Privacy Policy

This policy covers three product surfaces:

• Envoy CRM — our AI-native CRM platform: contacts, conversations across messaging channels, pipeline, orders, meetings, files, and the AI features that operate inside them.
• Volty — our self-serve, managed AI teammate. Volty is a pooled multi-tenant service; each organisation's data is isolated at the database layer by Postgres Row-Level Security. Volty's runtime guardrails are documented at AI Ethics & Guardrails; the full architecture is at the Volty platform whitepaper.
• Custom AI Agents — bespoke agents we scope, build, and operate for your business workflows, under the guardrails documented at AI Ethics & Guardrails.

Where the three surfaces handle data differently, we say so explicitly. The runtime architecture for the agents themselves (capability scoping, audit trail, human-in-the-loop) is separately documented at /ai-ethics.

Envoy CRM and Volty both store the data you and your team add directly, plus the data that flows in from the channels you connect. The two products have different architectures — Envoy is application-scoped, Volty is Row-Level-Security-isolated in a pooled multi-tenant deployment — but the data categories are similar. Envoy-specific handling is described first (§2.1–§2.3); Volty-specific handling follows (§2.4–§2.7).

Voltade builds AI agents on three related platforms. Envoy CRM uses an in-product AI assistant and AI-assisted reply layer that send context (recent messages, the contact's profile, your knowledge base entries) to OpenAI, and persist the model provider's response id alongside our own usage telemetry. Voice-enabled Envoy features additionally use ElevenLabs for speech synthesis where enabled. Volty runs a bounded, journalled "wake" per conversation: the agent sees only the conversation it is scoped to, its context is drawn from the connected channel and your organisation's knowledge drive, and every model call is routed through our hosted Bifrost model gateway (based on the open-source maximhq/bifrost project, configured and operated by Voltade) under a per-organisation virtual key. Custom AI Agents run under the guardrails documented at AI Ethics & Guardrails, which also covers Volty's runtime in detail.

Across all three surfaces:

• Per-customer scope — for an inbound message from contact X, an agent has access to that contact's record, conversation history, and your organisation's knowledge base. It does not see other customers' data.
• Bounded execution — every agent run has a token budget and a defined exit; long-running work is queued asynchronously.
• Trace records — we record per-call usage (feature, model, token counts, estimated cost, and the model provider's response id). Our hosted Bifrost gateway retains request and response logs for a rolling operational window used to investigate incidents and calibrate cost.
• Output guardrails — model responses pass through a sanitiser that removes leaked internal instructions or chain-of-thought before reaching customers.

• To provide, operate, and improve the Services you've subscribed to.
• To run the AI agents you've configured — analysing inbound messages, drafting replies, retrieving relevant records, and escalating to humans when guardrails require it.
• To process payments, issue invoices, and administer your account.
• To respond to support requests, security incidents, and lawful regulatory obligations.
• To produce aggregated, de-identified diagnostics that help us measure reliability and improve the product.
• To send service-related communications (account, billing, security). Marketing communications are sent only with your consent and you can opt out at any time.

Voltade Services use multiple large language model providers. Model calls in Volty are routed through a hosted Bifrost gateway we operate — a deployment of the open-source maximhq/bifrost project, configured with per-organisation virtual keys, cost metering, and failover across models. The current set of providers is:

• Anthropic (Claude) — primary reasoning model for Volty and for Custom AI Agents. Anthropic does not train its models on data submitted via API, and our account is configured for zero-retention. Anthropic Commercial Terms.
• OpenAI — primary reasoning model for Envoy CRM's in-product AI; also used across Volty and Custom AI Agents for reasoning, vision (Volty drive extraction), and embedding generation. OpenAI API content is not used to train OpenAI models. OpenAI Enterprise Privacy.
• Google (Gemini) — reasoning and grounded web-search results in Volty. Google API content submitted via the paid Gemini API is not used to train Google models under Google's paid-API terms.
• DeepSeek — reasoning model available to Volty for cost-tier selection.
• Moonshot (Kimi) — reasoning model available to Volty for cost-tier selection.
• Xiaomi (MiMo) — reasoning model available to Volty for cost-tier selection.
• Z.AI — reasoning model available to Volty for cost-tier selection.
• Models routed via OpenRouter — additional models available to Volty for cost-tier selection.
• ElevenLabs — voice synthesis for voice-enabled Custom AI Agents (not used by Volty).

In Volty, model selection is tiered by your subscription plan; the agent uses the highest-quality available model in your tier and falls back to the next-ranked model on provider failure. Envoy CRM uses a narrower subset — primarily OpenAI for in-product AI reasoning, with ElevenLabs for voice synthesis where enabled. Custom AI Agents draw from Anthropic and OpenAI depending on the engagement. We may add or substitute model providers as the field evolves. Material changes are reflected in this page and, where relevant, in the subprocessor list at §7.

We send the minimum context an agent needs for the task at hand — recent messages and the relevant slice of your knowledge base or drive, not a full database dump.

When you authorise an integration (Microsoft 365, Google Workspace, Salesforce, Shopify, WooCommerce, Odoo, HubSpot, Telegram, Meta channels, and others), you grant Voltade scoped access to that connected account. We use that access only for the features you've turned on. You can revoke an integration at any time from inside the product or from the third-party platform; we will stop processing immediately and begin deletion of cached data within 30 days.

The current authoritative integrations list is published at /integrations.

We work with the third parties below to deliver Envoy CRM and Custom AI Agents. Each is bound by confidentiality and, where applicable, a Data Processing Agreement.

We do not sell personal data, and we do not share it with advertising networks for cross-site profiling.

Envoy CRM customer data is stored in Singapore (Hetzner Cloud Kubernetes with in-cluster CloudNativePG Postgres, AWS Singapore region for object storage, backups, and email). Volty customer data is stored in Singapore (AWS Aurora Postgres, S3, and SES in ap-southeast-1).

Some subprocessors operate outside Singapore. AI model providers accessed via Bifrost include operators in the United States (Anthropic, OpenAI, Google Gemini, OpenRouter) and in China (DeepSeek, Moonshot, Xiaomi, Z.AI). ElevenLabs (US) is used only for voice-enabled Custom AI Agents. Channel providers (Meta, Google Workspace, Microsoft 365) operate across multiple jurisdictions. Where personal data leaves Singapore, we rely on contractual safeguards meeting PDPA Section 26 standards of protection.

Envoy CRM and Custom AI Agents:

• Account and billing records — retained for the life of the account plus 7 years to meet Singapore tax and accounting requirements.
• Envoy contacts, conversations, pipeline, orders, attachments, meetings — retained for the life of your subscription. On request, or within a reasonable period after subscription termination, we delete these records. Some derived analytics and irretrievable backups may persist beyond that point until they roll off; see the backup item below.
• Audit log of edits to records — retained for the life of the subscription so you can investigate what changed and when.
• AI usage telemetry — feature, model, token counts, response id (no prompt/response body). Retained for product analytics and cost allocation.
• Postgres backups — managed by CloudNativePG with a rolling retention window.

Volty:

• Volty contacts, conversations, knowledge drive, memory — retained for the life of your organisation. Soft-deleted conversations, contacts, and inboxes hard-purge after a 30-day grace period; drive trash purges after 30 days.
• Organisation deletion — enters a 30-day grace period (logins blocked, cancellable). After 30 days, all customer data for the organisation is purged.
• User account deletion — anonymised immediately on request (email replaced with a placeholder, name and phone scrubbed, sessions hard-deleted).
• Contact Forget — anonymises the contact record and redacts merge snapshots; you can additionally request purge of conversation history under this contact.
• Operation events (agent audit trail) — retained for approximately 3 months.
• Admin audit and inbox audit — retained up to 12 months per policy.
• Postgres backups — a multi-day point-in-time recovery window on managed Aurora Postgres.

You can request deletion of your data at any time by emailing [email protected], or (for Volty) directly from within the product. We will action the request within 30 days unless a legal obligation requires longer retention, in which case we will tell you.

We encrypt data in transit (TLS 1.2+) and at rest. Production access is restricted, MFA-enforced, and logged. We hold:

• Singapore CSA Cyber Essentials Mark.
• CASA Tier 2 Cloud Application Security Assessment.
• Pre-Approved Solution under IMDA's SMEs Go Digital programme.

Volty-specific controls. Tenant isolation is enforced at the database layer by Postgres Row-Level Security policies keyed on the customer's organisation identifier, applied per-transaction; the Volty application database role cannot bypass Row-Level Security. Contact-triggered agent wakes run with a further-de-escalated read scope confined to a single conversation and contact. Sensitive configuration secrets (channel access tokens, connected-mailbox credentials, third-party integration credentials) are envelope-encrypted at rest with per-domain key encryption keys. Model-inference calls are routed through our hosted Bifrost gateway under per-organisation virtual keys.

Breach notification. We will notify affected customers and the Singapore Personal Data Protection Commission of any notifiable data breach within 72 hours of confirming that the breach meets the PDPA notification threshold. The full register of certifications and controls lives in the Trust Centre.

Under the PDPA you may:

• Confirm whether Voltade holds personal data about you and request a copy.
• Correct any inaccurate or incomplete personal data — including memory entries an agent has stored about you.
• Withdraw consent (we will tell you the consequences before doing so).
• Revoke any third-party integration you previously authorised.
• Lodge a complaint with the PDPC if you believe we have not handled a request properly.

Submit requests to [email protected]. We respond within 30 days. A reasonable administrative fee may apply for repeated or voluminous requests.

For Volty specifically, you can inspect and edit your organisation's knowledge drive entries and per-contact memory from inside the product. Data export for Volty is currently on request via [email protected]; a self-serve export tool is in development.

Our Services are designed for businesses. Some of our customers operate childcare, schools, and education services — in those cases the customer is responsible for obtaining parental consent before submitting any child's data through Envoy, and Voltade processes such data only as a data intermediary on the customer's behalf.

We may update this policy as the Services evolve. The "Last updated" date at the top of the page reflects the most recent change. For material changes we'll notify you directly.

For privacy questions, requests, or complaints contact our Data Protection Officer at [email protected] or by post to Voltade Pte. Ltd., 75 Ayer Rajah Crescent, #01-16, Singapore 139953.