Privacy policy
The short version: we collect what we need to run the website and VoiceGateway Cloud, and to bill for it. We never sell personal information, never use it for advertising, and never use your call data to train AI models. If you self-host VoiceGateway, your call data stays on your own infrastructure and we receive none of it.
Last updated: 18 October 2026
Who we are
VoiceGateway is a business name of Mahimai Labs Inc., a corporation in Ontario, Canada (“we”, “us”). This policy covers the website at voicegateway.dev, the documentation at docs.voicegateway.dev and VoiceGateway Cloud, our hosted service.
For call data that a Cloud customer sends to their workspace, the customer decides what is collected and why, and we process it on their behalf. If you spoke to an agent that one of our customers runs, please contact that business about your data first; we will help them answer you.
What we collect
- Waitlist email. When you join the waitlist, we store the email address you enter, with the time and the page it came from.
- Website analytics. PostHog measures visits, documentation and source links, and successful waitlist confirmations. On docs.voicegateway.dev it also records the text of searches and the top result, code copies, outbound links, and answers to “Was this page helpful?”, including any optional message you write. Analytics runs only on the production sites, uses in-memory identifiers, and does not record sessions or send your email address.
- Cloud account. Your email address, a hashed password (we never store the password itself), your organisation, role and invitations, and sign-in sessions. To slow down password guessing, we briefly keep failed sign-in attempts with the email address and network address they came from.
- Billing. Stripe collects your card details; we never see or store full card numbers. From Stripe we receive your name, email, billing address, plan, invoices and payment status, and we send Stripe the usage your workspace is billed on.
- Call data in Cloud. What your LiveKit project and agents send to your workspace: LiveKit webhooks and API reads about rooms, participants, phone calls, egress and ingress; agent traces, logs, metrics and transcripts; and call recordings, only for projects that turn recordings on. Phone numbers from LiveKit SIP are masked before they are stored, and secrets are removed from stored webhooks. The LiveKit API key and secret you connect are encrypted at rest.
- Support. The messages you send us and our replies.
How we use it
- To run VoiceGateway Cloud: show your calls, send alerts, invitations and password resets.
- To bill for subscriptions and usage, and to keep the records tax law requires.
- To keep the service secure, prevent abuse and fix problems.
- To answer support requests.
- To tell you about access and important product changes. You can opt out of product updates at any time.
- To improve the website and documentation, using the analytics described above.
Who we share it with
We share personal information only with service providers that help us run VoiceGateway, under contracts that limit their use of it:
- Stripe: payments, invoices and the billing portal.
- Cloudflare: hosting for the website, documentation and waitlist.
- PostHog: website and documentation analytics.
- Our cloud hosting provider: servers, databases and storage for VoiceGateway Cloud.
- Our email delivery provider: invitations, password resets and alerts.
We may also disclose information when the law requires it, to protect the rights and safety of our users or the public, or to a buyer if the business is sold, in which case this policy continues to apply. Email [email protected] for the current list of providers.
How long we keep it
- Raw call data in Cloud (events, traces, logs, metrics and transcripts) is deleted after 90 days.
- Samples of LiveKit layers (rooms, participants, workers, phone calls, egress and ingress) are deleted after 30 days.
- The call list and call summaries are kept while your workspace exists.
- Account data is kept while your account exists. When a workspace is closed, we delete its data, except billing records.
- Billing records are kept for as long as Canadian tax law requires.
- Waitlist emails are kept until you ask us to remove them.
How we protect it
- Traffic to the website and to VoiceGateway Cloud is encrypted with TLS.
- Passwords are hashed with Argon2id. Sessions are kept on the server; your browser holds only a random session cookie.
- LiveKit API secrets are encrypted at rest, and credentials are compared in constant time.
- Each workspace is isolated: members see only their own organisation, within the role they were given.
- Access to production systems is limited to the people who operate the service.
- VoiceGateway does not sit in the live audio path of your calls.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.
Where it is stored
Our providers may store and process information in Canada, the United States and other countries. Wherever it is processed, we protect it as this policy describes.
Your choices and rights
You can ask to see, correct, export or delete the personal information we hold about you, and withdraw consent where we rely on it. Email [email protected] and we will answer within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada, or the data protection authority where you live.
Children
VoiceGateway is a tool for businesses and developers. It is not directed at children, and we do not knowingly collect their information.
Changes
When we change this policy, we update the date above. If a change materially affects how we use your information, we will tell Cloud customers by email before it takes effect.
Contact
Questions about privacy? Email [email protected]. Mahimai Labs Inc., Toronto, Ontario, Canada.