its instructions.

9. Children's Privacy

The Service is not directed to children under the age of 14, and we do not knowingly collect personal information from children.

10. Privacy Officer and Contact

• Privacy Officer: Yeon-jae Kim (CEO)
• Contact: support@livespeech.ai
• Address: 8F B814, 454 Namsejong-ro, Boram-dong, Sejong Special Self-Governing City, Republic of Korea

In Korea, you may also contact the Personal Information Dispute Mediation Committee (privacy.go.kr), the Korea Internet & Security Agency report center (privacy.kisa.or.kr, dial 118), or the Personal Information Protection Commission. Canadian users may contact the Office of the Privacy Commissioner of Canada; California users may exercise rights under the CCPA.

11. Google User Data and Google Calendar Integration

Business Customers may optionally connect their Google Calendar. When connected, we are granted the calendar.events scope (https://www.googleapis.com/auth/calendar.events) on the Customer's primary calendar via Google OAuth.

a. Access and Use

• When the AI agent handles a booking during a call, it lists events within a requested time window to check availability and prevent double-booking.
• When a booking is confirmed during a call, it creates an event on the Customer's primary calendar.
• We do not read, modify, or delete calendar data for any other purpose, and we do not access any calendar other than the primary calendar.

b. Storage and Revocation

• We store an OAuth refresh token, encrypted with AWS KMS, so the agent can access the calendar during calls.
• You may revoke access at any time in your Google Account settings (myaccount.google.com/permissions) or by disconnecting the calendar in the Console.

Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes to This Policy

We may amend this Privacy Policy in response to changes in law or the Service. We will announce material changes through the Service.