Vulcan365 Voice Privacy Policy

1. About this policy

This policy describes how Vulcan365 handles information in Vulcan365 Voice, the mobile application that connects a phone to a Vulcan365-hosted business phone system. It is specific to the app. Our general Privacy Policy covers the vulcan365.com website.

Vulcan365 Voice is provided to businesses. Accounts are created by your organization's administrator, not by you, and the app cannot be used without a setup code issued by that administrator. The service is offered in the United States to users 18 and older.

In this policy, "we" and "us" mean Vulcan365. Where your organization decides what the service is used for, your organization is the controller of that information and we process it on their instructions.

2. Information the app collects

Account and device information

Your extension's SIP username, password, and phone-system domain, delivered to the app when you redeem a setup code.
A random installation identifier generated on your device. It identifies this installation to our servers and is not derived from any hardware identifier or advertising ID.
The device name you have given your phone, the platform (Android or iOS), and the app version.
The IP address and browser/app user agent seen when a setup code is redeemed, recorded so an administrator can see where a device was activated.

Calls

Call signaling and call detail records: the numbers involved, direction, start and end times, and duration.
Live microphone audio during a call. Call audio is carried between your device and the phone system for the duration of the call. Vulcan365 Voice does not record calls.

Text messages

The full text of SMS messages you send and receive on a business number assigned to you, together with the sending and receiving numbers, direction, delivery status, and timestamps.
Picture and other media attachments sent or received as MMS. Inbound attachments are copied to our storage because the carrier's links expire; outbound attachments are stored so the carrier can retrieve them for delivery.
Delivery receipts returned by the carrier.
Which conversations you have marked as read.

Safety and policy information

The versions of the Terms of Service and this Privacy Policy you accepted, and the date you accepted them.
A record that you confirmed you meet the minimum age. Your date of birth is checked on your device and is never stored or sent to us. We receive only the fact that the check passed.
Reports you file about a message or sender: the reason you chose, any detail you type, the reported number, and a reference to the reported message.
Numbers you have blocked, and the business line the block applies to.
Security and administrative records, such as failed sign-on attempts to the phone system and a log of device activations, policy acceptances, and device removals.

Push notifications

So the app can ring for an incoming call or alert you to a new message while it is in the background, your device registers a push token with Google Firebase Cloud Messaging and that token is associated with your extension through Microsoft Azure Notification Hubs.

What the app does not collect

We do not collect your contacts, photo library, calendar, or location.
We do not use advertising identifiers, behavioral analytics, or third-party advertising or analytics SDKs.
We do not record calls.
We do not read the SMS messages stored by your phone's own messaging app. Vulcan365 Voice only handles messages on your business number.

3. Why we use this information

To provide the service: to place and receive calls, send and receive text messages, and deliver notifications.
To keep the service safe: to act on abuse reports, enforce blocks, and investigate misuse of a business number.
To secure the service: to detect unauthorized access to the phone system and maintain an administrative audit trail.
To meet legal and contractual obligations: including telecommunications record-keeping and responses to lawful requests.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

4. Who we share it with

We share only what each provider needs to deliver the service:

Flowroute — our telecommunications carrier. Receives the sending and receiving numbers, the message text, and any attachments, because that is what delivering a text message over the public telephone network requires. Carriers keep their own records under their own retention obligations.
Google (Firebase Cloud Messaging) — delivers push notifications to Android devices. Receives the push token and a notification signal. Message content is not placed in push notifications.
Microsoft (Azure Notification Hubs) — routes push notifications to the right device.
Your organization. Administrators at your organization can see the numbers assigned to you, which devices are activated, and the message history on your business number. Vulcan365 Voice is a business tool; treat it as your employer's system.

We may also disclose information when required by law, to respond to lawful requests from public authorities, or to protect the rights and safety of users and the public.

5. How we protect it

Traffic between the app and our servers uses HTTPS. SIP signaling uses TLS, and call audio uses SRTP encryption where the phone system requires it.
Your SIP password and the app's access credential are held in your device's encrypted secure storage — Android Keystore or iOS Keychain — not in ordinary app settings.
The app's access credential is stored on our servers only as an irreversible hash. Setup codes are single-use, expire, and are also stored only as a hash.
Media attachments are reachable only through long, random, unguessable links.
Access to customer data by Vulcan365 staff is limited to those who need it to support the service and to review abuse reports.

No system is perfectly secure. We cannot guarantee the security of information transmitted over the public telephone network, which is not encrypted end to end by design.

6. How long we keep it

Retention differs for information tied to your device and information that belongs to your organization. This distinction matters, so we state it plainly:

Information	Retention	Removed when you remove the device?
SIP credential, access credential, installation identifier, app settings, cached messages on the phone	Held on the device until removed	Yes — erased from the phone and revoked on our servers
Push registration	Until the device is removed or the token expires	Yes
Device activation record and policy acceptance	Retained as an administrative record of the organization's account	Marked revoked; the record is kept
Text messages, attachments, and call detail records on the business number	Retained for as long as your organization's account is active, and afterwards as its service agreement and applicable law require	No — these belong to your organization, not to your handset
Abuse reports and blocked-number lists	Retained so repeat abuse can be recognized; blocks persist so a reinstall does not undo them	No
Security event records	Purged on a rolling schedule	No

Removing the app, or removing the device from within the app, does not delete your organization's call and message records. Those records belong to the business that holds the account, and Vulcan365 is required to keep them by its service agreement and by law. Requests to delete organization records must come from your organization's administrator.

7. Your choices and controls

Report a message or sender. Every conversation has plainly labeled Report and Block actions. Reports go to a Vulcan365 moderation queue and are reviewed by a person.
Block a sender. Blocking is enforced on our servers, not just in the app: a blocked sender's messages are not shown to you and do not generate notifications, and you cannot reply until you unblock them. Your blocks survive reinstalling the app. Blocking does not affect calls.
Manage your blocks. Settings › About lists everyone you have blocked and lets you unblock them.
Remove this device. Settings › About removes the device: it revokes the device's access on our servers and erases the account, messages, and settings held on the phone.
Permissions. The app asks for the microphone when you make or receive a call, the camera when you take a photo to send or scan a setup code, and notifications so it can ring. You can change these at any time in your phone's system settings; declining a permission disables only the feature that needs it.

See deleting your Vulcan365 Voice data for the full deletion process, including what to do if your phone is lost.

8. Children

Vulcan365 Voice is not directed to children. It is a business tool for users 18 and older, and the app checks your age on your device before setup. We do not knowingly collect information from anyone under 18. If you believe a minor has used the app, contact us at the address below and we will work with the account's administrator to remove the device.

9. Changes to this policy

We will post any changes on this page and update the date above. When the change is material, the app asks you to review and accept the new version before you can continue sending messages.

10. Contact us

Privacy questions about Vulcan365 Voice: [email protected]
Support and abuse reports: [email protected] or 205-725-5510

If your organization holds the account, your administrator can also raise a request on your behalf.