Voice Data Terms
This is the data processing agreement for Troctor Voice, the phone receptionist. It is the document your lawyer means when they ask for a DPA, and it is written the way the rest of this site is written, so you can read it yourself in ten minutes and know what you are signing. The short version: your callers' details are yours, not ours. You decide what happens to them, we act on what you decide, and everything below says how that is arranged, who else touches a call, what actually protects it, what we will tell you if something goes wrong, and what is deleted when this ends. It applies to Voice only; the Mac app and Troctor Next are covered by the Terms of Use and the Privacy Policy.
Who this is between
These terms are between Globyskytek LLC, a North Carolina limited liability company that operates Troctor, and the venue whose phone line Troctor Voice answers. They form part of our Terms of Use and they take effect the moment Voice starts answering your calls, whether you are in the free closed beta or paying for it later.
They cover the personal data of your callers: the people who ring your restaurant. They do not cover your own account with us, the email address you signed up with, your licence, or the logins your staff use, because that data is ours to be responsible for rather than yours, and the Privacy Policy is where it is described.
Who is responsible for what
You are the controller and we are the processor. That is the whole of the allocation, and in ordinary words it means you decide what happens to your callers' details and we do what you decide. It is the same arrangement you already have with your booking book and your till, and it is written down here because a phone answered by software makes people want it in writing.
Underneath that sentence are four facts, which are the ones every data protection law asks a contract to state:
No audio is recorded, by us or for you. There is no call recording in this product, no setting that turns one on, and nothing written to disk anywhere on the audio path. The words of a call reach durable storage only as text.
What we do with caller data
We process it on your instructions and for nothing else. Your instructions are these terms plus the settings you choose in your console: your hours, your menu, your tables, which services are on, what the assistant is taught to say, and whether the order texts are sent. Changing a setting is you giving us a new instruction, which is why the console is the honest place for those decisions to live rather than an email to us.
What that rules out, stated as flatly as we can:
- We do not use your callers' details for any purpose of our own.
- We do not sell them, rent them, or share them with anybody for marketing or advertising, and there is no advertising anywhere in Troctor to share them with.
- We do not send your callers anything except the order texts you switched on, which carry the order number, a word when it is ready, and a word if the kitchen has to change or cancel it. No marketing, ever, from us.
- We do not build profiles of callers across calls or across venues, keep voiceprints, or analyse how a caller sounds.
- We do not move a caller's details from your workspace into another venue's, or into any pooled dataset of ours.
Two exceptions, named rather than left to be discovered. We process what we must to keep the service running and secure, which means counting calls, watching for failures and holding the technical receipts. And if the law requires us to hand something over, we will comply, and we will tell you first unless we are prohibited from telling you.
Access on our side is limited to the people who need it to run Troctor, and they are under a duty of confidentiality. Today that is one person, which is stated plainly in what actually protects it rather than dressed up as a team.
The notice, and the part that is yours
We handle the AI disclosure and you cannot switch it off. The first thing the agent says on every call identifies it as an AI assistant, says the call is transcribed, and offers the caller a way out: say "no recording" and a message is taken with no transcript kept. That sentence is ours, it is identical at every venue, there is no field in your console that could reword it, and we keep a technical receipt for every call proving it finished before anything was transcribed. Callers whose area code belongs to a state where everyone on a call has to agree are asked one further question, and a caller who declines gets a message taken with no transcript kept. The privacy policy describes both in full.
Everything else you owe your callers is yours. We are the software; you are the business they rang. So the privacy notice on your website, any signage or menu wording, telling your staff how the line now works, and deciding that using Voice on your line is lawful where you operate and for the callers you serve, are all yours to do. We cannot do them for you and nothing here moves them to us. The Voice section of the Terms of Use says the same thing in the contract that sits above this one.
One specific worth pulling out, because it is easy to get wrong by being helpful. The order texts are registered as transactional messages, which means no marketing and no links. The pickup and delivery note you type in your settings is put into the text a caller receives, so a discount code or a website address in that note turns a transactional message into a marketing one under our registration and yours. Keep the note to what the caller needs in order to collect their food.
Who else touches a call
Answering a phone in real time takes several companies, and here is every one of them, what it does, and what it sees. They are our sub-processors, each bound by its own contract with us to process what it receives only to provide its part of the service. The same list is in the privacy policy, because your callers deserve to read it too.
Deepgram is also the fallback voice, on a line where Cartesia is not configured, so the phone keeps being answered rather than going silent.
Adding one is something we tell you about first. We will give you notice before a new sub-processor starts handling your callers' data, at the notification address on your workspace, and if you object we will either work around it or let you out of the agreement without penalty. The current list is always this page, and you can ask for it in writing at privacy@troctor.com. We stay responsible to you for what any of them does with your callers' data.
What actually protects it
This section describes mechanisms that exist in the code today rather than intentions, which is the same standard the security page holds itself to.
And what this is not, because a security section that only lists strengths is a sales page. We hold no SOC 2 report, no ISO 27001 certificate and no independent penetration test, and we will not imply otherwise on a questionnaire. Troctor is one person, so there is no separation of duties to describe. And one piece of advice rather than a mechanism: sign your kitchen tablet in on a dedicated staff account rather than the owner's, because a tablet session is not yet scoped to the device and cannot be revoked device by device, so removing that account is how you take a tablet out of service. We would rather you knew that than found it out.
If you find a hole in any of this, security@troctor.com reaches us directly.
If something goes wrong
If we discover a breach affecting your callers' personal data, we will tell you without undue delay and in any case within 72 hours of becoming aware of it. Not when we have finished investigating, and not once we have decided how serious it is: within 72 hours of knowing.
What that message will contain: what happened and when, which of your callers and which fields are affected as far as we can tell at that point, what we have done to stop it, and what we think you should do. We will keep you updated as we learn more rather than sending one message and going quiet, and we will help you with any notification you have to make to your callers or to a regulator, including giving you what you need in writing. It goes to the notification address on your workspace, and to your phone if the address bounces.
How long things are kept
You can ask us to delete any of it at any time, in whole or for one caller, and we will. What does not exist yet is a retention control you can set yourself: there is no slider in the console that shortens the ninety days, so today the way to get a shorter period is to ask us for one and we will hold ourselves to it.
When this ends
Within 30 days of the end of the agreement we delete your workspace and everything under it: the call records, any transcript still inside its ninety days, the bookings, the orders, the messages, the menu and the settings. You do not have to ask, and we do not keep a copy for ourselves.
Two things to know before that clock starts. There is no export button in the console today, so if you want your bookings or your order history to take with you, ask before the deletion and we will produce a copy by hand; afterwards there is nothing to produce. And the consent receipts may outlive the rest, to the end of their four years, because they are the proof that those calls were disclosed to your callers and to your benefit as much as ours. They hold no phone number and nothing anybody said.
Archiving is not deletion, and the two sit near each other in our console, so it is worth being exact. Archiving stops your line being answered and hides the workspace from your staff. Everything under it stays where it was until somebody deletes it, which is what the paragraph above is for.
No training on your callers
We do not train models on your callers' data, and there is no model of ours to train. The transcript of a call goes to a model vendor to compose the reply and to write the summary, on our accounts and under our contracts, and for nothing else. Where a vendor offers a setting that stops content being retained for training, we choose it. Where one does not offer that control we will say so rather than implying a promise we cannot keep.
The same applies to us: your calls are not a dataset. One honest qualification rather than a flat claim, because we read calls in your first days live and it would be silly to pretend nothing is learned from them. What we learn about how the assistant handles a conversation can change the script every venue works from. What never leaves your workspace is your callers: no detail of theirs is copied into another venue's records or into anything of ours, and the teaching feature that turns an answer into something the assistant says next time works inside your workspace only.
When a caller exercises a right
A caller can ask to see what is held about them, correct it, or have it deleted. Because the data is yours, the decision is yours and we act on it.
- If the request reaches you, you can cancel a booking or an order in your own console straight away. Erasing a record is us rather than a button of yours: tell us what to remove and we will do it within 30 days of your instruction, sooner if the law gives you a shorter deadline.
- If the request reaches us, we will not act on it alone. We will pass it to you, help you answer it, and tell the caller that we have done so, so nobody is left waiting in silence. Where the law puts the duty directly on us rather than on you, we will act and tell you what we did.
- What neither of us can do is find one person across venues. There are no caller profiles to search, and a phone number is not a key that opens anything here, because the one collection built around a caller holds a salted hash rather than a number.
Callers can write to us at privacy@troctor.com, and the privacy policy tells them so in their own words rather than in yours.
Where it runs
We are based in the United States and the venues in this beta are in the United States and Canada. Your workspace and everything in it live in Google Cloud in the United States. The sub-processors named above may process data in the United States or elsewhere under their own arrangements. Where personal data moves out of the UK or the EEA we rely on Standard Contractual Clauses or another approved safeguard, the same as the rest of Troctor.
Changes
We may update these terms. If a change is material, or if a sub-processor is being added, we will tell the notification address on your workspace before it takes effect, and the date at the top of this page will change with it. Voice is in a closed beta, so the honest expectation is that this page moves as the product does, and every move is dated.
Signing this
These terms apply to every venue using Voice without anything being signed. If your own paperwork needs a signed copy, or your insurer or your franchise wants one on file, write to legal@troctor.com and we will send it back with our name on it and yours on the front. If you have a form of your own you would rather use, send that instead and we will read it properly rather than refusing on principle.
Anything else about this page goes to privacy@troctor.com, or by post to Globyskytek LLC, #2150, 207 W Millbrook Road, Suite 210, Raleigh, NC 27609, United States.