PHOXY Privacy Policy

PHOXY is operated by HMZ Digicorp, Sociedad Limitada (SL), NIF/CIF B02910099, established in Málaga, Spain. The service is offered to individuals and businesses in Europe. This notice covers account holders and people who call them.

For accounts, billing and service security, HMZ Digicorp determines the purposes of processing. For a business customer’s callers, messages and appointments, the business generally determines those purposes and PHOXY processes data on its instructions. A caller is not automatically a party to the PHOXY subscription. Personal-account use must also respect other people’s rights.

Account and organisation details, preferences and authentication records support access and account administration. Caller numbers, confirmed names, conversation transcripts, summaries, call times and duration support answering, messages and booking. Business knowledge, leads, tasks and private web-assistant conversations support the requested service. Avoid including sensitive information that is not needed.

Account service and billing rely on performance of the subscriber contract; statutory accounting and lawful requests rely on legal obligations. Security and abuse prevention may rely on legitimate interests, subject to necessity and balancing with your rights. The business customer must establish its own legal basis for caller processing, such as steps requested by the caller or a justified legitimate interest. Consent is used where legally required; an OAuth permission or confirmation checkbox is not, by itself, consent to every processing purpose.

Calls are processed by AI and can produce stored text transcripts and summaries. The assistant configuration disables audio/video recording; this is not a guarantee that telecom or voice providers retain no processing records. Google Calendar and Microsoft Outlook, when connected, supply availability and event details. PHOXY manages bookings in the selected writable calendar and checks other selected calendars for busy times. Disconnecting stops PHOXY’s use of the connection through its disconnection process; it does not erase existing provider events or prove deletion of all provider copies. Google data is used for requested calendar functions, not advertising; the Google API Services User Data Policy, including Limited Use, applies.

Number setup may require identity, address or business documents for carrier checks. Documents are private and may be accessed by their owner, authorised administrators and the relevant verification provider. Message drafts contain recipients, text and delivery status. Confirmation details are recorded only after an explicit action. New paid SMS/email options remain in simulation, without real sends. Stripe processes payments and card or wallet details; PHOXY keeps billing references, status and credits, not full card details. Essential account, security and billing emails are separate.

Access is limited by account and organisation permissions and authorised support needs. Relevant service paths include Lovable Cloud and its hosting infrastructure; Vapi, Deepgram, OpenAI, Anthropic and Microsoft Azure for applicable voice/AI processing; Twilio, DIDWW or Telnyx for the selected telephone service; Google or Microsoft for connected calendars; Stripe for payment; and the configured email provider, including Resend where enabled. Not every provider is used for every account. Processing can involve countries outside the EEA. Provider-specific locations, contractual safeguards and retention must be assessed separately; we do not promise exclusively European hosting or treat an OAuth permission as a transfer safeguard.

The workspace bot uses Google Gemini through the existing AI gateway or a server-configured Google API. When PDF import is enabled, the file is sent to Gemini to produce a draft for review; PHOXY does not save the original PDF in its storage. File contents and responses remain subject to the provider’s processing terms and retention periods. Avoid unnecessary personal information and review prices and conditions before saving.

Current call-history settings are 30 days for Free, 90 for Starter/Personal and 180 for Plus/legacy Pro. Enterprise uses the account’s configured period; without a period, data remains until deletion. The period applies to call rows, transcripts and summaries, not all account categories. Cleanup jobs remove eligible data; exact execution and provider copies are separate. Diagnostic tool logs have a 30-day cleanup target. Abandoned document deposits are eligible for the separate cleanup after 24 hours; validated documents are not covered by that rule. Accounts, business data, messages and uploaded documents remain subject to account deletion and applicable legal retention. Account deletion reconciles subscriptions and attempts external disconnection and resource removal before confirming completion; failures require retry. Existing external calendar events, payment records, carrier records and backups are not guaranteed to disappear immediately.

You may request access, rectification, erasure, restriction, objection and, where applicable, portability; consent can be withdrawn without affecting earlier lawful processing. Settings offer a paginated JSON account export. Screen CSV exports cover the loaded rows only. External-provider files, backups and certain operational records require a separate request. Callers should contact the business they called; PHOXY can assist it. Identity checks are proportionate and a confirmed name alone is not proof of identity. Requests normally receive a response within one month, with a reasoned extension where the GDPR allows it. You can complain to the AEPD (aepd.es) or your competent supervisory authority.

PHOXY uses session storage for sign-in and preferences such as language and selected organisation, and hosting may use routing and anti-abuse cookies. These must be limited to the requested service; optional tracking requires any applicable prior consent. The application does not enable advertising analytics in this version. Third-party hosted scripts must also be checked after deployment. Access controls and credential protection reduce risk but do not guarantee absolute security. Account holders must be adults; callers may include minors, so unnecessary collection should be avoided.

contact@phoxyassistant.com