Privacy Policy

1. Data controller

VOLANDOO SOLUTIONS SLU, Tax ID B44544914, with registered office at CALLE VERGE DEL PILAR, NUM 15, 46210 PICANYA - (VALENCIA), Spain, is the controller of the personal data processed in Orbitali.

You can contact us at info@volandoo.com or info@orbitali.ai. For data protection inquiries, you can write to the data protection officer at dpd@gesercos.es.

2. Data we process

We process the data needed to operate an AI voice agent platform for developers and businesses.

• Account and organization data: name, email, encrypted password, sessions, roles, invitations, account status, and profile preferences.
• Technical and security data: IP addresses, user agent, session identifiers, authentication logs, encrypted or hashed API keys, and visible key prefixes.
• Agent configuration: names, language, voice, prompts, instructions, greetings, server URLs, headers, secrets, tools, parameter schemas, and error configuration.
• Telephony and call data: origin and destination numbers, connected owned numbers, Telnyx or Twilio identifiers, call status, duration, timestamps, transcripts, messages, tool invocations, and associated responses.
• Knowledge data: uploaded files, name, description, type, size, extracted text, chunks, and embeddings required for the agent's semantic search.
• Usage and billing data: consumption, minutes, tokens, estimated costs, billing profile, tax or business name, Tax ID/VAT if provided, tax country, checkout sessions, and Stripe references.
• Support and communication data: messages sent by email, forms, tickets, sales requests, or conversations with our team.
• Booking, waitlist, or contact form data: name, email, company, phone if you provide it, notes, described problem, date of acceptance of the privacy policy, language, version of the policy accepted, and request context.
• Observability and web analytics data: performance metrics, errors, technical logs, product events, usage interactions, IP address, and user agent when analytics is enabled.

3. Purposes and legal basis

• Provide the contracted service, create accounts, authenticate users, manage organizations, API keys, agents, calls, knowledge, usage, and billing.
• Process calls in real time, generate voice responses, run configured tools, and deliver webhooks to the server you configure.
• Maintain security, prevent abuse, investigate failures, debug incidents, and protect the platform, our users, and third parties.
• Comply with legal, tax, accounting, and regulatory obligations and requests from competent authorities.
• Respond to support, sales, waitlist, meeting booking, or legal requests. We process this data on the basis of your consent when you submit the form and, where applicable, to take pre-contractual steps requested by you.
• Improve Orbitali through technical and product analytics. On the public website, analytics and campaign measurement are only enabled with your consent.

4. Calls, AI, and webhooks

Orbitali processes call audio, metadata, and conversational content to route calls, connect to real-time AI models, generate responses, create transcripts, log messages, and run tools.

When you configure a server URL, Orbitali may send events such as assistant-request or tool-call to your backend. You are responsible for the lawfulness of the data you receive, return, or decide to include in prompts, tool responses, and business logic.

You must ensure that callers have received the notices and consents required for their data, voice, and conversational content to be processed by Orbitali and by the necessary technical providers.

5. Providers and data sharing

We do not sell personal data. We share data only when necessary to provide Orbitali, comply with the law, or protect rights and safety.

• Telephony providers, such as Telnyx or Twilio, to connect owned numbers, calls, webhooks, and media streams.
• AI providers, such as Google Gemini for real-time voice processing and, where applicable, auxiliary generation.
• Embedding providers, such as OpenAI, to convert document or query text into search vectors.
• Payment and billing providers, such as Stripe, for payments, checkout, taxes, and invoices.
• Hosting, database, storage, email, support, and observability providers, including OpenObserve when configured.
• Calendar, CRM, and internal communication providers needed to manage requests, bookings, and sales follow-up.
• Public administrations, courts, law enforcement, or third parties when there is a legal obligation or it is necessary to defend rights.

6. Subprocessors and DPA

We publish a list of subprocessors relevant to Orbitali and the public website. We also offer a Data Processing Agreement (DPA) for customers who need to document processing on behalf of third parties.

7. International transfers

Some providers may process data outside the European Economic Area. When this happens, we will apply the safeguards required by applicable regulations, such as adequacy decisions, standard contractual clauses, or other valid mechanisms.

8. Retention

We retain data while the account is active or while it is necessary to provide Orbitali, comply with legal obligations, resolve disputes, maintain security, prevent fraud, and defend claims. Form, waitlist, and booking data is retained while we handle the request and reasonable follow-up, unless you request its deletion earlier. You can delete agents, documents, or other resources from the platform when the functionality is available. Some records may be kept for the applicable legal periods.

9. Security

We apply reasonable technical and organizational measures, including access controls, encryption or hashing of secrets where appropriate, environment separation, activity logging, and operational security practices. No internet-connected system can guarantee absolute security.

10. Your rights

You can request access, rectification, deletion, objection, restriction, portability, and withdrawal of consent where applicable by writing to dpd@gesercos.es or info@orbitali.ai. You can also lodge a complaint with the Spanish Data Protection Agency if you believe the processing does not comply with applicable regulations.

11. Minors

Orbitali is aimed at businesses, developers, and professionals. It is not intended for those under 16, and we do not knowingly collect data from minors to create user accounts.

12. Changes

We may update this policy to reflect changes to the product, providers, regulations, or internal practices. We will publish the current version on this page and indicate the date of last update.