Privacy Policy

Version 2.3. Effective October 13, 2026. Last updated October 13, 2026. What changed in version 2.3: notifications to the account owner can also go by WhatsApp (Section 9.3); key 9 is offered on outbound calls only, and the Customer's own announcement text is played on outbound calls (Sections 3.5 and 22); deleting an account deletes its do-not-call list and block lists (Section 3.4); the log of privacy setting changes records additions to the do-not-call list and who acted, including our staff (Sections 3.2 and 9.5); the privacy advice we compute from an account's activity (Section 4.9); masking also covers webhook deliveries, lists and errands (Sections 9.4, 12 and 18.1); connected applications can read and change privacy settings (Section 18.3); and card numbers said in a voice conversation in the dashboard are masked too (Section 13.2). What changed in version 2.2: a Cookie settings link on every page of our website, Global Privacy Control honored, and the cookie banner placed by the visitor's country (Section 7); our Data Processing Addendum at www.uirix.com/en/dpa (Sections 2.2 and 9.1); how the Personal AI Agent profile is shared (Section 19.2); how long evidence records are kept (Section 3.4); that the calls signing up allows are about your account, support and the Service (Section 4.4); that in accounts opened from October 12, 2026 the call announcement is on by default on outbound calls (Section 3.5); and that we do not use Customers' conversations to improve the Service (Section 4.5). What changed in version 2.1: in accounts opened from October 12, 2026, conversation text, call recordings, and summaries with contact details are deleted automatically after one year unless the Customer chooses another period or to keep them; the compliance tools on Profile > Privacy and the data they keep (do-not-call entries with how each opt-out was given, consent records, block lists, the call announcement and a log of setting changes); the notice the phone line can play; masking in Public API responses and in stored text, described as it works; calls from UIRIX, which signing up allows and which you can stop at any time; and EqualWeb Ltd. named as the company that operates UIRIX. In version 2.0 (October 10, 2026) we rewrote this Policy to describe the Service as it works today, including phone calls and recording, the Public API and webhooks, connected AI applications, the Personal AI Agent, partners and our partner program, the cookies and advertising tags on our website, and how we keep and delete data. Earlier versions, including the one shown as last updated January 2025, are available on request at info@uirix.com. We review this Policy at least once a year.

Short version. This summary is not part of the Policy.

We are responsible for account data, our websites, our own marketing and Personal AI Agents used for personal purposes. We process our Customers' agent conversations on their behalf. Calls are recorded unless the Customer turns recording off, and conversations are transcribed and summarized by AI, which can make mistakes. A Customer can have the phone line announce the AI and the recording, and can let people opt out during a call; we keep the records of opt-outs and consents. In accounts opened from October 12, 2026, unless the Customer chooses another period or to keep them in Profile > Privacy, conversation text, call recordings, and summaries with contact details are deleted automatically one year after the conversation. We use AI, telephony and payment providers, and we send data to the apps and services a Customer connects. We do not sell personal data for money. Section 7 explains the analytics and advertising tags on our website.

1.1 Who we are. This Policy is issued by EqualWeb Ltd., which operates UIRIX ("UIRIX", "we", "us" or "our"). UIRIX AI and UiriX are its brand names. UIRIX is the controller of the data described in Section 2.1. Our contact details are in Section 17.

1.2 What this Policy covers. This Policy explains how UIRIX handles the personal data of visitors to our websites, people who use UIRIX accounts, and people who talk with, are called by, or are named to agents that run on UIRIX. It describes our practices. It is not a contract. Our Terms of Service govern the use of the Service, and Sections 2 and 12 of this Policy also form part of them.

1.3 Definitions. These words have the same meanings here as in Section 1.4 of our Terms of Service, except "you", which is defined below:

• "Service": the UIRIX AI platform: our websites, dashboard, AI voice and chat agents, website widgets and demo pages, phone numbers, calling and messaging, the Public API and webhooks, the Personal AI Agent, accounts opened through our partners, and the connector that lets AI applications such as Claude and ChatGPT work with an account.
• "Customer": the person or organization that holds a UIRIX account, including an account opened for it by a UIRIX partner, and the users it authorizes.
• "Partner": a business that opens or manages UIRIX accounts for its own customers under an agreement with UIRIX. In this Policy, the word also covers a person or business that refers customers to UIRIX under our partner program (Section 20).
• "Personal AI Agent": an agent that answers and places calls for one individual.
• "Owner": the individual a Personal AI Agent works for.
• "End User": any individual who talks or chats with an agent, whom an agent calls, messages or transfers a call to, who appears on a Customer's contact or do-not-call list, or who is named in an agent's knowledge or an Owner's profile.
• "Connected app": an AI assistant or other application that a Customer authorizes to act on its account through our connector, an API key or an integration.
• "Customer Content": the data a Customer, its End Users or its Connected apps provide to the Service, and the records the Service creates for the Customer from it, including conversations, transcripts, recordings, summaries, leads and other agent records.

"You" means the person reading this Policy: a Customer, a user of an account, a visitor to our websites or an End User, as the context shows.

"Personal data" means information that identifies an individual, or can reasonably be used to identify one, directly or indirectly, as the law that applies defines it.

An account that a Partner opened belongs to the Customer, not to the Partner.

2.1 Where we are the controller. We decide how personal data is used, and are responsible for it, for: Customers and their users (accounts, billing, support and security); visitors to our websites; people who talk to the UIRIX agent on our website; Customers who use our help assistant in the dashboard; our own marketing, including calls and e-mails to people who sign up, buy a plan or request a demo; our advertising measurement; people who apply to or take part in our partner program; and Personal AI Agents used for personal purposes (Section 2.3).

2.2 Where we act for a Customer. When a business Customer uses the Service with other people's data (callers, website visitors, contacts and lists), the Customer is the controller. We process that data for the Customer, as its processor or service provider, under our Terms of Service. Our Data Processing Addendum is at www.uirix.com/en/dpa.

2.3 Personal AI Agents. When an individual uses a Personal AI Agent for personal purposes, we act for that individual, the Owner, and we are responsible under data-protection law for how the Service processes the data of the people who call the agent, whom it calls and who are named in the Owner's profile. The Owner is responsible for what they ask the agent to store and do, and must be entitled to give us the details they add.

2.4 Shared responsibility. Each Customer is responsible for the notices and consents its use of the Service requires. Customers and Owners are responsible for the personal data they collect through the Service and for what they ask their agents to do. We remain responsible for our own legal duties, including security and processing data only on the Customer's instructions.

3.1 Account data. Name, e-mail address, verified phone number, company, website, language, time zone and a hashed password. If you sign in with Google: your Google ID, name, e-mail address and picture. If a Partner opened or links your account: the Partner's customer reference, your name, company and e-mail address. If you use two-step verification: your trusted devices. If you apply to our partner program or join through a Partner: the data described in Section 20.

Support and communications: messages, e-mails and calls you send us, support requests, files you share for troubleshooting, and your conversations (voice or text) with the UIRIX help assistant in the dashboard, which our AI providers process.

3.2 Sign-in, device and security records. The IP address, browser and device used to sign up and sign in; session records; API keys and connected apps, with the time and IP address of their last use; the record of requests made through the Public API and our connector; the actions taken in the dashboard; the log of changes to privacy settings (who changed what and when, from which IP address and browser, including when a member of our staff, a Partner or a connected application acted in the account), which also records each addition to the do-not-call list and each block list loaded; and error and server logs, which can contain excerpts of conversations and phone numbers (Section 6).

3.3 Payment data. Cardcom processes our payments and issues our invoices. We never receive the full card number or security code. We keep a payment token, the last four digits, the card brand, the expiry date and the records of each transaction. To process a payment we send Cardcom the billing name, e-mail address, company, tax ID, phone number and address.

3.4 Data we process for Customers. When we provide the Service to Customers we process:

• call audio and recordings;
• transcripts, and the actions agents take (tool calls, tickets, appointments and orders);
• caller and called numbers, and the caller name and location the phone carrier provides;
• details people give (name, e-mail address, phone number, company and requests);
• on websites with an agent: the IP address and browser type, a browser identifier stored in the browser, and, unless the website tells the widget that the visitor declined analytics, the page address including its query string, the page title, the referrer, the first page of the visit, campaign tags and ad click ids (such as gclid, fbclid, li_fat_id and msclkid);
• data the Customer's own systems pass to the agent;
• documents, knowledge files and agent instructions the Customer uploads or writes, which may include names and contact details;
• AI-generated summaries and the details they extract;
• contact lists, call history and the purpose of each list and campaign;
• consent records the Customer enters for contacts (type, date, source and reference);
• do-not-call entries, with how and when each opt-out was given (a key press, a spoken request, a reply such as STOP, or the Customer); a reply such as STOP stops messages only;
• block lists the Customer uploads for a country, such as a do-not-call registry;
• the text of the announcement the Customer sets for outbound calls;
• imported conversations;
• for Personal AI Agents, the Owner's profile (Section 19).

How long these records are kept. Leads, tickets, appointments, orders and callback requests that agents record, the items and call history of outbound calling lists, and the instructions of Personal AI Agent errands are kept for as long as the account is open, unless they are deleted in the Service or on request. The retention settings in Section 12 do not delete them. Do-not-call entries, with the record of each opt-out, and the block lists a Customer uploads are kept while the account exists, also after its subscription ends, and are deleted with the account when it is deleted; a Customer that may need them later should export its do-not-call list first, through the Public API or by asking us. Consent records are kept while the account exists, and after it is deleted for as long as they are needed to show that consent was given. The log of privacy setting changes is kept while the account exists, and after it is deleted for as long as it is needed to show how the settings were used. The retention settings do not delete any of these, and we do not delete records the law requires us to keep. When an agent is deleted, its chat conversations are deleted, but its call records, including their transcripts and recordings, are kept under the account's retention settings.

3.5 Recording and transcription. Calls that an agent answers or places are recorded by default. The recordings are stored by our telephony provider (Twilio). The Customer can switch recording off in Profile > Privacy, and a call placed through the API can be placed without recording. If a call is transferred, the rest of the call may also be recorded. Calls and chats are transcribed, and most are summarized. In Profile > Privacy the Customer can switch on a fixed sentence that the phone line plays before the agent speaks, saying that the call is recorded, that it is with an AI assistant, or both, always or where the country rules we maintain call for it, on outbound calls and, if chosen, on incoming calls. In accounts opened on or after October 12, 2026, it is on by default on outbound calls and follows the country rules; in older accounts it is off until the Customer turns it on. While the recording notice is on, recording starts after the sentence, and where every party must agree to recording the Customer chooses whether to notify and record, or not to record. The Customer can write its own sentence for outbound calls; incoming calls hear the built-in sentence, which is available in 17 languages. When the sentence is off, no recording notice is played. If the Customer turned these options on, the person an agent calls can press 9 during the sentence or the call, and anyone talking to an agent can say that they do not want to be called again, and the number is added to the Customer's do-not-call list. Key 9 is not offered on calls people make to the Customer's numbers.

3.6 Websites a Customer asks us to read. When a Customer asks us to scan a website, we read its public pages. These may include personal data published there, such as staff names and contact details. We keep the text as knowledge for that Customer's agent, and we may store a screenshot of the home page for a demo page.

3.7 Sources. We receive personal data from:

• Customers and their users;
• people who talk to agents;
• websites Customers ask us to read;
• systems Customers connect (CRM, calendar, files, the API and webhooks);
• AI applications Customers connect, such as Claude or ChatGPT;
• Partners who refer customers to us or open accounts for them, and partner sign-in;
• Google sign-in;
• our telephony provider (caller ID, carrier caller name and location);
• our network provider (country).

At a Customer's direction, we also import contacts from its CRM (such as HubSpot).

3.8 Voice and biometric data. We do not create voiceprints or other biometric identifiers from call audio, and we do not ask our providers to create them. Agents recognize returning callers by phone number only (Section 4.3).

4.1 Purposes. We use personal data only for these purposes:

• to run agents for Customers, including analyzing conversations and recognizing returning callers and visitors;
• to run Personal AI Agents for their Owners;
• to contact you about the Service and our offers, where the law allows and with an easy way to opt out;
• to measure our advertising;
• to keep the Service secure and prevent abuse;
• to support, bill and administer accounts;
• to run our partner program, including linking customers to Partners, paying commissions and preventing self-referral;
• to improve the Service with aggregated and de-identified information, as described in Section 5, never with the content of Customers' conversations;
• to keep the records that show compliance with call and message laws, such as opt-outs, consents and privacy setting changes;
• to suggest the privacy and call-compliance settings an account needs (Section 4.9);
• to comply with the law.

We will give notice before we use personal data for any other purpose, and ask for consent where the law requires it.

4.2 Conversation analysis. After each conversation, an AI model records its purpose, topics, sentiment, outcome and follow-ups; whether it was handed to a person; who or what answered (for example, voicemail); key details; contact details the person stated (filled in only where the record was empty); and a score of how well the agent performed. We do not use this to make decisions about individuals. Customers must not rely on it alone for decisions that have legal or similarly significant effects on a person.

4.3 Returning callers and visitors. To continue earlier conversations, an agent receives the last three calls with the same phone number, a summary of calls placed to or imported for that number (by default, in the last 30 days), including what was agreed, and the caller's name if it is known. On websites, an agent receives short notes on the same browser's last three conversations from the past 60 days. Callers are matched by phone number only, so someone else on a shared line may be recognized as the earlier caller. Agents are instructed to confirm the name before treating the caller as that person.

4.4 Calls and messages from UIRIX. When you sign up or buy a plan, we keep your name, phone number, e-mail address, language, time zone and plan, and the IP address, browser and country recorded at sign-up. We use them to contact you about your account. When you sign up and accept our Terms of Service, you agree that we may call you and text you, including with AI voice agents and automatic dialing, about your account, getting started, support and the Service you use (Terms of Service, Section 19); we may also e-mail you about them. We call you about our other products or offers only if you agree to it separately. You can ask us to stop at any time by writing to info@uirix.com or, where the dashboard offers it, in Profile > Privacy, and we stop within 10 business days.

4.5 Review of conversations. We may review the content of conversations, including with the help of AI tools (Section 9.5), to support Customers and to keep the Service safe. We do not use Customers' conversations, recordings or transcripts to improve the Service or for any other purpose of our own.

4.6 No AI training. We do not use Customer Content to train AI models.

4.7 How long we keep our own records. Data in a Customer account, including its conversations, is kept as Sections 3.4 and 12 describe. Records of our own marketing contacts (people who sign up, buy a plan or request a demo, including our demo calls and their recordings) are kept until you ask us to stop contacting you or to delete them. After you opt out, we keep only what we need to honor your request. Account and billing records are kept for as long as the account is open, and after that for as long as tax and accounting law requires. Support e-mails are kept for as long as we need them to support you and your account. Conversations with our help assistant are kept with the account's conversation records, and the conversation-text setting in Section 12 applies to them. Google Analytics keeps the user-level and event-level data of our website for no more than 14 months. Server logs and sign-in records are covered in Section 6, records of connected applications in Section 18.2, and records of our partner program in Section 20.

4.8 Accuracy of AI processing. Transcripts, summaries, translations, contact details extracted from conversations, and the language, intent or outcome detected in a conversation are produced by AI and can be inaccurate or incomplete. We do not guarantee that they are accurate. Customers and Owners should check them before relying on them, and they are responsible for what they do with them. This does not limit your right to have inaccurate personal data about you corrected (Section 14).

4.9 Privacy and compliance advice. To tell a Customer which settings on Profile > Privacy the law of the countries it calls may require and which we recommend, we look at the account's activity in the last 90 days: the numbers and countries it calls, its marketing campaigns and calls, incoming calls and the countries of its numbers, the messages its agents send and the block lists it loaded. The advice is computed by fixed rules from the country rules we maintain, not by an AI model. We show it to the Customer and to the applications the Customer connects, and we do not use it for any other purpose. It is not legal advice (Terms of Service, Section 5.1).

We may create aggregated or de-identified information, such as counts and performance measures. We use it only to run, secure and improve the Service and for business reporting. This information cannot reasonably identify a person, Customer or device. We keep it that way, we do not try to re-identify it, and we require anyone we give it to do the same.

To protect the Service, our users and our business, we may monitor, log, analyze and review activity in the Service, including system logs and operational telemetry, to:

• detect and prevent fraud, spam, malicious activity and policy violations;
• enforce our Terms of Service and security controls;
• keep the Service working and reliable.

We may take the actions we consider appropriate, including limiting features, requiring additional verification, suspending access or closing accounts, subject to the law. We do not guarantee that our systems will detect or prevent all misuse or security incidents.

Our server logs can contain excerpts of conversations and phone numbers. We keep them for as long as we need them for security and troubleshooting. Sign-in session records, with the IP address and device used, are kept while the account is open. A sign-up that is never completed, with the details entered and the IP address and browser used, is kept until the sign-up is completed or started again with the same e-mail address, or until you ask us to delete it at info@uirix.com.

7.1 Our website. Our website uses the storage it needs to work, plus Google Analytics and Google Ads tags that measure visits and the results of our ads, and we may show our ads to people who visited our site. Google Fonts, jsDelivr and our own content delivery network receive your IP address when our pages load fonts, icons and style files. The sign-in and sign-up pages of our dashboard use Cloudflare Turnstile, which checks your browser to stop automated abuse.

7.2 Your choices. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies are not set until you accept them. Our consent banner opens by itself for these visitors, placed by the country our network provider (Cloudflare) reads from the connection, or by the browser's time zone when that is not available, until you accept or decline. Until then, Google's tags may still send Google limited signals without cookies, such as that a page was viewed. If the banner does not open for you there, these cookies stay off. Elsewhere, including Israel and the United States, analytics and advertising cookies are on by default. Wherever you are, you can open the banner and change your choice at any time with "Cookie settings" at the bottom of every page of our website. You can also block or delete cookies and site storage in your browser settings, limit ad personalization in your Google account's ad settings, and install Google's opt-out browser add-on for Google Analytics. Blocking storage the site needs may stop some features from working.

7.3 Our assistant on our website. Our own chat and voice assistant on this site records the page, referrer and campaign tags of the visit whatever you choose in the banner. It also keeps the browser identifier described in Section 21.

7.4 Our dashboard. The pricing page of our dashboard loads the Google Ads tag. When a Customer buys a plan, the payment confirmation page reports the purchase value and a transaction id to Google Ads. This happens in every region.

7.5 Browser signals. We honor Global Privacy Control on our website: when your browser sends it, our advertising cookies and signals stay off for that browser, which opts you out of the sharing Section 9.8 describes. This applies to our website, not to the dashboard pages in Section 7.4. We do not respond to Do Not Track signals.

Where the law requires a legal basis for processing (for example, in the EEA, the UK and Israel), we rely on:

• contract: to provide the Service and run accounts, support and billing;
• legitimate interests: security, abuse prevention, improving the Service, marketing to business contacts where the law allows, and legal claims. You may object to processing based on legitimate interests;
• legal obligation: tax, accounting and lawful requests;
• consent: non-essential cookies in the EEA, the UK and Switzerland, and marketing calls or messages where the law requires consent. You may withdraw consent at any time. Withdrawing it does not affect processing that took place before.

We share personal data as described below.

9.1 Our service providers. Our service providers process personal data only to provide the Service to us, under written terms. Our main providers, including the sub-processors that handle Customer Content, are:

• OpenAI, United States: AI chat, realtime voice, transcription, speech and summaries. In OpenAI browser voice, the visitor's browser connects to OpenAI directly, so OpenAI receives the visitor's IP address and audio;
• Google Cloud, United States: Gemini voice through Vertex AI and the Gemini API;
• Twilio, United States: phone numbers, calls, recordings, text and WhatsApp messages, and verification codes;
• Anthropic, United States: AI tools our staff use to help operate and support the Service (Section 9.5);
• our e-mail delivery provider: the e-mail we send, including transcripts and summaries;
• our hosting provider: the servers and databases of the Service (Section 10);
• Cardcom, Israel: payments and invoices;
• Cloudflare, United States and its global network: network security and delivery, and the Turnstile check on our dashboard's sign-in and sign-up pages.

For our own websites and dashboard we also use Google (sign-in, Analytics, Ads and fonts), jsDelivr (style files and icons), ipapi.co (country detection on the phone-number page) and DeBounce (which checks only the domain of a sign-up e-mail address). We will update this list, and tell Customers by e-mail or in the dashboard, at least 30 days before a new provider starts handling Customer Content. A Customer may object by writing to info@uirix.com. Our Data Processing Addendum is at www.uirix.com/en/dpa.

9.2 Services a Customer connects. At a Customer's direction, we send data to the services it connects: calendars (such as Google Calendar and Microsoft 365), CRMs (such as HubSpot), automation tools (such as Zapier), custom actions that send details from a conversation to a web address the Customer sets, webhook endpoints (conversations, leads and calls, with transcripts and contact details), AI applications connected through our connector or an API key, and the addresses they register for events. Those services' own terms then apply. We are not responsible for the privacy practices of the Connected apps, Partners, integrations or webhook destinations that a Customer chooses to use.

9.3 Notifications. We send leads, requests and messages to the notification e-mail addresses and phone number a Customer sets. After an incoming phone call longer than 20 seconds, we send a summary e-mail to the address the Customer sets, with the caller's number and country, the summary, a rating and the full transcript, and, if enabled, a short text message; the text message, or its WhatsApp version, is also sent after a shorter call of more than 10 seconds in which the caller spoke. A Customer can also choose WhatsApp for these notifications: the call summary, new messages and new leads, with the caller's name and number, are then sent through Twilio and WhatsApp (Meta) to the number the Customer sets. We keep a copy of each call-summary e-mail in our systems. These copies are not covered by the retention settings in Section 12, and we delete them when a Customer asks us at info@uirix.com.

9.4 Webhooks and event deliveries. Customers, and applications they connect, can register web addresses that receive conversation transcripts, summaries, contact details and call results when events occur. We keep a copy of each webhook delivery so it can be resent, until the endpoint is deleted or the conversation-text retention period the Customer sets applies. Copies of event deliveries to connected applications are kept until the account is deleted. When the Customer turns on personal-data masking (Section 12), it applies to the text of every event that carries it: lead and other outcome events, and the transcript and summary in conversation, summary and call events. Contact fields, such as the caller's name, number and e-mail address, are not masked.

9.5 Access by our staff. A limited number of authorized staff can access accounts for support, operation and security. A few senior administrators can sign in to a Customer's account with a single-use link, and each such sign-in is recorded; changes to privacy settings made in that session are recorded under the administrator's name. We use AI tools, including those of Anthropic, to help operate and support the Service, under each provider's business terms.

9.6 Partners. See Section 20.

9.7 Legal requests and business transfers. We may disclose information if we believe in good faith that disclosure is necessary to:

• comply with applicable law, regulation, legal process or a governmental request;
• enforce our Terms of Service and agreements;
• protect the rights, safety and security of UIRIX, Customers, End Users or the public;
• detect, prevent or address fraud, abuse or security incidents.

We may not be able to give advance notice of a disclosure when the law prohibits it, or where notice could compromise security or an investigation. We may also disclose information in connection with a merger, acquisition, restructuring, financing, or sale of all or part of our business or assets, subject to reasonable safeguards.

9.8 No sale. We do not sell personal data for money. We never sell Customer Content or End User data, or share it for advertising. Some advertising cookies on our website, and the purchase report described in Section 7.4, may count as "sharing" of personal data for advertising under some US state laws. You can opt out of this sharing with Cookie settings on our website, by turning on Global Privacy Control in your browser (Section 7.5), by writing to info@uirix.com, or by blocking or deleting these cookies in your browser (Section 7.2).

9.9 Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the service providers that deliver our messages.

Data may be stored and processed in Israel, the United States and other countries where we or our providers operate. Our providers process data mainly in the United States (for example, our AI model, voice and telephony providers) and in Cloudflare's global network. Payments are processed in Israel.

Transfers from the EEA, the UK and Switzerland rely on the adequacy decisions for Israel, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or on standard contractual clauses approved for these transfers. Transfers from Israel follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001. You can ask for a copy of these safeguards at info@uirix.com.

We use technical and organizational measures that include:

• TLS encryption for connections between your browser or application and our websites, dashboard and API;
• salted password hashes;
• Public API keys and the tokens of connected AI applications are stored only as hashes, limited by permissions, expiring and revocable (a key's secret is shown once, when it is created);
• encrypted webhook signing secrets and signed webhook deliveries;
• optional two-step verification by text message;
• limits on failed sign-in attempts;
• security logging.

No system is completely secure. If a security incident affects personal data we hold or process, we will notify affected Customers without undue delay, and notify authorities and individuals where the law requires. We remain responsible for our service providers as our agreements and the law provide. We are not responsible for incidents caused by a Customer's own configuration, credentials or systems, or by third-party services a Customer chooses to connect.

By default, conversation text, call recordings, and summaries with contact details are deleted automatically one year (365 days) after the conversation. The rest of the data in your account is kept for as long as your account is open. This one-year default applies to accounts opened on or after October 12, 2026. In accounts opened before that date nothing is deleted automatically unless the owner chooses a period, which can be one year or any other period in Profile > Privacy.

Your retention settings. In your dashboard, under Profile > Privacy, you can choose another period for each of the following, 7, 30, 90, 180, 365 or 730 days, or keep it for as long as your account is open:

• Conversation text: transcripts of calls and chats, including the details of the actions the agent took.
• Call recordings: the audio itself is deleted, not only the link to it.
• Summaries and contact details: summaries, and the phone numbers, names and e-mail addresses of the people who contacted your agents.

A nightly cleanup permanently deletes data older than the period that applies. Deleted data cannot be recovered.

What these settings do not delete. Usage and billing records are kept so that charges and invoices stay correct. Do-not-call entries, opt-out and consent records, and the log of privacy setting changes are kept as Section 3.4 describes. Your account details, agents, knowledge and the contact lists you upload stay until you delete them or close your account. Summaries we e-mailed stay in the recipients' mailboxes.

Call recording. Phone calls are recorded by default. You can turn recording off under Profile > Privacy, and new calls of your account are then not recorded. You are responsible for telling callers that calls are recorded and for getting any consent the law requires; while it is on, the announcement in Section 3.5 gives the notice for you.

Personal data in API responses. You can have the Public API, our connector and webhook deliveries mask phone numbers, e-mail addresses and card numbers inside the text of conversations, summaries, lead or other outcome records and Personal AI Agent errands, in single records and in lists. Contact fields, such as the caller's name, number and e-mail address, are not masked; access to them depends on the permissions of the key or connected app. This does not change the stored data.

Backups and legal holds. Deleted data may remain in backups for up to 90 days. We may keep data longer where the law requires it or to resolve a dispute.

13.1 What not to put in the Service. Unless we agree otherwise in writing, do not use the Service for:

• health information protected by HIPAA (we do not sign business associate agreements);
• government ID numbers;
• full payment card numbers or security codes;
• bank credentials, passwords or one-time codes;
• biometric data;
• sensitive data about children.

Section 13.3 explains what an Owner may store in the Personal AI Agent profile.

13.2 Card numbers. Do not set agents to collect card numbers. Send a payment link instead. When a valid card number is typed anyway in a chat on a website or in the dashboard, or said in a voice conversation on a website or in the dashboard, we mask it (replace it with a marker) in the stored text. Transcripts of phone calls may keep what was said, recordings keep the audio, and imported conversations keep what was imported.

13.3 Personal AI Agent profile. The Personal AI Agent profile holds what the Owner chooses to tell it, such as the names and numbers of people and providers, customer numbers, address, routine and preferences. An Owner may also store their own date of birth, ID number, health fund and health providers for errands that need them. These sensitive details are stored only if the Owner chooses to add them. The profile is sent to our AI providers on calls and to the AI application the Owner connects, and the Owner can remove entries or clear it at any time. It is built to refuse entries that look like passwords, verification codes or payment card numbers. Do not give it bank account numbers or other secrets. Health providers and health-related errands are also covered by Section 25.

14.1 Your rights. Depending on where you live, you may ask us for access to your personal data, a copy of it in a portable format, correction, deletion, restriction or objection, and withdrawal of any consent you gave. Where a US state law gives you these rights, you may also opt out of the sale or sharing of your data, of targeted advertising and of profiling, and limit the use of sensitive data. Requests are free, unless the law allows a fee or a refusal for requests that are manifestly unfounded or excessive. We will not discriminate against you for using a right.

14.2 How to ask. Write to info@uirix.com. We answer within 30 days, or sooner where the law requires, and we act on a request to opt out of sharing or targeted advertising within 15 business days. We may need to verify your identity. An authorized agent may act for you with proof of authority.

14.3 Appeals and complaints. If we refuse a request, you may appeal by replying "Appeal" to our answer. We will answer the appeal in writing within 45 days, or within the longer period your state's law allows, and explain our reasons. If we deny it, we will tell you how to contact your state Attorney General or data protection authority. You may also complain to a data protection authority: in the EU or EEA, your local authority; in the UK, the Information Commissioner's Office; in Israel, the Privacy Protection Authority. If you are in the UK and you complain to us, we acknowledge your complaint within 30 days.

14.4 End Users. If you talked with, or were called by, an agent that a business Customer runs on UIRIX, that Customer decides how your data is used, and you should contact it first (see Section 22). We forward the requests we receive to the Customer and help it answer, including by deleting one person's conversations, recordings and contact details on its instruction.

14.5 Closing an account. To close an account, write to info@uirix.com from the account's e-mail address. We will revoke the account's API keys and connected-app access, release its phone numbers, and delete the account and its content, except records we must keep under Sections 4.7 and 12 (for example, billing and tax records). Do-not-call and opt-out records are kept as long as needed to honor them. Before closing, a Customer can read its conversations through the Public API or ask us for a copy.

Accounts are for adults: you must be at least 18 years old, or the age of majority where you live if that is higher (see Section 1.3 of our Terms of Service). We do not knowingly collect personal data from children for our own purposes.

The Owner of a Personal AI Agent may add family members, including children, with a name, phone number and call rule, so that the agent recognizes them when they call. Calls with a child are recorded and transcribed like other calls unless the Owner turns recording off. By adding a child under 13, the Owner confirms that they are the child's parent or legal guardian and consents to this processing for the child. The Owner can remove the child from the profile at any time, and the child's calls are deleted as Section 12 describes or when the Owner asks us at info@uirix.com.

A Customer's agents may talk with people whose age they do not know, and the Customer is responsible for complying with the laws that protect children. If you believe we hold a child's data without proper permission, write to info@uirix.com and we will delete it.

We will post any update here with a new version number and date. For a material change, we will notify Customers by e-mail or in the dashboard at least 30 days before it applies, and ask for consent where the law requires it.

This Policy may be offered in languages other than English for convenience. If a translation differs from the English version, the English version controls, unless the law that applies to you requires otherwise.

Write to info@uirix.com for support, billing, privacy requests, account closure and security reports, including suspected unauthorized use of an account, API key or connected app. We answer privacy requests within 30 days, or sooner where the law requires.

Mail: UIRIX AI, 447 Broadway, 2nd FL #239, New York, NY 10013, United States.

Phone: +1 646-679-6818.

An AI application such as Claude or ChatGPT that a Customer connects through our connector, or that uses an API key the Customer creates, reads and changes the account on the Customer's instructions, within the permissions the Customer approved.

18.1 What we send. As the Customer's requests need it, we send the application: agents and knowledge; conversations with full transcripts, including callers' words and contact details; leads and results; contacts; the Personal AI Agent profile; usage and balance; and the account's privacy settings, with the advice on them (Section 4.9) and the latest entries of the log of setting changes. Where available, we also send the live transcript of a call that the Customer or Owner follows. Through the connector we never send call recordings. An API key with the recordings permission can download them. Masking of personal data is off unless the Customer turns it on in Profile > Privacy (Section 12). Masking covers the text of conversations, summaries, outcome records and errands. Contact fields, such as the caller's name, number and e-mail address, are not masked. The application's provider handles this data under its own terms, possibly in the United States.

18.2 What we receive and keep. From the application we receive what it sends to our tools; its registration details (its name, the addresses it declares and the IP address it registered from); and, for each request, the time, the operation, the result, the key used, the IP address and the software (user agent). We use these to run, bill, secure and audit the Service, and never for advertising, sale or AI training. Request records are kept for 12 months, and token records for 30 days after they expire. Records of connected applications and API keys, including revoked keys and the IP address of their last use, are kept while the account is open. An application's registration is not tied to one account and is kept so that the application can connect again.

18.3 Permissions. Reading is always on. It includes letting the application receive call and lead notifications (caller name, number and summary) at an address it registers. Changes and webhooks are on by default, and the Customer can switch them off on the approval screen. With changes allowed, the application can also change the account's privacy settings; a change that turns a protection off or sets data to be deleted needs the Customer's explicit confirmation, which the application reports and we cannot verify. Calls from UIRIX (Section 4.4) and national block lists can be changed only in the dashboard. Outbound calls are off unless the Customer allows them.

18.4 Ending a connection. A connection lasts up to three years unless the Customer ends it sooner. Disconnecting an application under Profile > API Keys > Connected apps also disables the webhooks it created and ends its event subscriptions. Revoking an API key the Customer created, under Profile > API keys, ends its event subscriptions, but webhooks created with that key keep running until the Customer disables them under the agent's Integrations > Webhooks. Removing UIRIX inside the application alone does not end the connection.

18.5 Business Customers. A business that connects an application is responsible for sharing its End Users' data with that application's provider. We are not responsible for the privacy practices of the applications a Customer connects.

A Personal AI Agent answers and places calls for one individual, the Owner.

19.1 The profile. The Owner builds the profile by chatting with the agent or through an AI application the Owner connects. It can hold: the name to use, language, city, time zone, date of birth, ID number, home address and whether it may be shared, work details, people (relationship, phone number and how their calls are handled), accounts and services with customer or contract numbers, regular providers (for example, doctors or garages), routine, preferences and notes. Sensitive details, such as the date of birth, ID number, health fund or doctors, are stored only if the Owner chooses to add them. It is built to refuse entries that look like passwords, verification codes or payment card numbers. Do not give it bank account numbers or other secrets.

19.2 How the profile is used. The profile is part of the agent's knowledge. Everything in it, including the sensitive details the Owner added (such as a date of birth, an ID number, a health fund or doctors), is sent to our AI providers (OpenAI or Google, Section 9.1) at the start of every call and chat the agent handles, and to the AI application the Owner connects whenever that application reads the profile. During an errand, the agent tells the business or person it calls the details the task needs, such as the date of birth or ID number for an appointment, and they then keep those details under their own practices. The home address is given only if the Owner allowed it. Do not add details you do not want used this way.

19.3 Calls. For calls the agent makes or answers for the Owner, including calls forwarded from the Owner's phone, we process the other person's voice, words and number; record the call unless recording is turned off; give the Owner a transcript and summary (live in the AI application when the Owner follows the call, where available); and keep the instructions of each errand. When the Owner searches contacts, the agent looks in the profile, in names that callers gave and in earlier errands.

19.4 Removing data. The Owner can remove people, accounts, providers, whole topics or the entire profile. Call records are kept as described in Section 12. Errand instructions are kept for as long as the account is open, and the retention settings in Section 12 do not delete them.

20.1 What a Partner sends us. A Partner may open an account for a Customer. It sends us the details the Customer gave it: company name, sign-in e-mail address, the chosen password (we store only a hash of it), website, language and the Partner's own reference. Partner sign-in links the two accounts in both directions. We link an existing account to a Partner only at the Customer's written request, and we tell the Customer before we do.

20.2 What the Partner receives. For accounts it opened or that are linked to it, the Partner receives the account details, plan, Wallet balance, agent setup status, website widget code, agent greeting, the website pages we scanned and a demonstration address. The Partner may also choose the voice provider of the Customer's agents.

20.3 Partner sign-in links. With each request the Partner makes about the account (for example, each lookup), it also receives a single-use link, valid for 10 minutes, that opens the Customer's dashboard for up to 15 minutes with full access, including conversations, recordings and contacts. During a partner sign-in session, the Partner can do anything the Customer can do in the dashboard, including creating API keys. Review your API keys after any partner sign-in.

20.4 The Partner's own policy. The Partner handles the data it receives under its own privacy policy, and we are not responsible for its privacy practices. A Customer may ask us at info@uirix.com to end the link between its account and the Partner.

20.5 Partner program applicants. If you apply to our partner program, we collect your answers to the application questions, your company and contact details, and the IP address and time of your application and of your acceptance of the partner terms. If you take part in the program and we pay you commissions, we also collect your payout and tax details, which we keep encrypted. We use this data to review applications, run the program, pay commissions, meet tax duties and prevent fraud. We give payout details only to the bank or payment service that makes the payment (for example, PayPal), and tax details to tax authorities where the law requires.

20.6 Records of accepted terms and consents. When you accept partner terms, enter a partner code or allow a Partner to manage your account, we record the document, its version, the time and your IP address. We keep partner program records, including commissions, payouts and these records, while the account is open and afterwards for as long as tax and accounting law requires or as needed to resolve a dispute.

20.7 What a Partner sees about you. If a Partner referred you, for example with a partner code, it sees your e-mail address in masked form, the month you signed up, the status of your account, how you joined, and the amounts of your payments and of its commission. If a Partner opened your account, or you allowed a Partner to manage it, the Partner can also see and change your account and agents as needed to manage them, which can include your agents' conversations, calls and contacts, for example through the Public API or a Connected app. You can ask us at info@uirix.com to end a Partner's access.

20.8 Fraud checks. To prevent self-referral and abuse, we compare the details of a sign-up (phone number, IP address and browser, e-mail domain and payment card token) with the Partner's own details.

The website owner (our Customer) decides to use the widget and must inform its visitors and obtain any consent the law requires.

The widget's own code sets no cookies. Our network provider may set cookies it needs for security. In the visitor's browser, the widget stores a session id, its open or closed state and mode, the first page of the visit, and the site's analytics choice if the site gives one. In its own frame it keeps a visitor id with no expiry date, so the agent can recognize the same browser and recall earlier conversations on that site.

The widget sends us the messages or voice, the IP address and the browser type. Unless the site has told the widget that the visitor declined analytics, it also sends the page address and title, the referrer, the first page of the visit, and campaign tags and ad click ids. It uses the microphone only after the browser asks for permission. For some agents, the browser connects directly to OpenAI for the voice conversation.

We store the full IP address and show the Customer only the country. If a site passes us a visitor's do-not-sell request, we store it and give it to the Customer. We never sell widget data or share it for advertising.

The agent is an AI system run by a business or a person (our Customer), who decides how your data is used. We process it on their behalf. Conversations are transcribed and summarized, and calls are recorded unless the Customer turned recording off. If the Customer turned these options on, the phone line tells you before the agent speaks that the call is recorded or that you are talking to an AI assistant, and you can say that you do not want to be called again, or, on a call the agent placed to you, press 9, to be added to the Customer's do-not-call list. The Customer sees what you said and the details you gave.

To access, correct or delete your data, or to stop further calls, contact that business or person. If you cannot tell who it was, write to info@uirix.com with the number that called you, or the website, and the date. We will pass your request to them. Where the agent works for an individual rather than a business, you may also send your request to us directly (Section 2.3).

This Section applies to residents of US states whose privacy laws give consumers rights over their personal data. It describes our own practices as a controller (Section 2.1). For data we process for a business Customer, contact that Customer first (Section 22).

Your rights. Depending on your state, you may ask us to confirm whether we process your personal data, to access it, to get a copy in a portable format, to correct it and to delete it, and you may opt out of targeted advertising, of the sale or sharing of your personal data and of profiling that has legal or similarly significant effects. Section 14 describes these rights.

How to ask. Write to info@uirix.com. We may need to verify your identity, and an authorized agent may act for you with proof of authority. We answer within 30 days, or sooner where the law requires.

Appeals. If we refuse your request, you may appeal by replying "Appeal" to our answer, as Section 14.3 describes. If we deny the appeal, we will tell you how to contact your state Attorney General.

No discrimination. We will not deny you the Service, charge you a different price or give you a different level of service because you used a privacy right.

What we collect and share. In the last 12 months, we collected the categories of personal data listed in Section 3, from the sources listed there, for the purposes in Section 4, and disclosed them to the categories of recipients in Section 9. We do not sell personal data for money. Some advertising cookies on our website may count as "sharing" of personal data for advertising, or as targeted advertising, under some state laws (Sections 7 and 9.8). The categories shared in this way are identifiers (such as IP address and cookie ids) and internet activity on our websites (pages visited and ad clicks), and the recipient is Google. You can opt out with Cookie settings on our website, with Global Privacy Control (Section 7.5), by writing to info@uirix.com, or by blocking or deleting these cookies in your browser (Section 7.2). We do not knowingly sell or share the personal data of consumers under 16.

Sensitive data. We collect sensitive personal data only as Section 3 describes (account log-in details, the contents of calls and messages, and, if an Owner adds them, the ID number, health fund and health providers in a Personal AI Agent profile), and we use it only to provide the Service and for other purposes the law permits, so we do not offer a separate right to limit it.

Retention. We keep personal data as Sections 4.7 and 12 describe.

The company named in Section 1.1 is the controller of the account, billing, support and website data described in Section 2. For data that business Customers process through the Service about their own callers and visitors, the Customer is the controller. Section 2.3 explains our role for Personal AI Agents.

You have no legal duty to give us data, and giving it depends on your will and consent. The exceptions are the billing details that tax law requires on invoices, and any data that a law or a court order requires. Without your name, e-mail address, phone number and, for paid plans, billing details, we cannot open or run an account.

We use the data for the purposes in Section 4, keep it as Sections 4.7 and 12 describe, and give it to the recipients in Section 9 for the purposes stated there. You may review the data we hold about you, and ask us to correct or delete data that is inaccurate, incomplete, unclear or out of date, by writing to info@uirix.com.

This Section covers consumer health data, as defined by Washington's My Health My Data Act and similar state laws, that your Personal AI Agent handles: the doctors, clinics, dentists and health fund you list, and the appointments and health-related errands your agent calls about, including their call notes and summaries. Your agent holds this data only if you choose to add it or ask it for such an errand.

Sources: you, the AI assistant you connect to UIRIX, and the providers your agent speaks with.

Purpose: only to run the calls and errands you ask for.

Sharing: we share it only as needed for those errands: with the provider concerned on the call and the people your agent speaks with; with our service providers (AI model, telephony and hosting providers, listed in Section 9.1); and with the AI assistant applications you connect. We never sell it.

Your rights: you may ask us to confirm whether we hold your consumer health data, to see it and the list of third parties we shared it with, to delete it, or to withdraw any consent you gave, by writing to info@uirix.com. You may delete profile entries yourself at any time. If we refuse a request, you may appeal by replying to our answer. If the appeal is denied, you may contact the Washington Attorney General.