Legal

Privacy Policy

Last updated: October 12, 2026

1. Introduction

Welcome to QuorumVoice ("we," "us," or "our"), a product of Inevital Labs, LLC. QuorumVoice is a multi-tenant communication intelligence platform that captures, transcribes, categorizes, and logs phone calls, voicemails, SMS messages, and emails for organizations such as HOA boards, property management companies, small businesses, schools, and nonprofits.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, visit our website at quorumvoice.com, or interact with communications managed through QuorumVoice. By using our services, you agree to the practices described in this policy.

If you do not agree with the terms of this Privacy Policy, please do not access or use our services.

2. Information We Collect

2.1 Information You Provide Directly

Account information: Name, email address, phone number, organization name, and role when you create an account or are invited to an organization.
Billing information: Payment details processed through our billing provider, Stripe. We do not store credit card numbers directly on our servers.
Contact information: Names, phone numbers, email addresses, and other details you add to your organization's contact directory.
Communication content: Emails you compose and send, SMS messages you draft, and notes you attach to contact records.

2.2 Information Collected Automatically

Call recordings: Inbound and outbound phone calls recorded through our platform with appropriate consent and disclosure.
Call metadata: Call duration, timestamps, caller ID, dialed numbers, call disposition, and call flow events.
Transcripts: Automated transcriptions of call recordings and voicemails generated through Deepgram's Nova-3 speech-to-text engine.
SMS messages: Inbound and outbound SMS message content, timestamps, and delivery status.
Email metadata: Sender, recipient, subject lines, timestamps, and message content for emails processed through connected accounts.
Device and usage data: IP address, browser type, operating system, referring URLs, pages visited, and interaction patterns with our platform. For our public blog and marketing pages, page views are measured first-party and server-side using a one-way hash derived from IP address and browser — the raw IP address is not stored — together with the referring site, campaign (utm) parameters, and general device type. If you allow analytics cookies, we also use Google Analytics 4 (see Section 13); it does not load without your consent.

2.3 Information from Third-Party Sources

Email providers: When you connect your organization's email account (Microsoft 365 or Gmail) via OAuth, we access email messages and metadata as authorized.
Google services: When your organization connects a Google account, we receive the Gmail, Google Calendar and Google Meet data described in Google user data below.
Zoom: When your organization connects Zoom, we receive the meeting recordings and meeting details described in Zoom data below.
Telephony provider: Call detail records, SMS delivery reports, and recording files from our telephony infrastructure provider, Telnyx.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our communication intelligence platform.
Record, transcribe, and categorize phone calls and voicemails for your organization.
Process and deliver SMS messages in compliance with applicable regulations.
Sync and display emails from connected email accounts in your unified communication timeline.
Generate AI-powered classifications, summaries, and insights from your communications.
Create searchable embeddings of communication content for semantic search functionality.
Link communications to the correct contact records and maintain per-contact unified timelines.
Process billing and manage your subscription.
Send transactional notifications about your account and service updates.
Enforce our terms of service and comply with legal obligations.
Detect, investigate, and prevent fraudulent or unauthorized activity.

4. Call Recording & Transcription

QuorumVoice records and transcribes phone calls as a core feature of the platform. We take call recording compliance seriously:

Two-party consent: By default, calls processed through QuorumVoice include an automated recording disclosure at the beginning of the call, informing all parties that the call may be recorded, played before any conversation begins. For contacts who have previously given recorded consent through the platform's contact-verification process, the per-call disclosure may be skipped and the previously captured consent relied upon instead; that consent record is retained with the contact.
Recording storage: Call recordings are stored securely in private storage buckets and accessed only via time-limited signed URLs. Recordings are never publicly accessible.
Transcription: Recordings are automatically transcribed using Deepgram's Nova-3 speech-to-text engine. Audio is sent directly to Deepgram for processing (not routed through Telnyx). Every request we send opts out of Deepgram's Model Improvement Program, so Deepgram keeps the audio only as long as it needs to process the request and does not use it to train its models. Transcripts are stored alongside call records in your organization's data.
Access controls: Only authorized members of your organization can access call recordings and transcripts, subject to role-based permissions.
Voicemail: Voicemail messages are recorded, transcribed, and categorized using the same secure pipeline as live calls.

5. AI Processing

QuorumVoice uses artificial intelligence to enhance the value of your communications data:

Classification: We use Anthropic's Claude language model (accessed via the Vercel AI Gateway) to automatically categorize communications by topic, urgency, and sentiment.
Summarization: AI-generated summaries of calls, voicemails, and email threads are created to help your team quickly understand communication content.
Embeddings: We generate vector embeddings of communication content using OpenAI's embedding models (accessed via the Vercel AI Gateway) to power semantic search across your organization's communications.
AI receptionist (Quill Concierge): Organizations on eligible plans may enable Quill Concierge, an AI receptionist that answers inbound calls using synthesized speech. When a caller speaks with Quill, their speech is processed in real time by conversational AI hosted on our telephony provider's (Telnyx) infrastructure to generate responses, and the call is recorded, transcribed, and logged like any other call, subject to the same recording disclosure and consent practices described above.
Data isolation: AI processing is performed on a per-organization basis. Your data is never used to train AI models and is not shared with or accessible to other organizations on the platform.
Gateway routing: All AI/ML requests are routed through the Vercel AI Gateway, which provides an additional layer of security, observability, and access control. We do not send data directly to AI provider APIs.

6. Third-Party Services

We rely on trusted third-party service providers to operate our platform. These providers process data on our behalf under strict contractual obligations:

Supabase: Database hosting, user authentication, file storage (including call recordings), and real-time data synchronization. All tenant data is isolated using row-level security policies.
Vercel: Application hosting, serverless function execution, and AI Gateway routing for all AI/ML operations.
Telnyx: Telephony infrastructure including call control, call recording, SMS messaging, phone number provisioning, 10DLC compliance for US A2P messaging, and hosting of the conversational voice AI behind the Quill Concierge AI receptionist.
Google Analytics: Website usage measurement on our public site and sign-up pages, only for visitors who allow analytics cookies. Advertising features are off.
Google & Microsoft: When your organization connects a Gmail or Microsoft 365 account, email data is accessed via the Gmail API or Microsoft Graph API using OAuth 2.0, only within the scopes you authorize. Google and Microsoft process that email data under their own terms and privacy policies. How we handle data from Google is set out in Google user data below.
Deepgram: Speech-to-text transcription via the Nova-3 engine, for calls, voicemails and recorded meetings. Audio is sent directly to Deepgram (not through Telnyx or the Vercel AI Gateway). Every request opts out of Deepgram's Model Improvement Program, so Deepgram keeps the audio only as long as it needs to process the request and does not use it to train its models.
Resend: Transactional email delivery for outbound email communications.
Anthropic: AI language model provider (Claude) for communication classification and summarization, accessed exclusively via the Vercel AI Gateway.
OpenAI: Embedding model provider for semantic search vector generation, accessed exclusively via the Vercel AI Gateway.
Stripe: Subscription billing, payment processing, and customer portal management. Stripe processes all payment transactions.
Sentry: Application error monitoring. When the platform encounters an error, Sentry receives the technical error report (stack trace and request metadata such as the URL and status code, and your IP address) so we can detect and fix problems quickly. On the Quill demo and sign-up pages, Sentry may also keep a session replay of the page to show what led to an error, with all text and form fields masked and media blocked. Sentry does not receive communication content, recordings, transcripts, or message bodies, and sets no cookies.
Trigger.dev: Runs background jobs, such as processing a call after it ends, transcribing and summarizing recordings, and syncing email and meetings. The data a job works on passes through Trigger.dev while the job runs.
Zoom: Meeting recordings and meeting details for organizations that connect Zoom, and the Zoom meetings we create for appointments, as described in Zoom data below.
Expo and Apple Push Notification service: Deliver push notifications to the QuorumVoice mobile app. A notification carries a short title and preview, such as a caller's name or the first words of a message.
Cloudflare: Relays the audio and video of team huddles when a direct connection between participants isn't possible. The media is encrypted in transit.
Firecrawl: Reads public web pages your organization points us to, such as your own website, to suggest AI context and knowledge base content. It does not receive your communications.
Other model hosts behind the Vercel AI Gateway: When a model's own provider is unavailable, the Vercel AI Gateway may route the same request to that model hosted on Google Cloud Vertex AI or Microsoft Azure.

6.1 Google user data

When your organization connects a Google account, QuorumVoice asks only for the access the features you use need, and Google's consent screen shows each permission before you agree. Depending on what you connect, we access:

Gmail: Messages in the connected mailbox (senders, recipients, subject, body and attachments), so they appear in your organization's inbox and on contact timelines, can be classified, summarized and searched, and can be answered. We send the emails and replies your team writes in QuorumVoice from that mailbox.
Google Calendar: The list of your calendars and your free and busy times, to offer open appointment times, and the events QuorumVoice books, which we create, update and delete on the calendars you choose. For a recorded Google Meet meeting, we also read the guest list of its calendar event, as described under Google Meet below.
Google Meet: The recordings, transcripts and participant lists of Meet meetings, read through Google Meet and Google Drive, so those meetings appear on your timelines with a transcript and a summary. We use Google Drive access only to download those meeting recordings and transcripts. When a Google Calendar is connected to QuorumVoice (your organization's appointments calendar, or the calendar of the Google account that connected Meet), we also read the guest list (names and email addresses) of the calendar event a recorded Meet meeting was scheduled on. We find that event by its time and its Meet code, and we use the guest list only to show who attended and to file the meeting on the right contact. We do not read event titles or descriptions.

How we use it. We use Google user data only to provide and improve the features you see in QuorumVoice: the shared inbox, contact timelines, classification, summaries, search, replies, appointment booking and meeting capture. We do not sell Google user data, use it for advertising, or use it to create, train or improve AI models. Classification, summaries and search run through the AI providers listed above and produce results for your organization only.

Who can see it. Members of your organization see your Google data, within what their role allows. QuorumVoice staff do not read it, except when you ask us to (for example, in a support request), when it is necessary for security (for example, investigating a bug or abuse), when it is necessary to comply with applicable law, or when the data is aggregated and used for internal operations as the law allows.

Who we share it with. We share Google user data only with the service providers listed above that we need to run these features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.

Storage and retention. Messages, events and meeting records are stored in your organization's database and private storage. The OAuth tokens that let us reach your Google account are stored encrypted. Data stays while your organization's account is active, as described in Data Retention.

Disconnecting and deletion. You can disconnect a Google account at any time in QuorumVoice settings, or remove QuorumVoice's access from your Google Account at myaccount.google.com/permissions. Disconnecting deletes the connection and its stored tokens, and we stop accessing that account. Messages, events and meetings already added to your timelines stay as your organization's records until your organization's account is closed, or until you ask us to delete them at privacy@quorumvoice.com.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

6.2 Zoom data

When your organization connects Zoom, we access, for the Zoom user who connected:

Cloud recordings: The recordings of meetings that user hosts, with Zoom's transcript when there is one, the meeting topic and times, and the list of participants (names and, where Zoom provides them, email addresses). We store the recording in private storage, transcribe it with Deepgram when Zoom has no transcript, summarize it, and add the meeting to your contact timelines.
Meetings for appointments: When your team books an appointment with a Zoom location, we create the Zoom meeting, and we delete it if the appointment is cancelled.

We use Zoom data only to provide these features. We do not sell it or use it for advertising. Members of your organization see it within what their role allows.

You can disconnect Zoom at any time in QuorumVoice settings, or remove the QuorumVoice app from your Zoom account. When the app is removed, Zoom notifies us and we delete the connection and its stored tokens. Meetings already added to your timelines stay as your organization's records until your organization's account is closed, or until you ask us to delete them at privacy@quorumvoice.com.

We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:

Within your organization: Communication data is shared among authorized members of your organization based on their assigned roles and permissions.
Service providers: With the third-party providers listed above, solely to provide and maintain our services.
Deidentified statistics: Aggregate, deidentified service-quality statistics covering multiple customers may be shared with named integration partners under a written no-reidentification agreement, as described in Section 12.9 of the Master Service Agreement. This never includes communication content, recordings, or any information that identifies you, your organization, or your contacts.
Legal requirements: When required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership.
With your consent: We may share information with third parties when you have given explicit consent.

8. Data Security

We implement robust security measures to protect your information:

Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL.
Encryption at rest: Sensitive data including OAuth tokens and organizational identifiers are encrypted using database-level vault encryption.
Row-level security: All tenant data in our database is protected by row-level security policies ensuring strict organizational isolation. Users can only access data belonging to their own organization.
Access controls: Role-based access control (superadmin, owner, admin, member, viewer) governs what actions users can perform and what data they can access within the platform.
Private storage: Call recordings and sensitive files are stored in private storage buckets and accessed only through time-limited signed URLs.
Webhook security: All inbound webhooks are verified using provider-specific signature validation, and endpoints are designed to be idempotent to prevent duplicate processing.

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we continuously review and improve our security practices.

9. Data Retention

We retain your information as follows:

Account data: Retained for the duration of your active account and for a reasonable period after account closure to comply with legal obligations.
Call recordings: Retained for the duration of your organization's subscription and deleted after account termination following the data export window described in the Master Service Agreement, unless applicable law requires a longer retention period.
Transcripts and summaries: Retained for the same duration as their associated call recordings.
SMS messages: Retained for the duration of your organization's subscription and subject to your configured retention settings.
Email data: Email metadata and content synced from connected accounts are retained for the duration of your organization's subscription, including after a mailbox is disconnected, unless you ask us to delete them sooner.
Meeting recordings: Meetings captured from Zoom or Google Meet, with their recordings, transcripts and summaries, are retained for the duration of your organization's subscription, including after the meeting account is disconnected, unless you ask us to delete them sooner.
Billing records: Retained as required by applicable tax and financial regulations.

You may request deletion of your data at any time by contacting us at privacy@quorumvoice.com.

10. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

10.1 General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure: Request deletion of your personal data under certain circumstances.
Right to restrict processing: Request that we limit how we use your personal data.
Right to data portability: Request your data in a structured, machine-readable format.
Right to object: Object to processing of your personal data for certain purposes.
Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

10.2 California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA and CPRA:

Right to know: Request information about the categories and specific pieces of personal information we have collected, the sources of collection, and the purposes for collection.
Right to delete: Request deletion of your personal information, subject to certain exceptions.
Right to opt-out of sale: We do not sell personal information. However, you have the right to opt-out if this ever changes.
Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
Right to correct: Request correction of inaccurate personal information.
Right to limit use of sensitive personal information: Request that we limit our use of sensitive personal information to what is necessary for providing the services.

To exercise any of these rights, contact us at privacy@quorumvoice.com. We will respond to verifiable requests within 30 days (GDPR) or 45 days (CCPA).

11. SMS & TCPA Compliance

QuorumVoice sends and receives SMS messages on behalf of organizations using our platform. We are committed to compliance with the Telephone Consumer Protection Act (TCPA) and related regulations:

Opt-out handling: We maintain opt-out records for all contacts. When a contact opts out of SMS communications, we immediately honor that request and suppress all future outbound SMS to that number.
10DLC compliance: All SMS messaging through QuorumVoice is conducted via registered 10-digit long code (10DLC) campaigns in compliance with carrier requirements for application-to-person (A2P) messaging in the United States.
Consent records: Organizations using QuorumVoice are responsible for obtaining proper consent from their contacts before sending SMS messages. Our platform provides tools to track and manage consent status.
Message content: All SMS messages sent through QuorumVoice include required identification and opt-out instructions as applicable.

12. Mobile Application

The QuorumVoice companion mobile app gives your team on-the-go access to calls, messages, tasks, and contacts. It uses the same backend, authentication, and per-organization data isolation as the web platform. In addition, when you use the mobile app:

Push notifications: With your permission, we send push notifications (for example, new messages, missed calls, and task assignments) through Expo's push notification service, which relays them via Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM). A device push token is stored with your account and is used only to deliver your notifications; it is removed when you sign out or disable notifications.
Incoming call alerts: On iOS, incoming calls ring through Apple's VoIP push (PushKit) and native call UI (CallKit). Call signaling and audio are delivered through our telephony provider, Telnyx.
Microphone: The app requests microphone access solely to place and receive calls. Audio is not captured outside of an active call.
Photos: If you attach a photo to a message, the app requests access to the photos you choose to share. We do not scan or upload your photo library.
Device storage: Your session is kept in secure device storage managed by the operating system. The mobile app does not use cookies.
No advertising or analytics SDKs: The mobile app contains no advertising, ad-attribution, or third-party analytics SDKs.

13. Cookies & Tracking Technologies

We use cookies and similar technologies to:

Essential cookies: Maintain your authentication session, remember your preferences, and enable core platform functionality. These cookies are strictly necessary and cannot be disabled.
Analytics cookies (optional): Only if you allow them in the cookie banner, Google Analytics 4 measures which pages are visited and how people found us. You can withdraw consent at any time under Cookie settings in the site footer, which deletes these cookies.

We use no advertising cookies or tracking pixels. Besides the optional Google Analytics above, our visitor analytics are first-party and server-side, as described in Section 2.2. For more information, see our Cookie Policy.

14. Children's Privacy

QuorumVoice is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as promptly as possible. If you believe that a child under 13 has provided us with personal information, please contact us at privacy@quorumvoice.com.

15. International Data Transfers

QuorumVoice is operated from the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure your data receives an adequate level of protection.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Notify registered users via email or through an in-app notification.
Where required by law, obtain your consent before applying material changes to how we process your data.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Privacy inquiries: privacy@quorumvoice.com
Legal inquiries: legal@quorumvoice.com
Company: Inevital Labs, LLC

For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection supervisory authority.