Data handling, retention, and HIPAA

This article explains what data VoiceCraft collects during calls, how long it is kept, and the limits of HIPAA compliance in the current product.

What data is collected

During each call, VoiceCraft may collect and store:

• Call metadata: caller phone number, call duration, timestamp, outcome

• Transcripts: a text record of everything said on the call

• Call recordings: an audio file of the call (only if you have enabled the Record calls toggle on your agent)

• Contact records: name, phone number, and any information the caller provided during the call

• Customer stories: AI-generated summaries derived from transcripts

Where data is stored

Call recordings are stored in Cloudflare R2 (object storage). Transcripts, contact records, and call metadata are stored in a hosted PostgreSQL database. All data is scoped to your organization — other VoiceCraft customers cannot access your data.

Data retention

You control how long deleted agent data is kept before it is permanently purged.

1. In the sidebar, go to Settings.

2. Find the Data retention section.

3. Select a retention window: 30 days, 90 days, 1 year, 2 years, or Forever.

Only the workspace Owner can change the retention setting. Call history, appointments, and conversations are preserved during the retention window; agents deleted within the window can be recovered.

Call recording

Call recording is off by default. To enable it:

1. Open your agent and go to Settings.

2. Toggle Record calls on.

When enabled, all calls handled by that agent are recorded. Inform callers that calls may be recorded, in accordance with your local laws (many jurisdictions require two-party consent).

HIPAA disclosure

VoiceCraft has HIPAA infrastructure in progress, including Business Associate Agreement (BAA) acceptance tracking. Whether a BAA is available for your account depends on your plan and review status.

If you are a healthcare provider subject to HIPAA, contact support to request a BAA and confirm your organization's HIPAA review status before using VoiceCraft to collect, transmit, or store Protected Health Information (PHI) — such as patient diagnoses, treatment details, or insurance information.

Using VoiceCraft for general appointment scheduling (name, date, time) without collecting clinical details is lower risk but is not a substitute for legal advice. Consult your compliance officer or legal counsel before deploying the platform in a clinical environment.

Data deletion

To delete a contact and their associated data, open the contact record and use the delete option. To delete an agent and its data, go to the agent's settings and select Delete agent. Deleted data is held for the retention window you configured, then permanently purged.