7 days on us. A real phone line for your AI Bot, with 10 minutes of calls. Nothing charged today.See how it works
CosVoice
Privacy

Privacy Policy

Last updated October 5, 2026

CosVoice (“we”) provides phone lines and email identities for AI assistants. This policy explains what we collect and why, in plain language.

What we collect

  • Account data: your email, name, and optional password (stored hashed).
  • Line data: your line's number, persona settings, contacts you add, and your mobile number if you provide it. If you set an owner PIN, only a keyed hash of it is stored; nobody, including us and your Bot, can read it back.
  • Call data: call metadata (numbers, times, duration), transcripts, and structured notes produced during calls. We do not store audio recordings.
  • Messages and email: texts sent to your line and the subject and a short excerpt of emails sent to your line's address.
  • Usage: minutes used, API activity, and webhook delivery logs.
  • Payment: Stripe takes your card. We never see or store the card number. We keep Stripe's reference for your account and a fingerprint of the card, so that one card gets one free trial.
  • Website visits: which page was opened, the site you came from, and a random number in a cookie that tells one browser from another. It is not tied to your name, and there are no advertising trackers.

How we keep it private from us

What happens on your line is yours. Call summaries, transcripts, texts, email, your standing instructions, and notes are encrypted before they are stored, with a key that is separate for every line and held apart from the database. Our staff tools show usage: minutes, counts, plan, and status. They do not show conversations. We troubleshoot with logs that carry no content, and the only people who see what your line said are you, the assistant you connected, and the people you chose to share a call with.

How we use it

To run your line: answering and placing calls, producing debriefs, delivering notifications and webhooks you configure, metering minutes, preventing abuse, and supporting you. We also send a short weekly tip on using your line, which you can stop with one click. We do not sell personal data and we do not use your call content to train models.

How it is protected

  • Everything travels encrypted (TLS) between you, us, and the companies below.
  • What happens on your line is encrypted before it is stored (AES-256-GCM), with a separate key for every line. Those keys are themselves locked with a master key that is kept in a secret store, not in the database.
  • Passwords and owner PINs are stored only as salted or keyed hashes. We cannot read them back.
  • Staff tools show usage, not conversations. Our logs carry no call content.
  • An assistant connects to one line, with permission you give and can take back at any time.
  • We keep no audio. When a line is closed, its call content is deleted within 30 days.

Who processes it

Other companies handle parts of the service for us. Each gets only what it needs for its part, and processes it only to provide the service.

  • Twilio carries the calls and texts.
  • xAI or OpenAI runs the speech model on a call, depending on the voice your line uses. xAI also writes the call summary.
  • Cloudflare runs our application and holds the database. Fly.io runs the servers that connect a call to the speech model.
  • Resend delivers the email your line sends, such as call summaries.
  • Stripe takes payments.
  • Fastmail hosts the mailbox that email you write to us arrives in.

If you connect another service to your line, such as a calendar, the line shares with that service what your instruction needs.

Where it is stored

We store your data in the United States. Our database is in Cloudflare's Western North America region, in the United States. The call servers are in Los Angeles and keep no call content once a call ends. Twilio and Resend keep their records in the United States.

The speech model is the exception. During a call, xAI or OpenAI processes the audio and the words as they are spoken. On the connections we use, neither company promises to keep that processing in one country, and each may keep a record of requests for a limited time under its own terms. We store no audio ourselves.

Moving data between countries

CosVoice is built for the United States and Canada. Lines have numbers in those two countries, and they call and text numbers in those two countries only. If you use CosVoice from Canada, or from anywhere else outside the United States, your data is sent to the United States and stored there. The law on personal data there may differ from the law where you live.

We do not direct the service at people in the European Economic Area, the United Kingdom or Switzerland. We have not put a transfer arrangement in place for those regions, such as standard contractual clauses or the Data Privacy Framework.

Requests from governments and other third parties

We give your data to a government, a court, or anyone else outside the companies above only when the law makes us. That means a valid and binding legal demand, such as a subpoena, a court order or a search warrant, from an authority that has power over us.

  • No standing access. No government has direct or standing access to our systems, our database or our encryption keys, and we have built no back door. We do not hand data over voluntarily, and we do not sell it.
  • We check every demand. Before we answer, we check that the demand is lawful, that it comes from an authority entitled to make it, and that it asks for no more than it may.
  • We push back. If a demand is unlawful, unclear or wider than it needs to be, we refuse it or ask for it to be narrowed, and we contest it where the law lets us.
  • We give the least we can. We hand over only the data the demand names. Account details and usage come first. Line content is encrypted, and we decrypt it only when a demand specifically and lawfully requires that content. There are no audio recordings to give.
  • We tell you. We tell the customer before we hand anything over, unless the law or a court order forbids it. If it does, we tell you once we are allowed to.
  • We keep a record. For every demand we record who made it, under what authority, what we gave, our legal reasoning, and who handled it.
  • Emergencies. If we believe in good faith that someone is in danger of death or serious injury, we may give the least information needed to prevent it.

Legal demands go to hello@cosvoice.com with “Legal request” in the subject.

Payments

CosVoice sells a subscription. It is not a bank, a money transmitter or a payment service, and it is not registered with or supervised by a financial or anti-money-laundering regulator. Stripe takes the card payments. We never hold your money or move money for you, and your line never makes a payment or reads out a card number.

Calls with other people

Your line identifies itself as an assistant on outbound calls and confirms it is an AI when asked. Transcripts are generated for every call. You are responsible for complying with recording and disclosure laws where you and the people you call are located.

Your choices

You can edit or delete contacts, revoke API keys, remove webhooks, and close your line from Settings or by emailing hello@cosvoice.com. Closing a line releases the number and deletes call content within 30 days.

Contact

Questions: hello@cosvoice.com.